CVE-2020-14386

A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.

Or Cohen discovered that the AF_PACKET implementation in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14386)

It was discovered that the F2FS file system implementation in the Linux kernel did not properly perform bounds checking on xattrs in some situations. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2020-0067)

It was discovered that the Serial CAN interface driver in the Linux kernel did not properly initialize data. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-11494)

Mauricio Faria de Oliveira discovered that the aufs implementation in the Linux kernel improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to cause a denial of service. (CVE-2020-11935)

Piotr Krysiuk discovered that race conditions existed in the file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-12114)

Or Cohen discovered that the AF_PACKET implementation in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14386)

Hador Manor discovered that the DCCP protocol implementation in the Linux kernel improperly handled socket reuse, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-16119)

Giuseppe Scrivano discovered that the overlay file system in the Linux kernel did not properly perform permission checks in some situations. A local attacker could possibly use this to bypass intended restrictions and gain read access to restricted files. (CVE-2020-16120)

A flaw was found in the way the Linux kernel Bluetooth implementation handled L2CAP packets with A2MP CID. A remote attacker in adjacent range could use this flaw to crash the system causing denial of service or potentially execute arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2020-12351).

An information leak flaw was found in the way the Linux kernel's Bluetooth stack implementation handled initialization of stack memory when handling certain AMP packets. A remote attacker in adjacent range could use this flaw to leak small portions of stack memory on the system by sending a specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality (CVE-2020-12352).

A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability (CVE-2020-14385).

A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity (CVE-2020-14386).

A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (CVE-2020-14390).

A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability (CVE-2020-24490).

In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c (CVE-2020-25211).

get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv() (CVE-2020-25221).

The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices (CVE-2020-25284).

A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact (CVE-2020-25285).

A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability (CVE-2020-25641).

A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is…

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-14386: Fixed an overflow in tpacket_rcv in af_packet that could lead to a local privilege escalation ( bsc#1176069).

The following non-security bugs were fixed:

• bonding: check error value of register_netdevice() immediately (git-fixes).
• bonding: check return value of register_netdevice() in bond_newlink() (git-fixes).
• hippi: Fix a size used in a 'pci_free_consistent()' in an error handling path (git-fixes).
• mlx4: disable device on shutdown (git-fixes).
• mlxsw: core: Free EMAD transactions using kfree_rcu() (git-fixes).
• mlxsw: core: Increase scope of RCU read-side critical section (git-fixes).
• mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo (bsc#1175691).
• net/mlx5: Fix a bug of using ptp channel index as pin index (git-fixes).
• net/mlx5e: Fix error path of device attach (git-fixes).
• net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration (git-fixes).
• net: smc91x: Fix possible memory leak in smc_drv_probe() (git-fixes).
• sched/deadline: Initialize ->dl_boosted (bsc#1112178).
• scsi: lpfc: Add and rename a whole bunch of function parameter descriptions (bsc#1171558 bsc#1136666).
• scsi: lpfc: Add description for lpfc_release_rpi()'s 'ndlpl param (bsc#1171558 bsc#1136666).
• scsi: lpfc: Add missing misc_deregister() for lpfc_init() (bsc#1171558 bsc#1136666).
• scsi: lpfc: Ensure variable has the same stipulations as code using it (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix FCoE speed reporting (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix LUN loss after cable pull (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix RSCN timeout due to incorrect gidft counter (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix a bunch of kerneldoc misdemeanors (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix kerneldoc parameter formatting/misnaming/missing issues (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix no message shown for lpfc_hdw_queue out of range value (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix oops when unloading driver while running mds diags (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix retry of PRLI when status indicates its unsupported (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix some function parameter descriptions (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix typo in comment for ULP (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix validation of bsg reply lengths (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix-up around 120 documentation issues (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix-up formatting/docrot where appropriate (bsc#1171558 bsc#1136666).
• scsi: lpfc: NVMe remote port devloss_tmo from lldd (bsc#1171558 bsc#1136666 bsc#1173060).
• scsi: lpfc: Provide description for lpfc_mem_alloc()'s 'align' param (bsc#1171558 bsc#1136666).
• scsi: lpfc: Quieten some printks (bsc#1171558 bsc#1136666).
• scsi: lpfc: Remove unused variable 'pg_addr' (bsc#1171558 bsc#1136666).
• scsi: lpfc: Update lpfc version to 12.8.0.3 (bsc#1171558 bsc#1136666).
• scsi: lpfc: Use __printf() format notation (bsc#1171558 bsc#1136666).
• scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport (bsc#1171558 bsc#1136666).
• vxlan: Ensure FDB dump is performed under RCU (git-fixes).
• x86/mce/inject: Fix a wrong assignment of i_mce.status (bsc#1112178).
• x86/unwind/orc: Fix ORC for newly forked tasks (bsc#1058115).

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-14314: Fixed potential negative array index in do_split() in ext4 (bsc#1173798).
• CVE-2020-14386: Fixed an overflow in af_packet, which could lead to local privilege escalation (bsc#1176069).

The following non-security bugs were fixed:

• ACPICA: Do not increment operation_region reference counts for field units (git-fixes).
• ALSA: hda/realtek: Add model alc298-samsung-headphone (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Flex Book (git-fixes).
• ALSA: hda: avoid reset of sdo_limit (git-fixes).
• ALSA: isa: fix spelling mistakes in the comments (git-fixes).
• ALSA: usb-audio: Add capture support for Saffire 6 (USB 1.1) (git-fixes).
• ALSA: usb-audio: Update documentation comment for MS2109 quirk (git-fixes).
• ALSA: usb-audio: ignore broken processing/extension unit (git-fixes).
• ASoC: intel: Fix memleak in sst_media_open (git-fixes).
• ASoC: msm8916-wcd-analog: fix register Interrupt offset (git-fixes).
• ASoC: q6afe-dai: mark all widgets registers as SND_SOC_NOPM (git-fixes).
• ASoC: q6routing: add dummy register read/write function (git-fixes).
• ASoC: wm8994: Avoid attempts to read unreadable registers (git-fixes).
• Bluetooth: add a mutex lock to avoid UAF in do_enale_set (git-fixes).
• Drivers: hv: vmbus: Only notify Hyper-V for die events that are oops (bsc#1175128).
• HID: input: Fix devices that return multiple bytes in battery report (git-fixes).
• Input: psmouse - add a newline when printing 'proto' by sysfs (git-fixes).
• KVM: PPC: Book3S PR: Remove uninitialized_var() usage (bsc#1065729).
• KVM: Reinstall old memslots if arch preparation fails (bsc#1133021).
• KVM: arm64: Stop clobbering x0 for HVC_SOFT_RESTART (bsc#1133021).
• KVM: x86: Fix APIC page invalidation race (bsc#1133021).
• PCI: hv: Fix a timing issue which causes kdump to fail occasionally (bsc#1172871, git-fixes).
• RDMA/mlx5: Add missing srcu_read_lock in ODP implicit flow (jsc#SLE-8446).
• RDMA/mlx5: Fix typo in enum name (git-fixes).
• Revert 'scsi: qla2xxx: Disable T10-DIF feature with FC-NVMe during probe' (bsc#1171688 bsc#1174003).
• Revert 'scsi: qla2xxx: Fix crash on qla2x00_mailbox_command' (bsc#1171688 bsc#1174003).
• bdc: Fix bug causing crash after multiple disconnects (git-fixes).
• bfq: fix blkio cgroup leakage v4 (bsc#1175775).
• block: Fix the type of 'sts' in bsg_queue_rq() (git-fixes).
• bnxt_en: fix NULL dereference in case SR-IOV configuration fails (networking-stable-20_07_17).
• bonding: fix active-backup failover for current ARP slave (bsc#1174771).
• brcmfmac: To fix Bss Info flag definition Bug (git-fixes).
• brcmfmac: keep SDIO watchdog running when console_interval is non-zero (git-fixes).
• brcmfmac: set state of hanger slot to FREE when flushing PSQ (git-fixes).
• btrfs: add helper to get the end offset of a file extent item (bsc#1175546).
• btrfs: factor out inode items copy loop from btrfs_log_inode() (bsc#1175546).
• btrfs: fix memory leaks after failure to lookup checksums during inode logging (bsc#1175550).
• btrfs: fix missing file extent item for hole after ranged fsync (bsc#1175546).
• btrfs: make full fsyncs always operate on the entire file again (bsc#1175546).
• btrfs: make ranged full fsyncs more efficient (bsc#1175546).
• btrfs: remove useless check for copy_items() return value (bsc#1175546).
• btrfs: treat RWF_{,D}SYNC writes as sync for CRCs (bsc#1175493).
• config/x86_64: Make CONFIG_PINCTRL_AMD=y (bsc#1174800) The pinctrl driver has to be initialized before hid-i2c and others. For assuring it, change it built-in, since we can't put the module ordering. This change follows the SLE15-SP2 kernel behavior.
• cpumap: Use non-locked version __ptr_ring_consume_batched (git-fixes).
• crypto: aesni - Fix build with LLVM_IAS=1 (git-fixes).
• crypto: aesni - add compatibility with…

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25212: Fixed nfs getxattr kernel panic and memory overflow that could lead to crashes or privilege escalations (bsc#1176381).
• CVE-2020-14381: Fixed inode life-time issue in futex handling (bsc#1176011).
• CVE-2020-25643: Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (bnc#1177206).
• CVE-2020-25641: A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allowed a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability (bnc#1177121).
• CVE-2020-26088: A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a (bnc#1176990).
• CVE-2020-14390: When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (bnc#1176235 bnc#1176278).
• CVE-2020-0432: In skb_to_mamac of networking.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1176721).
• CVE-2020-0427: In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1176725).
• CVE-2020-0431: In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1176722).
• CVE-2020-0404: In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1176423).
• CVE-2020-25284: The rbd block device driver in drivers/block/rbd.c used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices, aka CID-f44d04e696fe (bnc#1176482).
• CVE-2020-14386: Memory corruption in af_apcket can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity (bnc#1176069).

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• Add de2b41be8fcc x86, vmlinux.lds: Page-align end of ..page_aligned sections
• Add f29dfa53cc8a x86/bugs/multihit: Fix mitigation reporting when VMX is not in use
• airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: asihpi: fix iounmap in error handler (git-fixes).
• ALSA: firewire-digi00x: exclude Avid Adrenaline from detection (git-fixes).
• ALSA; firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).
• ALSA: hda: Fix 2 channel swapping for Tegra (git-fixes).
• ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled (git-fixes).
• ALSA:…

This update syncs the RT kernel from the SUSE Linux Enterprise 15-SP2 codestream.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the kernel-devel-5.14.6-1.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).
• CVE-2020-14356: Fixed a null pointer dereference in cgroupv2 subsystem which could have led to privilege escalation (bsc#1175213).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).
• CVE-2020-24394: Fixed an issue which could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support (bsc#1175518).
• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The following non-security bugs were fixed:

• ACPI: kABI fixes for subsys exports (bsc#1174968).
• ACPI / LPSS: Resume BYT/CHT I2C controllers from resume_noirq (bsc#1174968).
• ACPI / LPSS: Use acpi_lpss_* instead of acpi_subsys_* functions for hibernate (bsc#1174968).
• ACPI: PM: Introduce 'poweroff' callbacks for ACPI PM domain and LPSS (bsc#1174968).
• ACPI: PM: Simplify and fix PM domain hibernation callbacks (bsc#1174968).
• ALSA: core: pcm_iec958: fix kernel-doc (bsc#1111666).
• ALSA: echoaduio: Drop superfluous volatile modifier (bsc#1111666).
• ALSA: echoaudio: Fix potential Oops in snd_echo_resume() (bsc#1111666).
• ALSA: hda: Add support for Loongson 7A1000 controller (bsc#1111666).
• ALSA: hda/ca0132 - Add new quirk ID for Recon3D (bsc#1111666).
• ALSA: hda/ca0132 - Fix AE-5 microphone selection commands (bsc#1111666).
• ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value (bsc#1111666).
• ALSA: hda: fix NULL pointer dereference during suspend (git-fixes).
• ALSA: hda: fix snd_hda_codec_cleanup() documentation (bsc#1111666).
• ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO (bsc#1111666).
• ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops (bsc#1111666).
• ALSA: hda/realtek: Add model alc298-samsung-headphone (git-fixes).
• ALSA: hda/realtek: Add mute LED and micmute LED support for HP systems (bsc#1111666).
• ALSA: hda/realtek - Add quirk for Lenovo Carbon X1 8th gen (bsc#1111666).
• ALSA: hda/realtek - Add quirk for MSI GE63 laptop (bsc#1111666).
• ALSA: hda/realtek - Add quirk for MSI GL63 (bsc#1111666).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Flex Book (git-fixes).
• ALSA: hda/realtek - change to suitable link model for ASUS platform (bsc#1111666).
• ALSA: hda/realtek - Check headset type by unplug and resume (bsc#1111666).
• ALSA: hda/realtek - Enable audio jacks of Acer vCopperbox with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer C20-820 with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31 with ALC256 (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer Veriton N4660G with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289 (bsc#1111666).
• ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289 (bsc#1111666).
• ALSA: hda/realtek - Enable Speaker for ASUS UX563 (bsc#1111666).
• ALSA: hda/realtek: Fix add a 'ultra_low_power' function for intel reference board (alc256) (bsc#1111666).
• ALSA: hda/realtek: Fixed ALC298 sound bug by adding quirk for Samsung Notebook Pen S (bsc#1111666).
• ALSA: hda/realtek - Fixed HP right speaker no sound (bsc#1111666).
• ALSA: hda/realtek - Fix Lenovo Thinkpad X1 Carbon 7th quirk subdevice id (bsc#1111666).
• ALSA: hda/realtek: Fix pin default on Intel NUC 8 Rugged (bsc#1111666).
• ALSA: hda/realtek - Fix unused…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).
• CVE-2020-14356: Fixed a null pointer dereference in cgroupv2 subsystem which could have led to privilege escalation (bsc#1175213).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).
• CVE-2020-24394: Fixed an issue which could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support (bsc#1175518).
• CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).
• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The following non-security bugs were fixed:

• ACPI: kABI fixes for subsys exports (bsc#1174968).
• ACPI / LPSS: Resume BYT/CHT I2C controllers from resume_noirq (bsc#1174968).
• ACPI / LPSS: Use acpi_lpss_* instead of acpi_subsys_* functions for hibernate (bsc#1174968).
• ACPI: PM: Introduce 'poweroff' callbacks for ACPI PM domain and LPSS (bsc#1174968).
• ACPI: PM: Simplify and fix PM domain hibernation callbacks (bsc#1174968).
• af_key: pfkey_dump needs parameter validation (git-fixes).
• agp/intel: Fix a memory leak on module initialisation failure (git-fixes).
• ALSA: core: pcm_iec958: fix kernel-doc (bsc#1111666).
• ALSA: echoaduio: Drop superfluous volatile modifier (bsc#1111666).
• ALSA: echoaudio: Fix potential Oops in snd_echo_resume() (bsc#1111666).
• ALSA: hda: Add support for Loongson 7A1000 controller (bsc#1111666).
• ALSA: hda/ca0132 - Add new quirk ID for Recon3D (bsc#1111666).
• ALSA: hda/ca0132 - Fix AE-5 microphone selection commands (bsc#1111666).
• ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value (bsc#1111666).
• ALSA: hda: fix NULL pointer dereference during suspend (git-fixes).
• ALSA: hda: fix snd_hda_codec_cleanup() documentation (bsc#1111666).
• ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO (bsc#1111666).
• ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops (bsc#1111666).
• ALSA: hda/realtek: Add model alc298-samsung-headphone (git-fixes).
• ALSA: hda/realtek: Add mute LED and micmute LED support for HP systems (bsc#1111666).
• ALSA: hda/realtek - Add quirk for Lenovo Carbon X1 8th gen (bsc#1111666).
• ALSA: hda/realtek - Add quirk for MSI GE63 laptop (bsc#1111666).
• ALSA: hda/realtek - Add quirk for MSI GL63 (bsc#1111666).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Flex Book (git-fixes).
• ALSA: hda/realtek - change to suitable link model for ASUS platform (bsc#1111666).
• ALSA: hda/realtek - Check headset type by unplug and resume (bsc#1111666).
• ALSA: hda/realtek - Enable audio jacks of Acer vCopperbox with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer C20-820 with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31 with ALC256 (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer Veriton N4660G with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289 (bsc#1111666).
• ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289 (bsc#1111666).
• ALSA: hda/realtek - Enable Speaker for ASUS UX563 (bsc#1111666).
• ALSA: hda/realtek: Fix add a 'ultra_low_power' function for intel reference board (alc256) (bsc#1111666).
• ALSA:…

The SUSE Linux Enterprise 12 SP2 kernel was updated to to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).
• CVE-2019-16746: Fixed an improper check of the length of variable elements in a beacon head, leading to a buffer overflow (bsc#1152107).
• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The following non-security bug was fixed:

• mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo (bsc#1175691).

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bug was fixed:

• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to 3.12.31 to receive various security and bugfixes.

The following security bug was fixed:

• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The following non-security bugs were fixed:

• EDAC: Fix reference count leaks (bsc#1112178).
• KVM: SVM: fix svn_pin_memory()'s use of get_user_pages_fast() (bsc#1112178).
• mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo (bsc#1175691).
• net/mlx5e: Fix error path of device attach (git-fixes).
• net/mlx5: Fix a bug of using ptp channel index as pin index (git-fixes).
• net: smc91x: Fix possible memory leak in smc_drv_probe() (git-fixes).
• sched/deadline: Initialize ->dl_boosted (bsc#1112178).
• scsi: lpfc: Add and rename a whole bunch of function parameter descriptions (bsc#1171558 bsc#1136666).
• scsi: lpfc: Add description for lpfc_release_rpi()'s 'ndlpl param (bsc#1171558 bsc#1136666).
• scsi: lpfc: Add missing misc_deregister() for lpfc_init() (bsc#1171558 bsc#1136666).
• scsi: lpfc: Ensure variable has the same stipulations as code using it (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix a bunch of kerneldoc misdemeanors (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix FCoE speed reporting (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix kerneldoc parameter formatting/misnaming/missing issues (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix LUN loss after cable pull (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix no message shown for lpfc_hdw_queue out of range value (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix oops when unloading driver while running mds diags (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix retry of PRLI when status indicates its unsupported (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix RSCN timeout due to incorrect gidft counter (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix some function parameter descriptions (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix typo in comment for ULP (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix-up around 120 documentation issues (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix-up formatting/docrot where appropriate (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix validation of bsg reply lengths (bsc#1171558 bsc#1136666).
• scsi: lpfc: NVMe remote port devloss_tmo from lldd (bsc#1171558 bsc#1136666 bsc#1173060).
• scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport (bsc#1171558 bsc#1136666).
• scsi: lpfc: Provide description for lpfc_mem_alloc()'s 'align' param (bsc#1171558 bsc#1136666).
• scsi: lpfc: Quieten some printks (bsc#1171558 bsc#1136666).
• scsi: lpfc: Remove unused variable 'pg_addr' (bsc#1171558 bsc#1136666).
• scsi: lpfc: Update lpfc version to 12.8.0.3 (bsc#1171558 bsc#1136666).
• scsi: lpfc: Use __printf() format notation (bsc#1171558 bsc#1136666).
• vxlan: Ensure FDB dump is performed under RCU (git-fixes).
• x86/fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task (bsc#1112178).
• x86/mce/inject: Fix a wrong assignment of i_mce.status (bsc#1112178).
• x86/unwind/orc: Fix ORC for newly forked tasks (bsc#1058115).

The SUSE Linux Enterprise 15 SP1 Azure kernel was updated to receive various security and bugfixes.

The following security bug was fixed:

• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The following non-security bugs were fixed:

• EDAC: Fix reference count leaks (bsc#1112178).
• KVM: SVM: fix svn_pin_memory()'s use of get_user_pages_fast() (bsc#1112178).
• mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo (bsc#1175691).
• sched/deadline: Initialize ->dl_boosted (bsc#1112178).
• scsi: lpfc: Add and rename a whole bunch of function parameter descriptions (bsc#1171558 bsc#1136666).
• scsi: lpfc: Add description for lpfc_release_rpi()'s 'ndlpl param (bsc#1171558 bsc#1136666).
• scsi: lpfc: Add missing misc_deregister() for lpfc_init() (bsc#1171558 bsc#1136666).
• scsi: lpfc: Ensure variable has the same stipulations as code using it (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix a bunch of kerneldoc misdemeanors (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix FCoE speed reporting (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix kerneldoc parameter formatting/misnaming/missing issues (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix LUN loss after cable pull (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix no message shown for lpfc_hdw_queue out of range value (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix oops when unloading driver while running mds diags (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix retry of PRLI when status indicates its unsupported (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix RSCN timeout due to incorrect gidft counter (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix some function parameter descriptions (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix typo in comment for ULP (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix-up around 120 documentation issues (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix-up formatting/docrot where appropriate (bsc#1171558 bsc#1136666).
• scsi: lpfc: Fix validation of bsg reply lengths (bsc#1171558 bsc#1136666).
• scsi: lpfc: NVMe remote port devloss_tmo from lldd (bsc#1171558 bsc#1136666 bsc#1173060).
• scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport (bsc#1171558 bsc#1136666).
• scsi: lpfc: Provide description for lpfc_mem_alloc()'s 'align' param (bsc#1171558 bsc#1136666).
• scsi: lpfc: Quieten some printks (bsc#1171558 bsc#1136666).
• scsi: lpfc: Remove unused variable 'pg_addr' (bsc#1171558 bsc#1136666).
• scsi: lpfc: Update lpfc version to 12.8.0.3 (bsc#1171558 bsc#1136666).
• scsi: lpfc: Use __printf() format notation (bsc#1171558 bsc#1136666).
• x86/fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task (bsc#1112178).
• x86/mce/inject: Fix a wrong assignment of i_mce.status (bsc#1112178).
• x86/unwind/orc: Fix ORC for newly forked tasks (bsc#1058115).

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bug was fixed:

• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The following non-security bugs were fixed:

• bcache: allocate meta data pages as compound pages (bsc#1172873).
• block: check queue's limits.discard_granularity in __blkdev_issue_discard() (bsc#1152148).
• block: improve discard bio alignment in __blkdev_issue_discard() (bsc#1152148).
• char: virtio: Select VIRTIO from VIRTIO_CONSOLE (bsc#1175667).
• dax: do not print error message for non-persistent memory block device (bsc#1171073).
• dax: print error message by pr_info() in __generic_fsdax_supported() (bsc#1171073).
• device property: Fix the secondary firmware node handling in set_primary_fwnode() (git-fixes).
• dpaa_eth: Fix one possible memleak in dpaa_eth_probe (bsc#1175996).
• drm/amd/powerplay: Fix hardmins not being sent to SMU for RV (git-fixes).
• drm/msm/a6xx: fix crashdec section name typo (git-fixes).
• drm/msm/adreno: fix updating ring fence (git-fixes).
• drm/msm/gpu: make ringbuffer readonly (git-fixes).
• drm/xen-front: Fix misused IS_ERR_OR_NULL checks (bsc#1065600).
• efi: Add support for EFI_RT_PROPERTIES table (bsc#1174029, bsc#1174110, bsc#1174111).
• efi: avoid error message when booting under Xen (bsc#1172419).
• efi/efivars: Expose RT service availability via efivars abstraction (bsc#1174029, bsc#1174110, bsc#1174111).
• efi: libstub/tpm: enable tpm eventlog function for ARM platforms (bsc#1173267).
• efi: Mark all EFI runtime services as unsupported on non-EFI boot (bsc#1174029, bsc#1174110, bsc#1174111).
• efi: Register EFI rtc platform device only when available (bsc#1174029, bsc#1174110, bsc#1174111).
• efi: Store mask of supported runtime services in struct efi (bsc#1174029, bsc#1174110, bsc#1174111).
• efi: Use EFI ResetSystem only when available (bsc#1174029, bsc#1174110, bsc#1174111).
• efi: Use more granular check for availability for variable services (bsc#1174029, bsc#1174110, bsc#1174111).
• ext4: handle read only external journal device (bsc#1176063).
• felix: Fix initialization of ioremap resources (bsc#1175997).
• Fix build error when CONFIG_ACPI is not set/enabled: (bsc#1065600).
• infiniband: hfi1: Use EFI GetVariable only when available (bsc#1174029, bsc#1174110, bsc#1174111).
• integrity: Check properly whether EFI GetVariable() is available (bsc#1174029, bsc#1174110, bsc#1174111).
• kabi: Fix kABI after EFI_RT_PROPERTIES table backport (bsc#1174029, bsc#1174110, bsc#1174111).
• kabi/severities: ignore kABI for net/ethernet/mscc/ References: bsc#1176001,bsc#1175999 Exported symbols from drivers/net/ethernet/mscc/ are only used by drivers/net/dsa/ocelot/
• mei: fix CNL itouch device number to match the spec (bsc#1175952).
• mei: me: disable mei interface on LBG servers (bsc#1175952).
• mei: me: disable mei interface on Mehlow server platforms (bsc#1175952).
• mmc: dt-bindings: Add resets/reset-names for Mediatek MMC bindings (git-fixes).
• mmc: mediatek: add optional module reset property (git-fixes).
• mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040 (git-fixes).
• net: dsa: felix: send VLANs on CPU port as egress-tagged (bsc#1175998).
• net: dsa: ocelot: the MAC table on Felix is twice as large (bsc#1175999).
• net: enetc: fix an issue about leak system resources (bsc#1176000).
• net: mscc: ocelot: fix untagged packet drops when enslaving to vlan aware bridge (bsc#1176001).
• obsolete_kmp: provide newer version than the obsoleted one (boo#1170232).
• PCI: Add device even if driver attach failed (git-fixes).
• PCI: Avoid Pericom USB controller OHCI/EHCI PME# defect (git-fixes).
• PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken (git-fixes).
• PM: sleep: core: Fix the handling of pending runtime resume requests (git-fixes).
• powerpc/book3s64/radix: Fix boot failure with large amount of guest memory (bsc#1176022 ltc#187208).
• powerpc/perf: Fix…

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).
• CVE-2019-16746: Fixed an improper check of the length of variable elements in a beacon head, leading to a buffer overflow (bsc#1152107).
• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The following non-security bugs were fixed:

• bonding: fix active-backup failover for current ARP slave (bsc#1174771).
• Drivers: hv: vmbus: Only notify Hyper-V for die events that are oops (bsc#1175127).
• ibmvnic: Fix IRQ mapping disposal in error path (bsc#1175112 ltc#187459).
• mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo (bsc#1175691).
• ocfs2: add trimfs dlm lock resource (bsc#1175228).
• ocfs2: add trimfs lock to avoid duplicated trims in cluster (bsc#1175228).
• ocfs2: fix the application IO timeout when fstrim is running (bsc#1175228).

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).
• CVE-2020-14356: Fixed a null pointer dereference in cgroupv2 subsystem which could have led to privilege escalation (bsc#1175213).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).
• CVE-2020-24394: Fixed an issue which could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support (bsc#1175518).
• CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).
• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The following non-security bugs were fixed:

• cifs: add support for fallocate mode 0 for non-sparse files (bsc#1175122).
• cifs: allow unlock flock and OFD lock across fork (bsc#1175122).
• cifs_atomic_open(): fix double-put on late allocation failure (bsc#1175122).
• cifs: Avoid doing network I/O while holding cache lock (bsc#1175122).
• cifs: call wake_up(&server->response_q) inside of cifs_reconnect() (bsc#1175122).
• cifs: Clean up DFS referral cache (bsc#1175122).
• cifs: document and cleanup dfs mount (bsc#1172428 bsc#1175122).
• cifs: do not ignore the SYNC flags in getattr (bsc#1175122).
• cifs: do not leak -EAGAIN for stat() during reconnect (bsc#1175122).
• cifs: do not share tcons with DFS (bsc#1175122).
• cifs: ensure correct super block for DFS reconnect (bsc#1175122).
• cifs: fail i/o on soft mounts if sessionsetup errors out (bsc#1175122).
• cifs: fiemap: do not return EINVAL if get nothing (bsc#1175122).
• cifs: Fix an error pointer dereference in cifs_mount() (bsc#1172428 bsc#1175122).
• cifs: fix double free error on share and prefix (bsc#1172428 bsc#1175122).
• cifs: fix leaked reference on requeued write (bsc#1175122).
• cifs: fix NULL dereference in match_prepath (bsc#1175122).
• cifs: Fix null pointer check in cifs_read (bsc#1175122).
• cifs: Fix potential deadlock when updating vol in cifs_reconnect() (bsc#1175122).
• cifs: fix potential mismatch of UNC paths (bsc#1175122).
• cifs: fix rename() by ensuring source handle opened with DELETE bit (bsc#1175122).
• cifs: Fix return value in __update_cache_entry (bsc#1175122).
• cifs: fix soft mounts hanging in the reconnect code (bsc#1175122).
• cifs: Fix task struct use-after-free on reconnect (bsc#1175122).
• cifs: fix uninitialised lease_key in open_shroot() (bsc#1175122).
• cifs: fix unitialized variable poential problem with network I/O cache lock patch (bsc#1175122).
• cifs: Get rid of kstrdup_const()'d paths (bsc#1175122).
• cifs: get rid of unused parameter in reconn_setup_dfs_targets() (bsc#1175122).
• cifs: handle empty list of targets in cifs_reconnect() (bsc#1172428 bsc#1175122).
• cifs: handle hostnames that resolve to same ip in failover (bsc#1175122).
• cifs: handle prefix paths in reconnect (bsc#1175122).
• cifs: handle RESP_GET_DFS_REFERRAL.PathConsumed in reconnect (bsc#1172428 bsc#1175122).
• cifs: improve read performance for page size 64KB & cache=strict & vers=2.1+ (bsc#1175122).
• cifs: Introduce helpers for finding TCP connection (bsc#1175122).
• cifs: make sure we do not overflow the max EA buffer size (bsc#1175122).
• cifs: make use of cap_unix(ses) in cifs_reconnect_tcon() (bsc#1175122).
• cifs: merge __{cifs,smb2}_reconnect_tcon into cifs_tree_connect() (bsc#1172428 bsc#1175122).
• cifs: Merge is_path_valid() into get_normalized_path() (bsc#1175122). -…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).
• CVE-2020-14356: Fixed a null pointer dereference in cgroupv2 subsystem which could have led to privilege escalation (bsc#1175213).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).
• CVE-2020-24394: Fixed an issue which could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support (bsc#1175518).
• CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).
• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The following non-security bugs were fixed:

• btrfs: remove a BUG_ON() from merge_reloc_roots() (bsc#1174784).
• cifs: document and cleanup dfs mount (bsc#1144333 bsc#1172428).
• cifs: Fix an error pointer dereference in cifs_mount() (bsc#1144333 bsc#1172428).
• cifs: fix double free error on share and prefix (bsc#1144333 bsc#1172428).
• cifs: handle empty list of targets in cifs_reconnect() (bsc#1144333 bsc#1172428).
• cifs: handle RESP_GET_DFS_REFERRAL.PathConsumed in reconnect (bsc#1144333 bsc#1172428).
• cifs: merge __{cifs,smb2}_reconnect_tcon into cifs_tree_connect() (bsc#1144333 bsc#1172428).
• cifs: only update prefix path of DFS links in cifs_tree_connect() (bsc#1144333 bsc#1172428).
• cifs: reduce number of referral requests in DFS link lookups (bsc#1144333 bsc#1172428).
• cifs: rename reconn_inval_dfs_target() (bsc#1144333 bsc#1172428).
• Drivers: hv: vmbus: Only notify Hyper-V for die events that are oops (bsc#1175127).
• ibmvnic: Fix IRQ mapping disposal in error path (bsc#1175112 ltc#187459).
• ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL (bsc#1175515).
• ip_tunnel: allow not to count pkts on tstats by setting skb's dev to NULL (bsc#1175515).
• ipvs: fix the connection sync failed in some cases (bsc#1174699).
• kabi: hide new parameter of ip6_dst_lookup_flow() (bsc#1165629).
• kabi: mask changes to struct ipv6_stub (bsc#1165629).
• mm: Avoid calling build_all_zonelists_init under hotplug context (bsc#1154366).
• mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo (bsc#1175691).
• ocfs2: add trimfs dlm lock resource (bsc#1175228).
• ocfs2: add trimfs lock to avoid duplicated trims in cluster (bsc#1175228).
• ocfs2: avoid inode removal while nfsd is accessing it (bsc#1172963).
• ocfs2: avoid inode removal while nfsd is accessing it (bsc#1172963).
• ocfs2: fix panic on nfs server over ocfs2 (bsc#1172963).
• ocfs2: fix panic on nfs server over ocfs2 (bsc#1172963).
• ocfs2: fix remounting needed after setfacl command (bsc#1173954).
• ocfs2: fix the application IO timeout when fstrim is running (bsc#1175228).
• ocfs2: load global_inode_alloc (bsc#1172963).
• ocfs2: load global_inode_alloc (bsc#1172963).
• powerpc/eeh: Fix pseries_eeh_configure_bridge() (bsc#1174689).
• powerpc/pseries: PCIE PHB reset (bsc#1174689).
• Revert 'ocfs2: fix panic on nfs server over ocfs2 (bsc#1172963).' This reverts commit 2638f62c6bc33d4c10ce0dddbf240aa80d366d7b.
• Revert 'ocfs2: load global_inode_alloc (bsc#1172963).' This reverts commit f04f670651f505cb354f26601ec5f5e4428f2f47.
• scsi: scsi_dh_alua: skip RTPG for devices only supporting active/optimized (bsc#1174978).
• selftests/livepatch: fix mem leaks in test-klp-shadow-vars (bsc#1071995).
• selftests/livepatch: more verification in test-klp-shadow-vars…

The SUSE Linux Enterprise 12 SP5 kernel RT was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2020-14386: Fixed a memory corruption which could have been exploited to gain root privileges from unprivileged processes (bsc#1176069).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-25212: Fixed A TOCTOU mismatch in the NFS client code which could have been used by local attackers to corrupt memory (bsc#1176381).
• CVE-2020-2521: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177511).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

The following non-security bugs were fixed:

• ACPI: EC: Reference count query handlers under lock (git-fixes).
• airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: asihpi: fix iounmap in error handler (git-fixes).
• ALSA: firewire-digi00x: exclude Avid Adrenaline from detection (git-fixes).
• ALSA; firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).
• ALSA: hda: Fix 2 channel swapping for Tegra (git-fixes).
• ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A (git-fixes).
• ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen (git-fixes).
• altera-stapl: altera_get_note: prevent write beyond end of 'key' (git-fixes).
• amd-xgbe: Add a check for an skb in the timestamp path (git-fixes).
• amd-xgbe: Add additional dynamic debug messages (git-fixes).
• amd-xgbe: Add additional ethtool statistics (git-fixes).
• amd-xgbe: Add ethtool show/set channels support (git-fixes).
• amd-xgbe: Add ethtool show/set ring parameter support (git-fixes).
• amd-xgbe: Add ethtool support to retrieve SFP module info (git-fixes).
• amd-xgbe: Add hardware features debug output (git-fixes).
• amd-xgbe: Add NUMA affinity support for IRQ hints (git-fixes).
• amd-xgbe: Add NUMA affinity support for memory allocations (git-fixes).
• amd-xgbe: Add per queue Tx and Rx statistics (git-fixes).
• amd-xgbe: Advertise FEC support with the KR re-driver (git-fixes).
• amd-xgbe: Always attempt link training in KR mode (git-fixes).
• amd-xgbe: Be sure driver shuts down cleanly on module removal (git-fixes). -…

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25643: Added range checks in ppp_cp_parse_cr() (bsc#1177206).
• CVE-2020-25641: Allowed for_each_bvec to support zero len bvec (bsc#1177121).
• CVE-2020-25645: Added transport ports in route lookup for geneve (bsc#1177511).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2020-14386: Fixed a memory corruption which could have been exploited to gain root privileges from unprivileged processes (bsc#1176069).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

The following non-security bugs were fixed:

• ALSA: firewire-digi00x: exclude Avid Adrenaline from detection (git-fixes).
• ALSA; firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A (git-fixes).
• ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen (git-fixes).
• arm64: KVM: Do not generate UNDEF when LORegion feature is present (jsc#SLE-4084).
• arm64: KVM: regmap: Fix unexpected switch fall-through (jsc#SLE-4084).
• asm-generic: fix -Wtype-limits compiler warnings (bsc#1112178).
• ASoC: tegra: Fix reference count leaks (git-fixes).
• batman-adv: Avoid uninitialized chaddr when handling DHCP (git-fixes).
• batman-adv: bla: use netif_rx_ni when not in interrupt context (git-fixes).
• bcache: allocate meta data pages as compound pages (bsc#1172873).
• bcache: Convert pr_<level> uses to a more typical style (git fixes (block drivers)).
• bcache: fix overflow in offset_to_stripe() (git fixes (block drivers)).
• bcm63xx_enet: correct clock usage (git-fixes).
• bcm63xx_enet: do not write to random DMA channel on BCM6345 (git-fixes).
• bitfield.h: do not compile-time validate _val in FIELD_FIT (git fixes (bitfield)).
• blktrace: fix debugfs use after free (git fixes (block drivers)).
• block: add docs for gendisk / request_queue refcount helpers (git fixes (block drivers)).
• block: check queue's limits.discard_granularity in __blkdev_issue_discard() (bsc#1152148).
• block: improve discard bio alignment in __blkdev_issue_discard() (bsc#1152148).
• block: revert back to synchronous request_queue removal (git fixes (block drivers)).
• block: Use non _rcu version of list functions for tag_set_list (git-fixes).
• bnxt_en: Fix completion ring sizing with TPA enabled (networking-stable-20_07_29).
• bonding: check error value of register_netdevice() immediately (git-fixes).
• bonding: check return value of register_netdevice() in bond_newlink() (git-fixes).
• bonding: use nla_get_u64 to extract the value for IFLA_BOND_AD_ACTOR_SYSTEM (git-fixes).
• btrfs: require only sector size alignment for parent eb bytenr (bsc#1176789).
• btrfs: tree-checker: fix the error message for transid error (bsc#1176788).
• ceph: do not allow setlease on cephfs (bsc#1177041).
• ceph: fix potential mdsc use-after-free crash…

This update for the Linux Kernel 4.12.14-197_26 fixes several issues.

The following security issues were fixed:

• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-0431: In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bsc#1176722)
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c (bsc#1176381).
• CVE-2020-14386: Fixed a memory corruption which could have lead to an attacker gaining root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity (bsc#1176069).
• CVE-2020-24394: The NFS server code can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support. This occurs because the current umask is not considered (bsc#1175518).

This update for the Linux Kernel 5.3.18-24_9 fixes several issues.

The following security issues were fixed:

• CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c (bsc#1176381).
• CVE-2020-14386: Fixed a memory corruption which could have lead to an attacker gaining root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity (bsc#1176069).

This update for the Linux Kernel 5.3.18-22 fixes several issues.

The following security issues were fixed:

• CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c (bsc#1176381).
• CVE-2020-14386: Fixed a memory corruption which could have lead to an attacker gaining root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity (bsc#1176069).
• CVE-2020-24394: The NFS server code can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support. This occurs because the current umask is not considered (bsc#1175518).

This update for the Linux Kernel 4.12.14-197_48 fixes several issues.

The following security issues were fixed:

• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c (bsc#1176381).
• CVE-2020-14386: Fixed a memory corruption which could have lead to an attacker gaining root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity (bsc#1176069).
• CVE-2020-24394: The NFS server code can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support. This occurs because the current umask is not considered (bsc#1175518).

This update for the Linux Kernel 4.12.14-120 fixes several issues.

The following security issues were fixed:

• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-0431: In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bsc#1176722)
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c (bsc#1176381).
• CVE-2020-14386: Fixed a memory corruption which could have lead to an attacker gaining root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity (bsc#1176069).
• CVE-2020-24394: The NFS server code can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support. This occurs because the current umask is not considered (bsc#1175518).

This update for the Linux Kernel 4.12.14-122_29 fixes several issues.

The following security issues were fixed:

• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c (bsc#1176381).
• CVE-2020-14386: Fixed a memory corruption which could have lead to an attacker gaining root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity (bsc#1176069).
• CVE-2020-24394: The NFS server code can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support. This occurs because the current umask is not considered (bsc#1175518).

This update for the Linux Kernel 4.4.180-94_107 fixes several issues.

The following security issues were fixed:

• CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with system execution privileges needed. User interaction is not needed for exploitation. (bsc#1176724)
• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-0431: In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bsc#1176722)
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c (bsc#1176381).
• CVE-2020-14386: Fixed a memory corruption which could have lead to an attacker gaining root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity (bsc#1176069).

Or Cohen discovered that the AF_PACKET implementation in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.