CVE-2020-1749

A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.

A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3639: Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4 (bnc#1085308 bnc#1087082 bnc#1172782 bnc#1172783). Mitigations for Arm had not been included yet.
• CVE-2020-14314: Fixed potential negative array index in do_split() (bsc#1173798).
• CVE-2020-14331: Fixed a buffer over write in vgacon_scroll (bnc#1174205).
• CVE-2020-14356: A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system (bnc#1175213).
• CVE-2020-1749: Some ipv6 protocols were not encrypted over ipsec tunnels (bsc#1165629).
• CVE-2020-24394: fs/nfsd/vfs.c (in the NFS server) could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered (bnc#1175518).

The following non-security bugs were fixed:

• ACPI: kABI fixes for subsys exports (bsc#1174968).
• ACPI / LPSS: Resume BYT/CHT I2C controllers from resume_noirq (bsc#1174968).
• ACPI / LPSS: Use acpi_lpss_* instead of acpi_subsys_* functions for hibernate (bsc#1174968).
• ACPI: PM: Introduce 'poweroff' callbacks for ACPI PM domain and LPSS (bsc#1174968).
• ACPI: PM: Simplify and fix PM domain hibernation callbacks (bsc#1174968).
• af_key: pfkey_dump needs parameter validation (git-fixes).
• agp/intel: Fix a memory leak on module initialisation failure (git-fixes).
• ALSA: core: pcm_iec958: fix kernel-doc (bsc#1111666).
• ALSA: echoaduio: Drop superfluous volatile modifier (bsc#1111666).
• ALSA: echoaudio: Fix potential Oops in snd_echo_resume() (bsc#1111666).
• ALSA: hda: Add support for Loongson 7A1000 controller (bsc#1111666).
• ALSA: hda/ca0132 - Add new quirk ID for Recon3D (bsc#1111666).
• ALSA: hda/ca0132 - Fix AE-5 microphone selection commands (bsc#1111666).
• ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value (bsc#1111666).
• ALSA: hda: fix snd_hda_codec_cleanup() documentation (bsc#1111666).
• ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO (bsc#1111666).
• ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops (bsc#1111666).
• ALSA: hda/realtek: Add model alc298-samsung-headphone (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Flex Book (git-fixes).
• ALSA: hda/realtek: Fix pin default on Intel NUC 8 Rugged (bsc#1111666).
• ALSA: hda/realtek - Fix unused variable warning (bsc#1111666).
• ALSA: hda - reverse the setting value in the micmute_led_set (bsc#1111666).
• ALSA: pci: delete repeated words in comments (bsc#1111666).
• ALSA: seq: oss: Serialize ioctls (bsc#1111666).
• ALSA: usb-audio: Add capture support for Saffire 6 (USB 1.1) (git-fixes).
• ALSA: usb-audio: add quirk for Pioneer DDJ-RB (bsc#1111666).
• ALSA: usb-audio: add startech usb audio dock name (bsc#1111666).
• ALSA: usb-audio: Add support for Lenovo ThinkStation P620 (bsc#1111666).
• ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support (bsc#1111666).
• ALSA: usb-audio: Disable Lenovo P620 Rear line-in volume control (bsc#1111666).
• ALSA: usb-audio: endpoint : remove needless check before usb_free_coherent() (bsc#1111666).
• ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 (bsc#1174625).
• ALSA: usb-audio: fix spelling mistake 'buss' -> 'bus' (bsc#1111666).
• ALSA: usb-audio: ignore broken processing/extension unit (git-fixes).
• ALSA: usb-audio: Update documentation comment for MS2109 quirk…

This update syncs the RT kernel from the SUSE Linux Enterprise 15-SP2 codestream.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for the Linux Kernel 4.4.178-94_91 fixes several issues.

The following security issues were fixed:

• CVE-2020-1749: Fixed an issue in the networking protocols in encrypted IPsec tunnel (bsc#1165631)
• CVE-2019-5108: Fixed an issue where by triggering AP to send IAPP location updates for stations before the required authentication process has completed could have led to denial-of-service (bsc#1159913).

This update for the Linux Kernel 4.12.14-197_34 fixes one issue.

The following security issue was fixed:

• CVE-2020-1749: Fixed an issue in the networking protocols in encrypted IPsec tunnel (bsc#1165631)

This update for the Linux Kernel 4.12.14-150_41 fixes several issues.

The following security issues were fixed:

• CVE-2020-1749: Fixed an issue in the networking protocols in encrypted IPsec tunnel (bsc#1165631)
• CVE-2019-5108: Fixed an issue where by triggering AP to send IAPP location updates for stations before the required authentication process has completed could have led to denial-of-service (bsc#1159913).

This update for the Linux Kernel 4.12.14-197_37 fixes one issue.

The following security issue was fixed:

• CVE-2020-1749: Fixed a vulnerability where in some cases IPv6 traffic would not be encrypted over an IPsec tunnel (bsc#1165629).

This update for the Linux Kernel 4.12.14-197_40 fixes several issues.

The following security issues were fixed:

• CVE-2020-12653: Fixed a buffer overflow in mwifiex_cmd_append_vsie_tlv() which could have allowed local users to gain privileges or cause a denial of service (bsc#1171254).
• CVE-2020-12654: Fixed a heap-based buffer overflow in mwifiex_ret_wmm_get_status() which could have been triggered by a remote AP to trigger (bsc#1171252).
• CVE-2020-1749: Fixed an improper implementation in some IPsec protocols where the data were sent unencrypted allowing an attacker to read them (bsc#1165631).

This update for the Linux Kernel 4.4.121-92_129 fixes several issues.

The following security issues were fixed:

• CVE-2020-12653: Fixed a buffer overflow in mwifiex_cmd_append_vsie_tlv() which could have allowed local users to gain privileges or cause a denial of service (bsc#1171254).
• CVE-2020-12654: Fixed a heap-based buffer overflow in mwifiex_ret_wmm_get_status() which could have been triggered by a remote AP to trigger (bsc#1171252).
• CVE-2020-1749: Fixed an improper implementation in some IPsec protocols where the data were sent unencrypted allowing an attacker to read them (bsc#1165631).

This update for the Linux Kernel 4.4.180-94_116 fixes several issues.

The following security issues were fixed:

• CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172437).
• CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171254).
• CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171252).
• CVE-2020-1749: Fixed an issue where some ipv6 protocols were not encrypted over ipsec tunnel (bsc#1165631).

This update for the Linux Kernel 4.4.180-94_127 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2020-1749: Fixed a flaw in IPsec where some IPv6 protocols were not encrypted (bsc#1165631).

This update for the Linux Kernel 4.12.14-95_54 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2020-15780: Fixed a lockdown bypass via injection of malicious ACPI tables via configfs (bsc#1174186).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2020-1749: Fixed a flaw in IPsec where some IPv6 protocols were not encrypted (bsc#1165631).

This update for the Linux Kernel 4.12.14-197_45 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2020-15780: Fixed a lockdown bypass via injection of malicious ACPI tables via configfs (bsc#1174186).
• CVE-2020-1749: Fixed a flaw in IPsec where some IPv6 protocols were not encrypted (bsc#1165631).

This update for the Linux Kernel 4.12.14-150_52 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2020-15780: Fixed a lockdown bypass via injection of malicious ACPI tables via configfs (bsc#1174186).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2020-1749: Fixed a flaw in IPsec where some IPv6 protocols were not encrypted (bsc#1165631).

This update for the Linux Kernel 4.12.14-150_55 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2020-1749: Fixed a flaw in IPsec where some IPv6 protocols were not encrypted (bsc#1165631).

This update for the Linux Kernel 4.12.14-197_51 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2020-1749: Fixed a flaw in IPsec where some IPv6 protocols were not encrypted (bsc#1165631).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).
• CVE-2020-14356: Fixed a null pointer dereference in cgroupv2 subsystem which could have led to privilege escalation (bsc#1175213).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).
• CVE-2020-24394: Fixed an issue which could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support (bsc#1175518).

The following non-security bugs were fixed:

• ACPI: kABI fixes for subsys exports (bsc#1174968).
• ACPI / LPSS: Resume BYT/CHT I2C controllers from resume_noirq (bsc#1174968).
• ACPI / LPSS: Use acpi_lpss_* instead of acpi_subsys_* functions for hibernate (bsc#1174968).
• ACPI: PM: Introduce 'poweroff' callbacks for ACPI PM domain and LPSS (bsc#1174968).
• ACPI: PM: Simplify and fix PM domain hibernation callbacks (bsc#1174968).
• af_key: pfkey_dump needs parameter validation (git-fixes).
• agp/intel: Fix a memory leak on module initialisation failure (git-fixes).
• ALSA: core: pcm_iec958: fix kernel-doc (bsc#1111666).
• ALSA: echoaduio: Drop superfluous volatile modifier (bsc#1111666).
• ALSA: echoaudio: Fix potential Oops in snd_echo_resume() (bsc#1111666).
• ALSA: hda: Add support for Loongson 7A1000 controller (bsc#1111666).
• ALSA: hda/ca0132 - Add new quirk ID for Recon3D (bsc#1111666).
• ALSA: hda/ca0132 - Fix AE-5 microphone selection commands (bsc#1111666).
• ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value (bsc#1111666).
• ALSA: hda: fix NULL pointer dereference during suspend (git-fixes).
• ALSA: hda: fix snd_hda_codec_cleanup() documentation (bsc#1111666).
• ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO (bsc#1111666).
• ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops (bsc#1111666).
• ALSA: hda/realtek: Add model alc298-samsung-headphone (git-fixes).
• ALSA: hda/realtek: Add mute LED and micmute LED support for HP systems (bsc#1111666).
• ALSA: hda/realtek - Add quirk for Lenovo Carbon X1 8th gen (bsc#1111666).
• ALSA: hda/realtek - Add quirk for MSI GE63 laptop (bsc#1111666).
• ALSA: hda/realtek - Add quirk for MSI GL63 (bsc#1111666).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Flex Book (git-fixes).
• ALSA: hda/realtek - change to suitable link model for ASUS platform (bsc#1111666).
• ALSA: hda/realtek - Check headset type by unplug and resume (bsc#1111666).
• ALSA: hda/realtek - Enable audio jacks of Acer vCopperbox with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer C20-820 with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31 with ALC256 (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer Veriton N4660G with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289 (bsc#1111666).
• ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289 (bsc#1111666).
• ALSA: hda/realtek - Enable Speaker for ASUS UX563 (bsc#1111666).
• ALSA: hda/realtek: Fix add a 'ultra_low_power' function for intel reference board (alc256) (bsc#1111666).
• ALSA: hda/realtek: Fixed ALC298 sound bug by adding quirk for Samsung Notebook Pen S (bsc#1111666).
• ALSA: hda/realtek - Fixed HP right speaker no sound (bsc#1111666).
• ALSA: hda/realtek - Fix Lenovo Thinkpad X1 Carbon 7th quirk subdevice id (bsc#1111666).
• ALSA: hda/realtek: Fix pin default on Intel NUC 8 Rugged…

The SUSE Linux Enterprise 15 SP1 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).
• CVE-2020-14356: Fixed a null pointer dereference in cgroupv2 subsystem which could have led to privilege escalation (bsc#1175213).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).
• CVE-2020-24394: Fixed an issue which could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support (bsc#1175518).
• CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).

The following non-security bugs were fixed:

• ACPI: kABI fixes for subsys exports (bsc#1174968).
• ACPI / LPSS: Resume BYT/CHT I2C controllers from resume_noirq (bsc#1174968).
• ACPI / LPSS: Use acpi_lpss_* instead of acpi_subsys_* functions for hibernate (bsc#1174968).
• ACPI: PM: Introduce 'poweroff' callbacks for ACPI PM domain and LPSS (bsc#1174968).
• ACPI: PM: Simplify and fix PM domain hibernation callbacks (bsc#1174968).
• af_key: pfkey_dump needs parameter validation (git-fixes).
• agp/intel: Fix a memory leak on module initialisation failure (git-fixes).
• ALSA: core: pcm_iec958: fix kernel-doc (bsc#1111666).
• ALSA: echoaduio: Drop superfluous volatile modifier (bsc#1111666).
• ALSA: echoaudio: Fix potential Oops in snd_echo_resume() (bsc#1111666).
• ALSA: hda: Add support for Loongson 7A1000 controller (bsc#1111666).
• ALSA: hda/ca0132 - Add new quirk ID for Recon3D (bsc#1111666).
• ALSA: hda/ca0132 - Fix AE-5 microphone selection commands (bsc#1111666).
• ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value (bsc#1111666).
• ALSA: hda: fix NULL pointer dereference during suspend (git-fixes).
• ALSA: hda: fix snd_hda_codec_cleanup() documentation (bsc#1111666).
• ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO (bsc#1111666).
• ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops (bsc#1111666).
• ALSA: hda/realtek: Add model alc298-samsung-headphone (git-fixes).
• ALSA: hda/realtek: Add mute LED and micmute LED support for HP systems (bsc#1111666).
• ALSA: hda/realtek - Add quirk for Lenovo Carbon X1 8th gen (bsc#1111666).
• ALSA: hda/realtek - Add quirk for MSI GE63 laptop (bsc#1111666).
• ALSA: hda/realtek - Add quirk for MSI GL63 (bsc#1111666).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Flex Book (git-fixes).
• ALSA: hda/realtek - change to suitable link model for ASUS platform (bsc#1111666).
• ALSA: hda/realtek - Check headset type by unplug and resume (bsc#1111666).
• ALSA: hda/realtek - Enable audio jacks of Acer vCopperbox with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer C20-820 with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31 with ALC256 (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer Veriton N4660G with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289 (bsc#1111666).
• ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289 (bsc#1111666).
• ALSA: hda/realtek - Enable Speaker for ASUS UX563 (bsc#1111666).
• ALSA: hda/realtek: Fix add a 'ultra_low_power' function for intel reference board (alc256) (bsc#1111666).
• ALSA: hda/realtek: Fixed ALC298 sound bug by adding quirk for Samsung Notebook Pen S (bsc#1111666). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).
• CVE-2020-14356: Fixed a null pointer dereference in cgroupv2 subsystem which could have led to privilege escalation (bsc#1175213).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).
• CVE-2020-24394: Fixed an issue which could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support (bsc#1175518).
• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The following non-security bugs were fixed:

• ACPI: kABI fixes for subsys exports (bsc#1174968).
• ACPI / LPSS: Resume BYT/CHT I2C controllers from resume_noirq (bsc#1174968).
• ACPI / LPSS: Use acpi_lpss_* instead of acpi_subsys_* functions for hibernate (bsc#1174968).
• ACPI: PM: Introduce 'poweroff' callbacks for ACPI PM domain and LPSS (bsc#1174968).
• ACPI: PM: Simplify and fix PM domain hibernation callbacks (bsc#1174968).
• ALSA: core: pcm_iec958: fix kernel-doc (bsc#1111666).
• ALSA: echoaduio: Drop superfluous volatile modifier (bsc#1111666).
• ALSA: echoaudio: Fix potential Oops in snd_echo_resume() (bsc#1111666).
• ALSA: hda: Add support for Loongson 7A1000 controller (bsc#1111666).
• ALSA: hda/ca0132 - Add new quirk ID for Recon3D (bsc#1111666).
• ALSA: hda/ca0132 - Fix AE-5 microphone selection commands (bsc#1111666).
• ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value (bsc#1111666).
• ALSA: hda: fix NULL pointer dereference during suspend (git-fixes).
• ALSA: hda: fix snd_hda_codec_cleanup() documentation (bsc#1111666).
• ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO (bsc#1111666).
• ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops (bsc#1111666).
• ALSA: hda/realtek: Add model alc298-samsung-headphone (git-fixes).
• ALSA: hda/realtek: Add mute LED and micmute LED support for HP systems (bsc#1111666).
• ALSA: hda/realtek - Add quirk for Lenovo Carbon X1 8th gen (bsc#1111666).
• ALSA: hda/realtek - Add quirk for MSI GE63 laptop (bsc#1111666).
• ALSA: hda/realtek - Add quirk for MSI GL63 (bsc#1111666).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Flex Book (git-fixes).
• ALSA: hda/realtek - change to suitable link model for ASUS platform (bsc#1111666).
• ALSA: hda/realtek - Check headset type by unplug and resume (bsc#1111666).
• ALSA: hda/realtek - Enable audio jacks of Acer vCopperbox with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer C20-820 with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31 with ALC256 (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer Veriton N4660G with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289 (bsc#1111666).
• ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289 (bsc#1111666).
• ALSA: hda/realtek - Enable Speaker for ASUS UX563 (bsc#1111666).
• ALSA: hda/realtek: Fix add a 'ultra_low_power' function for intel reference board (alc256) (bsc#1111666).
• ALSA: hda/realtek: Fixed ALC298 sound bug by adding quirk for Samsung Notebook Pen S (bsc#1111666).
• ALSA: hda/realtek - Fixed HP right speaker no sound (bsc#1111666).
• ALSA: hda/realtek - Fix Lenovo Thinkpad X1 Carbon 7th quirk subdevice id (bsc#1111666).
• ALSA: hda/realtek: Fix pin default on Intel NUC 8 Rugged (bsc#1111666).
• ALSA: hda/realtek - Fix unused…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).
• CVE-2020-14356: Fixed a null pointer dereference in cgroupv2 subsystem which could have led to privilege escalation (bsc#1175213).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).
• CVE-2020-24394: Fixed an issue which could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support (bsc#1175518).
• CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).
• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The following non-security bugs were fixed:

• ACPI: kABI fixes for subsys exports (bsc#1174968).
• ACPI / LPSS: Resume BYT/CHT I2C controllers from resume_noirq (bsc#1174968).
• ACPI / LPSS: Use acpi_lpss_* instead of acpi_subsys_* functions for hibernate (bsc#1174968).
• ACPI: PM: Introduce 'poweroff' callbacks for ACPI PM domain and LPSS (bsc#1174968).
• ACPI: PM: Simplify and fix PM domain hibernation callbacks (bsc#1174968).
• af_key: pfkey_dump needs parameter validation (git-fixes).
• agp/intel: Fix a memory leak on module initialisation failure (git-fixes).
• ALSA: core: pcm_iec958: fix kernel-doc (bsc#1111666).
• ALSA: echoaduio: Drop superfluous volatile modifier (bsc#1111666).
• ALSA: echoaudio: Fix potential Oops in snd_echo_resume() (bsc#1111666).
• ALSA: hda: Add support for Loongson 7A1000 controller (bsc#1111666).
• ALSA: hda/ca0132 - Add new quirk ID for Recon3D (bsc#1111666).
• ALSA: hda/ca0132 - Fix AE-5 microphone selection commands (bsc#1111666).
• ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value (bsc#1111666).
• ALSA: hda: fix NULL pointer dereference during suspend (git-fixes).
• ALSA: hda: fix snd_hda_codec_cleanup() documentation (bsc#1111666).
• ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO (bsc#1111666).
• ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops (bsc#1111666).
• ALSA: hda/realtek: Add model alc298-samsung-headphone (git-fixes).
• ALSA: hda/realtek: Add mute LED and micmute LED support for HP systems (bsc#1111666).
• ALSA: hda/realtek - Add quirk for Lenovo Carbon X1 8th gen (bsc#1111666).
• ALSA: hda/realtek - Add quirk for MSI GE63 laptop (bsc#1111666).
• ALSA: hda/realtek - Add quirk for MSI GL63 (bsc#1111666).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Flex Book (git-fixes).
• ALSA: hda/realtek - change to suitable link model for ASUS platform (bsc#1111666).
• ALSA: hda/realtek - Check headset type by unplug and resume (bsc#1111666).
• ALSA: hda/realtek - Enable audio jacks of Acer vCopperbox with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer C20-820 with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31 with ALC256 (bsc#1111666).
• ALSA: hda/realtek: Enable headset mic of Acer Veriton N4660G with ALC269VC (bsc#1111666).
• ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289 (bsc#1111666).
• ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289 (bsc#1111666).
• ALSA: hda/realtek - Enable Speaker for ASUS UX563 (bsc#1111666).
• ALSA: hda/realtek: Fix add a 'ultra_low_power' function for intel reference board (alc256) (bsc#1111666).
• ALSA:…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).
• CVE-2020-14356: Fixed a null pointer dereference in cgroupv2 subsystem which could have led to privilege escalation (bsc#1175213).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).
• CVE-2020-24394: Fixed an issue which could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support (bsc#1175518).
• CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).
• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The following non-security bugs were fixed:

• cifs: add support for fallocate mode 0 for non-sparse files (bsc#1175122).
• cifs: allow unlock flock and OFD lock across fork (bsc#1175122).
• cifs_atomic_open(): fix double-put on late allocation failure (bsc#1175122).
• cifs: Avoid doing network I/O while holding cache lock (bsc#1175122).
• cifs: call wake_up(&server->response_q) inside of cifs_reconnect() (bsc#1175122).
• cifs: Clean up DFS referral cache (bsc#1175122).
• cifs: document and cleanup dfs mount (bsc#1172428 bsc#1175122).
• cifs: do not ignore the SYNC flags in getattr (bsc#1175122).
• cifs: do not leak -EAGAIN for stat() during reconnect (bsc#1175122).
• cifs: do not share tcons with DFS (bsc#1175122).
• cifs: ensure correct super block for DFS reconnect (bsc#1175122).
• cifs: fail i/o on soft mounts if sessionsetup errors out (bsc#1175122).
• cifs: fiemap: do not return EINVAL if get nothing (bsc#1175122).
• cifs: Fix an error pointer dereference in cifs_mount() (bsc#1172428 bsc#1175122).
• cifs: fix double free error on share and prefix (bsc#1172428 bsc#1175122).
• cifs: fix leaked reference on requeued write (bsc#1175122).
• cifs: fix NULL dereference in match_prepath (bsc#1175122).
• cifs: Fix null pointer check in cifs_read (bsc#1175122).
• cifs: Fix potential deadlock when updating vol in cifs_reconnect() (bsc#1175122).
• cifs: fix potential mismatch of UNC paths (bsc#1175122).
• cifs: fix rename() by ensuring source handle opened with DELETE bit (bsc#1175122).
• cifs: Fix return value in __update_cache_entry (bsc#1175122).
• cifs: fix soft mounts hanging in the reconnect code (bsc#1175122).
• cifs: Fix task struct use-after-free on reconnect (bsc#1175122).
• cifs: fix uninitialised lease_key in open_shroot() (bsc#1175122).
• cifs: fix unitialized variable poential problem with network I/O cache lock patch (bsc#1175122).
• cifs: Get rid of kstrdup_const()'d paths (bsc#1175122).
• cifs: get rid of unused parameter in reconn_setup_dfs_targets() (bsc#1175122).
• cifs: handle empty list of targets in cifs_reconnect() (bsc#1172428 bsc#1175122).
• cifs: handle hostnames that resolve to same ip in failover (bsc#1175122).
• cifs: handle prefix paths in reconnect (bsc#1175122).
• cifs: handle RESP_GET_DFS_REFERRAL.PathConsumed in reconnect (bsc#1172428 bsc#1175122).
• cifs: improve read performance for page size 64KB & cache=strict & vers=2.1+ (bsc#1175122).
• cifs: Introduce helpers for finding TCP connection (bsc#1175122).
• cifs: make sure we do not overflow the max EA buffer size (bsc#1175122).
• cifs: make use of cap_unix(ses) in cifs_reconnect_tcon() (bsc#1175122).
• cifs: merge __{cifs,smb2}_reconnect_tcon into cifs_tree_connect() (bsc#1172428 bsc#1175122).
• cifs: Merge is_path_valid() into get_normalized_path() (bsc#1175122). -…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).
• CVE-2020-14356: Fixed a null pointer dereference in cgroupv2 subsystem which could have led to privilege escalation (bsc#1175213).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).
• CVE-2020-24394: Fixed an issue which could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support (bsc#1175518).
• CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).
• CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The following non-security bugs were fixed:

• btrfs: remove a BUG_ON() from merge_reloc_roots() (bsc#1174784).
• cifs: document and cleanup dfs mount (bsc#1144333 bsc#1172428).
• cifs: Fix an error pointer dereference in cifs_mount() (bsc#1144333 bsc#1172428).
• cifs: fix double free error on share and prefix (bsc#1144333 bsc#1172428).
• cifs: handle empty list of targets in cifs_reconnect() (bsc#1144333 bsc#1172428).
• cifs: handle RESP_GET_DFS_REFERRAL.PathConsumed in reconnect (bsc#1144333 bsc#1172428).
• cifs: merge __{cifs,smb2}_reconnect_tcon into cifs_tree_connect() (bsc#1144333 bsc#1172428).
• cifs: only update prefix path of DFS links in cifs_tree_connect() (bsc#1144333 bsc#1172428).
• cifs: reduce number of referral requests in DFS link lookups (bsc#1144333 bsc#1172428).
• cifs: rename reconn_inval_dfs_target() (bsc#1144333 bsc#1172428).
• Drivers: hv: vmbus: Only notify Hyper-V for die events that are oops (bsc#1175127).
• ibmvnic: Fix IRQ mapping disposal in error path (bsc#1175112 ltc#187459).
• ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL (bsc#1175515).
• ip_tunnel: allow not to count pkts on tstats by setting skb's dev to NULL (bsc#1175515).
• ipvs: fix the connection sync failed in some cases (bsc#1174699).
• kabi: hide new parameter of ip6_dst_lookup_flow() (bsc#1165629).
• kabi: mask changes to struct ipv6_stub (bsc#1165629).
• mm: Avoid calling build_all_zonelists_init under hotplug context (bsc#1154366).
• mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo (bsc#1175691).
• ocfs2: add trimfs dlm lock resource (bsc#1175228).
• ocfs2: add trimfs lock to avoid duplicated trims in cluster (bsc#1175228).
• ocfs2: avoid inode removal while nfsd is accessing it (bsc#1172963).
• ocfs2: avoid inode removal while nfsd is accessing it (bsc#1172963).
• ocfs2: fix panic on nfs server over ocfs2 (bsc#1172963).
• ocfs2: fix panic on nfs server over ocfs2 (bsc#1172963).
• ocfs2: fix remounting needed after setfacl command (bsc#1173954).
• ocfs2: fix the application IO timeout when fstrim is running (bsc#1175228).
• ocfs2: load global_inode_alloc (bsc#1172963).
• ocfs2: load global_inode_alloc (bsc#1172963).
• powerpc/eeh: Fix pseries_eeh_configure_bridge() (bsc#1174689).
• powerpc/pseries: PCIE PHB reset (bsc#1174689).
• Revert 'ocfs2: fix panic on nfs server over ocfs2 (bsc#1172963).' This reverts commit 2638f62c6bc33d4c10ce0dddbf240aa80d366d7b.
• Revert 'ocfs2: load global_inode_alloc (bsc#1172963).' This reverts commit f04f670651f505cb354f26601ec5f5e4428f2f47.
• scsi: scsi_dh_alua: skip RTPG for devices only supporting active/optimized (bsc#1174978).
• selftests/livepatch: fix mem leaks in test-klp-shadow-vars (bsc#1071995).
• selftests/livepatch: more verification in test-klp-shadow-vars…

The SUSE Linux Enterprise 12 SP5 kernel RT was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2020-14386: Fixed a memory corruption which could have been exploited to gain root privileges from unprivileged processes (bsc#1176069).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-25212: Fixed A TOCTOU mismatch in the NFS client code which could have been used by local attackers to corrupt memory (bsc#1176381).
• CVE-2020-2521: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177511).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

The following non-security bugs were fixed:

• ACPI: EC: Reference count query handlers under lock (git-fixes).
• airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: asihpi: fix iounmap in error handler (git-fixes).
• ALSA: firewire-digi00x: exclude Avid Adrenaline from detection (git-fixes).
• ALSA; firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).
• ALSA: hda: Fix 2 channel swapping for Tegra (git-fixes).
• ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A (git-fixes).
• ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen (git-fixes).
• altera-stapl: altera_get_note: prevent write beyond end of 'key' (git-fixes).
• amd-xgbe: Add a check for an skb in the timestamp path (git-fixes).
• amd-xgbe: Add additional dynamic debug messages (git-fixes).
• amd-xgbe: Add additional ethtool statistics (git-fixes).
• amd-xgbe: Add ethtool show/set channels support (git-fixes).
• amd-xgbe: Add ethtool show/set ring parameter support (git-fixes).
• amd-xgbe: Add ethtool support to retrieve SFP module info (git-fixes).
• amd-xgbe: Add hardware features debug output (git-fixes).
• amd-xgbe: Add NUMA affinity support for IRQ hints (git-fixes).
• amd-xgbe: Add NUMA affinity support for memory allocations (git-fixes).
• amd-xgbe: Add per queue Tx and Rx statistics (git-fixes).
• amd-xgbe: Advertise FEC support with the KR re-driver (git-fixes).
• amd-xgbe: Always attempt link training in KR mode (git-fixes).
• amd-xgbe: Be sure driver shuts down cleanly on module removal (git-fixes). -…

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25643: Added range checks in ppp_cp_parse_cr() (bsc#1177206).
• CVE-2020-25641: Allowed for_each_bvec to support zero len bvec (bsc#1177121).
• CVE-2020-25645: Added transport ports in route lookup for geneve (bsc#1177511).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2020-14386: Fixed a memory corruption which could have been exploited to gain root privileges from unprivileged processes (bsc#1176069).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

The following non-security bugs were fixed:

• ALSA: firewire-digi00x: exclude Avid Adrenaline from detection (git-fixes).
• ALSA; firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A (git-fixes).
• ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen (git-fixes).
• arm64: KVM: Do not generate UNDEF when LORegion feature is present (jsc#SLE-4084).
• arm64: KVM: regmap: Fix unexpected switch fall-through (jsc#SLE-4084).
• asm-generic: fix -Wtype-limits compiler warnings (bsc#1112178).
• ASoC: tegra: Fix reference count leaks (git-fixes).
• batman-adv: Avoid uninitialized chaddr when handling DHCP (git-fixes).
• batman-adv: bla: use netif_rx_ni when not in interrupt context (git-fixes).
• bcache: allocate meta data pages as compound pages (bsc#1172873).
• bcache: Convert pr_<level> uses to a more typical style (git fixes (block drivers)).
• bcache: fix overflow in offset_to_stripe() (git fixes (block drivers)).
• bcm63xx_enet: correct clock usage (git-fixes).
• bcm63xx_enet: do not write to random DMA channel on BCM6345 (git-fixes).
• bitfield.h: do not compile-time validate _val in FIELD_FIT (git fixes (bitfield)).
• blktrace: fix debugfs use after free (git fixes (block drivers)).
• block: add docs for gendisk / request_queue refcount helpers (git fixes (block drivers)).
• block: check queue's limits.discard_granularity in __blkdev_issue_discard() (bsc#1152148).
• block: improve discard bio alignment in __blkdev_issue_discard() (bsc#1152148).
• block: revert back to synchronous request_queue removal (git fixes (block drivers)).
• block: Use non _rcu version of list functions for tag_set_list (git-fixes).
• bnxt_en: Fix completion ring sizing with TPA enabled (networking-stable-20_07_29).
• bonding: check error value of register_netdevice() immediately (git-fixes).
• bonding: check return value of register_netdevice() in bond_newlink() (git-fixes).
• bonding: use nla_get_u64 to extract the value for IFLA_BOND_AD_ACTOR_SYSTEM (git-fixes).
• btrfs: require only sector size alignment for parent eb bytenr (bsc#1176789).
• btrfs: tree-checker: fix the error message for transid error (bsc#1176788).
• ceph: do not allow setlease on cephfs (bsc#1177041).
• ceph: fix potential mdsc use-after-free crash…

This update for the Linux Kernel 4.4.180-94_130 fixes several issues.

The following security issues were fixed:

• CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with system execution privileges needed. User interaction is not needed for exploitation. (bsc#1176724)
• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-0431: In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bsc#1176722)
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c (bsc#1176381).
• CVE-2020-11668: Fixed an out of bounds write to the heap in drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) caused by mishandling invalid descriptors (bsc#1168952).
• CVE-2020-1749: A flaw was found in the implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link, rather sending the data unencrypted. This would have allowed anyone in between the two endpoints to read the traffic unencrypted. (bsc#1165629)

This update for the Linux Kernel 4.4.121-92_146 fixes several issues.

The following security issues were fixed:

• CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178622).
• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177513).
• CVE-2020-0429: Fixed a memory corruption due to a use after free which could have led to to local privilege escalation (bsc#1176931).
• CVE-2020-11668: Fixed an issue where the Xirlink camera USB driver mishandled invalid descriptors (bsc#1173942).
• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165631).

This update for the Linux Kernel 4.4.180-94_135 fixes several issues.

The following security issues were fixed:

• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177513).
• CVE-2020-0429: Fixed a memory corruption due to a use after free which could have led to to local privilege escalation (bsc#1176931).
• CVE-2020-11668: Fixed an issue where the Xirlink camera USB driver mishandled invalid descriptors (bsc#1173942).
• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165631).

This update for the Linux Kernel 4.4.180-94_138 fixes several issues.

The following security issues were fixed:

• CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation (bsc#1179616).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#1178684).
• CVE-2020-25645: Fixed an issue where the traffic between two Geneve endpoints may have been unencrypted when IPsec was configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177513).
• CVE-2020-0429: Fixed a potential memory corruption due to a use after free which could have led local escalation of privilege with System execution privileges needed (bsc#1176931).
• CVE-2020-1749: Fixed an issue in some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6 where the kernel was not correctly routing tunneled data over the encrypted link rather sending the data unencrypted (bsc#1165631).

This update for the Linux Kernel 4.4.180-94_141 fixes several issues.

The following security issues were fixed:

• CVE-2021-27365: Fixed an issue where data structures did not have appropriate length constraints or checks, and could exceed the PAGE_SIZE value (bsc#1183491).
• CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the iscsi_transport structure (bsc#1183120).
• CVE-2021-27364: Fixed an issue where an unprivileged user could craft Netlink messages (bsc#1182717).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bsc#1177513).
• CVE-2020-0429: Fixed a memory corruption due to a use after free which could have led to local escalation of privilege with System execution privileges needed (bsc#1176931).
• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165631).

This update for the Linux Kernel 4.4.121-92_152 fixes several issues.

The following security issues were fixed:

• CVE-2021-27365: Fixed an issue where data structures did not have appropriate length constraints or checks, and could exceed the PAGE_SIZE value (bsc#1183491).
• CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the iscsi_transport structure (bsc#1183120).
• CVE-2021-27364: Fixed an issue where an unprivileged user could craft Netlink messages (bsc#1182717).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bsc#1177513).
• CVE-2020-0429: Fixed a memory corruption due to a use after free which could have led to local escalation of privilege with System execution privileges needed (bsc#1176931).
• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165631).

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bnc#1184509).
• CVE-2021-29650: Fixed an issue inside the netfilter subsystem that allowed attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value (bnc#1184208).
• CVE-2021-29154: Fixed BPF JIT compilers that allowed to execute arbitrary code within the kernel context (bnc#1184391).
• CVE-2020-25673: Fixed NFC endless loops caused by repeated llcp_sock_connect() (bsc#1178181).
• CVE-2020-25672: Fixed NFC memory leak in llcp_sock_connect() (bsc#1178181).
• CVE-2020-25671: Fixed NFC refcount leak in llcp_sock_connect() (bsc#1178181).
• CVE-2020-25670: Fixed NFC refcount leak in llcp_sock_bind() (bsc#1178181).
• CVE-2021-28950: Fixed an issue in fs/fuse/fuse_i.h where a 'stall on CPU' could have occured because a retry loop continually finds the same bad inode (bnc#1184194, bnc#1184211).
• CVE-2021-30002: Fixed a memory leak issue when a webcam device exists (bnc#1184120).
• CVE-2021-3483: Fixed a use-after-free bug in nosy_ioctl() (bsc#1184393).
• CVE-2021-20219: Fixed a denial of service vulnerability in drivers/tty/n_tty.c of the Linux kernel. In this flaw a local attacker with a normal user privilege could have delayed the loop and cause a threat to the system availability (bnc#1184397).
• CVE-2021-29265: Fixed an issue in usbip_sockfd_store in drivers/usb/usbip/stub_dev.c that allowed attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the local and shared status (bnc#1184167).
• CVE-2021-29264: Fixed an issue in drivers/net/ethernet/freescale/gianfar.c in the Freescale Gianfar Ethernet driver that allowed attackers to cause a system crash because a negative fragment size is calculated in situations involving an rx queue overrun when jumbo packets are used and NAPI is enabled (bnc#1184168).
• CVE-2021-28972: Fixed an issue in drivers/pci/hotplug/rpadlpar_sysfs.c where the RPA PCI Hotplug driver had a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination (bnc#1184198).
• CVE-2021-28660: Fixed rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c that allowed writing beyond the end of the ssid array (bnc#1183593).
• CVE-2020-0433: Fixed blk_mq_queue_tag_busy_iter of blk-mq-tag.c, where a possible use after free due to improper locking could have happened. This could have led to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1176720).
• CVE-2021-27365: Fixed an issue inside the iSCSI data structures that does not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message (bnc#1182715).
• CVE-2021-27363: Fixed an issue with a kernel pointer leak that could have been used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables (bnc#1182716).
• CVE-2021-27364: Fixed an issue in…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bnc#1184509).
• CVE-2021-29650: Fixed an issue inside the netfilter subsystem that allowed attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value (bnc#1184208).
• CVE-2020-27673: Fixed an issue in Xen where a guest OS users could have caused a denial of service (host OS hang) via a high rate of events to dom0 (bnc#1177411, bnc#1184583).
• CVE-2021-29154: Fixed BPF JIT compilers that allowed to execute arbitrary code within the kernel context (bnc#1184391).
• CVE-2020-25673: Fixed NFC endless loops caused by repeated llcp_sock_connect() (bsc#1178181).
• CVE-2020-25672: Fixed NFC memory leak in llcp_sock_connect() (bsc#1178181).
• CVE-2020-25671: Fixed NFC refcount leak in llcp_sock_connect() (bsc#1178181).
• CVE-2020-25670: Fixed NFC refcount leak in llcp_sock_bind() (bsc#1178181).
• CVE-2021-28950: Fixed an issue in fs/fuse/fuse_i.h where a 'stall on CPU' could have occured because a retry loop continually finds the same bad inode (bnc#1184194, bnc#1184211).
• CVE-2020-36322: Fixed an issue inside the FUSE filesystem implementation where fuse_do_getattr() calls make_bad_inode() in inappropriate situations, could have caused a system crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as CVE-2021-28950 (bnc#1184211).
• CVE-2021-30002: Fixed a memory leak issue when a webcam device exists (bnc#1184120).
• CVE-2021-3483: Fixed a use-after-free bug in nosy_ioctl() (bsc#1184393).
• CVE-2021-20219: Fixed a denial of service vulnerability in drivers/tty/n_tty.c of the Linux kernel. In this flaw a local attacker with a normal user privilege could have delayed the loop and cause a threat to the system availability (bnc#1184397).
• CVE-2021-29265: Fixed an issue in usbip_sockfd_store in drivers/usb/usbip/stub_dev.c that allowed attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the local and shared status (bnc#1184167).
• CVE-2021-29264: Fixed an issue in drivers/net/ethernet/freescale/gianfar.c in the Freescale Gianfar Ethernet driver that allowed attackers to cause a system crash because a negative fragment size is calculated in situations involving an rx queue overrun when jumbo packets are used and NAPI is enabled (bnc#1184168).
• CVE-2021-28972: Fixed an issue in drivers/pci/hotplug/rpadlpar_sysfs.c where the RPA PCI Hotplug driver had a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination (bnc#1184198).
• CVE-2021-28660: Fixed rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c that allowed writing beyond the end of the ssid array (bnc#1183593).
• CVE-2020-0433: Fixed blk_mq_queue_tag_busy_iter of blk-mq-tag.c, where a possible use after free due to improper locking could have happened. This could have led to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1176720).
• CVE-2021-28038: Fixed an issue with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931 (bnc#1183022, bnc#1183069).
• CVE-2021-27365: Fixed an issue inside the iSCSI data…

It was discovered that the F2FS file system implementation in the Linux kernel did not properly perform bounds checking on xattrs in some situations. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2020-0067)

It was discovered that memory contents previously stored in microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly exposed to processes on the same or different processor cores. A local attacker could use this to expose sensitive information. (CVE-2020-0543)

Piotr Krysiuk discovered that race conditions existed in the file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-12114)

It was discovered that the USB susbsystem's scatter-gather implementation in the Linux kernel did not properly take data references in some situations, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12464)

Bui Quang Minh discovered that the XDP socket implementation in the Linux kernel did not properly validate meta-data passed from user space, leading to an out-of-bounds write vulnerability. A local attacker with the CAP_NET_ADMIN capability could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12659)

Xiumei Mu discovered that the IPSec implementation in the Linux kernel did not properly encrypt IPv6 traffic in some situations. An attacker could use this to expose sensitive information. (CVE-2020-1749)

It was discovered that the F2FS file system implementation in the Linux kernel did not properly perform bounds checking on xattrs in some situations. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2020-0067)

It was discovered that memory contents previously stored in microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly exposed to processes on the same or different processor cores. A local attacker could use this to expose sensitive information. (CVE-2020-0543)

Piotr Krysiuk discovered that race conditions existed in the file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-12114)

It was discovered that the USB susbsystem's scatter-gather implementation in the Linux kernel did not properly take data references in some situations, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12464)

Xiumei Mu discovered that the IPSec implementation in the Linux kernel did not properly encrypt IPv6 traffic in some situations. An attacker could use this to expose sensitive information. (CVE-2020-1749)

Dmitry Vyukov discovered that the SELinux netlink security hook in the Linux kernel did not validate messages in some situations. A privileged attacker could use this to bypass SELinux netlink restrictions. (CVE-2020-10751)

It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle setxattr operations in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-19319)

It was discovered that memory contents previously stored in microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly exposed to processes on the same or different processor cores. A local attacker could use this to expose sensitive information. (CVE-2020-0543)

Piotr Krysiuk discovered that race conditions existed in the file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-12114)

It was discovered that the USB susbsystem's scatter-gather implementation in the Linux kernel did not properly take data references in some situations, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12464)

It was discovered that the DesignWare SPI controller driver in the Linux kernel contained a race condition. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2020-12769)

It was discovered that the exit signaling implementation in the Linux kernel contained an integer overflow. A local attacker could use this to cause a denial of service (arbitrary application crash). (CVE-2020-12826)

Xiumei Mu discovered that the IPSec implementation in the Linux kernel did not properly encrypt IPv6 traffic in some situations. An attacker could use this to expose sensitive information. (CVE-2020-1749)

Dmitry Vyukov discovered that the SELinux netlink security hook in the Linux kernel did not validate messages in some situations. A privileged attacker could use this to bypass SELinux netlink restrictions. (CVE-2020-10751)