CVE-2020-25643

A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Integer overflow in Intel(R) Graphics Drivers (CVE-2020-12362)

• kernel: memory leak in sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c (CVE-2019-18811)

• kernel: use-after-free caused by a malicious USB device in the drivers/usb/misc/adutux.c driver (CVE-2019-19523)

• kernel: use-after-free bug caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver (CVE-2019-19528)

• kernel: possible out of bounds write in kbd_keycode of keyboard.c (CVE-2020-0431)

• kernel: DoS by corrupting mountpoint reference counter (CVE-2020-12114)

• kernel: use-after-free in usb_sg_cancel function in drivers/usb/core/message.c (CVE-2020-12464)

• kernel: buffer uses out of index in ext3/4 filesystem (CVE-2020-14314)

• kernel: Use After Free vulnerability in cgroup BPF component (CVE-2020-14356)

• kernel: NULL pointer dereference in serial8250_isa_init_ports function in drivers/tty/serial/8250/8250_core.c (CVE-2020-15437)

• kernel: umask not applied on filesystem without ACL support (CVE-2020-24394)

• kernel: TOCTOU mismatch in the NFS client code (CVE-2020-25212)

• kernel: incomplete permission checking for access to rbd devices (CVE-2020-25284)

• kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c (CVE-2020-25285)

• kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read overflow (CVE-2020-25643)

• kernel: perf_event_parse_addr_filter memory (CVE-2020-25704)

• kernel: use-after-free in kernel midi subsystem (CVE-2020-27786)

• kernel: child process is able to access parent mm through hfi dev file handle (CVE-2020-27835)

• kernel: slab-out-of-bounds read in fbcon (CVE-2020-28974)

• kernel: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent (CVE-2020-35508)

• kernel: fuse: fuse_do_getattr() calls make_bad_inode() in inappropriate situations (CVE-2020-36322)

• kernel: use after free in tun_get_user of tun.c could lead to local escalation of privilege (CVE-2021-0342)

• kernel: NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs in drivers/media/usb/gspca/ov519.c (CVE-2020-11608)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
• af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
• ipv6: remove max_size check inline with ipv4 {CVE-2023-52340}
• aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts {CVE-2023-6270}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• hdlc_ppp: add range checks in ppp_cp_parse_cr() {CVE-2020-25643}
• perf/core: Fix race in the perf_mmap_close() function {CVE-2020-14351}
• media: xirlink_cit: add missing descriptor sanity checks {CVE-2020-11668}
• vt: selection, close sel_buffer race {CVE-2020-8648}
• net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
• media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}

• drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
• af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
• ipv6: remove max_size check inline with ipv4 {CVE-2023-52340}
• aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts {CVE-2023-6270}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• hdlc_ppp: add range checks in ppp_cp_parse_cr() {CVE-2020-25643}
• perf/core: Fix race in the perf_mmap_close() function {CVE-2020-14351}
• media: xirlink_cit: add missing descriptor sanity checks {CVE-2020-11668}
• vt: selection, close sel_buffer race {CVE-2020-8648}
• net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
• media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}

A flaw was found in the way the Linux kernel Bluetooth implementation handled L2CAP packets with A2MP CID. A remote attacker in adjacent range could use this flaw to crash the system causing denial of service or potentially execute arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2020-12351).

An information leak flaw was found in the way the Linux kernel's Bluetooth stack implementation handled initialization of stack memory when handling certain AMP packets. A remote attacker in adjacent range could use this flaw to leak small portions of stack memory on the system by sending a specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality (CVE-2020-12352).

A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability (CVE-2020-14385).

A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity (CVE-2020-14386).

A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (CVE-2020-14390).

A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability (CVE-2020-24490).

In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c (CVE-2020-25211).

get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv() (CVE-2020-25221).

The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices (CVE-2020-25284).

A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact (CVE-2020-25285).

A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability (CVE-2020-25641).

A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is…

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25212: Fixed nfs getxattr kernel panic and memory overflow that could lead to crashes or privilege escalations (bsc#1176381).
• CVE-2020-14381: Fixed inode life-time issue in futex handling (bsc#1176011).
• CVE-2020-25643: Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (bnc#1177206).
• CVE-2020-25641: A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allowed a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability (bnc#1177121).
• CVE-2020-26088: A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a (bnc#1176990).
• CVE-2020-14390: When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (bnc#1176235 bnc#1176278).
• CVE-2020-0432: In skb_to_mamac of networking.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1176721).
• CVE-2020-0427: In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1176725).
• CVE-2020-0431: In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1176722).
• CVE-2020-0404: In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1176423).
• CVE-2020-25284: The rbd block device driver in drivers/block/rbd.c used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices, aka CID-f44d04e696fe (bnc#1176482).
• CVE-2020-14386: Memory corruption in af_apcket can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity (bnc#1176069).

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• Add de2b41be8fcc x86, vmlinux.lds: Page-align end of ..page_aligned sections
• Add f29dfa53cc8a x86/bugs/multihit: Fix mitigation reporting when VMX is not in use
• airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: asihpi: fix iounmap in error handler (git-fixes).
• ALSA: firewire-digi00x: exclude Avid Adrenaline from detection (git-fixes).
• ALSA; firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).
• ALSA: hda: Fix 2 channel swapping for Tegra (git-fixes).
• ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled (git-fixes).
• ALSA:…

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth' aka 'BadVibes' (bsc#1177726).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' aka 'BadChoice' (bsc#1177725).
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code in the Linux kernel could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452 (bnc#1176381).
• CVE-2020-25645: Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality (bnc#1177511).
• CVE-2020-25643: Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (bnc#1177206).
• CVE-2020-25641: A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allowed a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability (bnc#1177121).

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1 (git-fixes).
• ASoC: img-i2s-out: Fix runtime PM imbalance on error (git-fixes).
• ASoC: kirkwood: fix IRQ error handling (git-fixes).
• ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions (git-fixes).
• ASoC: wm8994: Skip setting of the WM8994_MICBIAS register for WM1811 (git-fixes).
• Bluetooth: Fix refcount use-after-free issue (git-fixes).
• Bluetooth: Handle Inquiry Cancel error after Inquiry Complete (git-fixes).
• Bluetooth: L2CAP: handle l2cap config request during open state (git-fixes).
• Bluetooth: guard against controllers sending zero'd events (git-fixes).
• Bluetooth: prefetch channel before killing sock (git-fixes).
• Btrfs: fix crash during unmount due to race with delayed inode workers (bsc#1176019).
• Input: i8042 - add nopnp quirk for Acer Aspire 5 A515 (bsc#954532).
• Input: trackpoint - enable Synaptics trackpoints (git-fixes).
• Move upstreamed intel-vbtn patch into sorted section
• NFS: Do not move layouts to plh_return_segs list while in use (git-fixes).
• NFS: Do not return layout segments that are in use (git-fixes).
• NFS: Fix flexfiles read failover (git-fixes).
• NFSv4.2: fix client's attribute cache management for copy_file_range (git-fixes).
• PCI/IOV: Mark VFs as not implementing PCI_COMMAND_MEMORY (bsc#1176979).
• PCI: Avoid double hpmemsize MMIO window assignment (git-fixes).
• PCI: tegra194: Fix runtime PM imbalance on error (git-fixes).
• PCI: tegra: Fix runtime PM imbalance on error (git-fixes).
• Platform: OLPC: Fix memleak in olpc_ec_probe (git-fixes).
• RDMA/hfi1: Correct an interlock issue for TID RDMA WRITE request (bsc#1175621).
• Refresh patches.suse/fnic-to-not-call-scsi_done-for-unhandled-commands.patch (bsc#1168468, bsc#1171675).
• SUNRPC: Revert 241b1f419f0e ('SUNRPC: Remove xdr_buf_trim()') (git-fixes).
• USB: EHCI: ehci-mv: fix error handling in mv_ehci_probe() (git-fixes).
• USB: EHCI: ehci-mv: fix less than zero comparison of an…

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth' aka 'BadVibes' (bsc#1177726).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' aka 'BadChoice' (bsc#1177725).
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code in the Linux kernel could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452 (bnc#1176381).
• CVE-2020-25645: Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality (bnc#1177511).
• CVE-2020-25643: Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (bnc#1177206).
• CVE-2020-25641: A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allowed a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability (bnc#1177121).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25668: Make FONTX ioctl use the tty pointer they were actually passed (bsc#1178123).
• CVE-2020-25656: Extend func_buf_lock to readers (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812 (bnc#1176485).
• CVE-2020-14351: Fixed race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-8694: Restrict energy meter to root access (bsc#1170415).
• CVE-2020-16120: Check permission to open real file in overlayfs (bsc#1177470).
• CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: Always build evged in (git-fixes).
• ACPI: button: fix handling lid state changes when input device closed (git-fixes).
• ACPI: configfs: Add missing config_item_put() to fix refcount leak (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• act_ife: load meta modules before tcf_idr_check_alloc() (networking-stable-20_09_24).
• Add CONFIG_CHECK_CODESIGN_EKU
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: ac97: (cosmetic) align argument names (git-fixes).
• ALSA: aoa: i2sbus: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: asihpi: fix spellint typo in comments (git-fixes).
• ALSA: atmel: ac97: clarify operator precedence (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm:…

This update syncs the RT kernel from the SUSE Linux Enterprise 15-SP2 codestream.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2019-25643: Fixed an improper input validation in ppp_cp_parse_cr function which could have led to memory corruption and read overflow (bsc#1177206).
• CVE-2020-25641: Fixed ann issue where length bvec was causing softlockups (bsc#1177121).

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: asihpi: fix iounmap in error handler (git-fixes).
• ALSA: firewire-digi00x: exclude Avid Adrenaline from detection (git-fixes).
• ALSA: firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).
• ALSA: hda: Fix 2 channel swapping for Tegra (git-fixes).
• ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A (git-fixes).
• ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen (git-fixes).
• altera-stapl: altera_get_note: prevent write beyond end of 'key' (git-fixes).
• ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter (git-fixes).
• arm64: KVM: Do not generate UNDEF when LORegion feature is present (jsc#SLE-4084).
• arm64: KVM: regmap: Fix unexpected switch fall-through (jsc#SLE-4084).
• asm-generic: fix -Wtype-limits compiler warnings (bsc#1112178).
• ASoC: kirkwood: fix IRQ error handling (git-fixes).
• ASoC: tegra: Fix reference count leaks (git-fixes).
• ath10k: fix array out-of-bounds access (git-fixes).
• ath10k: fix memory leak for tpc_stats_final (git-fixes).
• ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read (git-fixes).
• batman-adv: Add missing include for in_interrupt() (git-fixes).
• batman-adv: Avoid uninitialized chaddr when handling DHCP (git-fixes).
• batman-adv: bla: fix type misuse for backbone_gw hash indexing (git-fixes).
• batman-adv: bla: use netif_rx_ni when not in interrupt context (git-fixes).
• batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh (git-fixes).
• batman-adv: mcast/TT: fix wrongly dropped or rerouted packets (git-fixes).
• bcache: Convert pr_<level> uses to a more typical style (git fixes (block drivers)).
• bcache: fix overflow in offset_to_stripe() (git fixes (block drivers)).
• bcm63xx_enet: correct clock usage (git-fixes).
• bcm63xx_enet: do not write to random DMA channel on BCM6345 (git-fixes).
• bitfield.h: do not compile-time validate _val in FIELD_FIT (git fixes (bitfield)).
• blktrace: fix debugfs use after free (git fixes (block drivers)).
• block: add docs for gendisk / request_queue refcount helpers (git fixes (block drivers)). -…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2019-25643: Fixed an improper input validation in ppp_cp_parse_cr function which could have led to memory corruption and read overflow (bsc#1177206).
• CVE-2020-25641: Fixed ann issue where length bvec was causing softlockups (bsc#1177121).

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: asihpi: fix iounmap in error handler (git-fixes).
• ALSA: firewire-digi00x: exclude Avid Adrenaline from detection (git-fixes).
• ALSA; firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).
• ALSA: hda: Fix 2 channel swapping for Tegra (git-fixes).
• ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A (git-fixes).
• ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen (git-fixes).
• altera-stapl: altera_get_note: prevent write beyond end of 'key' (git-fixes).
• ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter (git-fixes).
• arm64: KVM: Do not generate UNDEF when LORegion feature is present (jsc#SLE-4084).
• arm64: KVM: regmap: Fix unexpected switch fall-through (jsc#SLE-4084).
• asm-generic: fix -Wtype-limits compiler warnings (bsc#1112178).
• ASoC: kirkwood: fix IRQ error handling (git-fixes).
• ASoC: tegra: Fix reference count leaks (git-fixes).
• ath10k: fix array out-of-bounds access (git-fixes).
• ath10k: fix memory leak for tpc_stats_final (git-fixes).
• ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read (git-fixes).
• batman-adv: Add missing include for in_interrupt() (git-fixes).
• batman-adv: Avoid uninitialized chaddr when handling DHCP (git-fixes).
• batman-adv: bla: fix type misuse for backbone_gw hash indexing (git-fixes).
• batman-adv: bla: use netif_rx_ni when not in interrupt context (git-fixes).
• batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh (git-fixes).
• batman-adv: mcast/TT: fix wrongly dropped or rerouted packets (git-fixes).
• bcache: Convert pr_<level> uses to a more typical style (git fixes (block drivers)).
• bcache: fix overflow in offset_to_stripe() (git fixes (block drivers)).
• bcm63xx_enet: correct clock usage (git-fixes).
• bcm63xx_enet: do not write to random DMA channel on BCM6345 (git-fixes).
• bitfield.h: do not compile-time validate _val in FIELD_FIT (git fixes (bitfield)).
• blktrace: fix debugfs use after free (git fixes (block drivers)).
• block: add docs for gendisk / request_queue refcount helpers (git fixes (block drivers)). -…

The SUSE Linux Enterprise 15 SP1 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2019-25643: Fixed an improper input validation in ppp_cp_parse_cr function which could have led to memory corruption and read overflow (bsc#1177206).
• CVE-2020-25641: Fixed ann issue where length bvec was causing softlockups (bsc#1177121).

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: asihpi: fix iounmap in error handler (git-fixes).
• ALSA: firewire-digi00x: exclude Avid Adrenaline from detection (git-fixes).
• ALSA; firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).
• ALSA: hda: Fix 2 channel swapping for Tegra (git-fixes).
• ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A (git-fixes).
• ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen (git-fixes).
• altera-stapl: altera_get_note: prevent write beyond end of 'key' (git-fixes).
• ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter (git-fixes).
• arm64: KVM: Do not generate UNDEF when LORegion feature is present (jsc#SLE-4084).
• arm64: KVM: regmap: Fix unexpected switch fall-through (jsc#SLE-4084).
• asm-generic: fix -Wtype-limits compiler warnings (bsc#1112178).
• ASoC: kirkwood: fix IRQ error handling (git-fixes).
• ASoC: tegra: Fix reference count leaks (git-fixes).
• ath10k: fix array out-of-bounds access (git-fixes).
• ath10k: fix memory leak for tpc_stats_final (git-fixes).
• ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read (git-fixes).
• batman-adv: Add missing include for in_interrupt() (git-fixes).
• batman-adv: Avoid uninitialized chaddr when handling DHCP (git-fixes).
• batman-adv: bla: fix type misuse for backbone_gw hash indexing (git-fixes).
• batman-adv: bla: use netif_rx_ni when not in interrupt context (git-fixes).
• batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh (git-fixes).
• batman-adv: mcast/TT: fix wrongly dropped or rerouted packets (git-fixes).
• bcache: Convert pr_<level> uses to a more typical style (git fixes (block drivers)).
• bcache: fix overflow in offset_to_stripe() (git fixes (block drivers)).
• bcm63xx_enet: correct clock usage (git-fixes).
• bcm63xx_enet: do not write to random DMA channel on BCM6345 (git-fixes).
• bitfield.h: do not compile-time validate _val in FIELD_FIT (git fixes (bitfield)).
• blktrace: fix debugfs use after free (git fixes (block drivers)).
• block: add docs for gendisk / request_queue refcount helpers (git fixes (block…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2019-25643: Fixed an improper input validation in ppp_cp_parse_cr function which could have led to memory corruption and read overflow (bsc#1177206).
• CVE-2020-25641: Fixed ann issue where length bvec was causing softlockups (bsc#1177121).

The following non-security bugs were fixed:

• ALSA: asihpi: fix iounmap in error handler (git-fixes).
• ALSA: firewire-digi00x: exclude Avid Adrenaline from detection (git-fixes).
• ALSA: firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).
• ALSA: hda: Fix 2 channel swapping for Tegra (git-fixes).
• ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A (git-fixes).
• ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen (git-fixes).
• altera-stapl: altera_get_note: prevent write beyond end of 'key' (git-fixes).
• ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter (git-fixes).
• arm64: KVM: Do not generate UNDEF when LORegion feature is present (jsc#SLE-4084).
• arm64: KVM: regmap: Fix unexpected switch fall-through (jsc#SLE-4084).
• asm-generic: fix -Wtype-limits compiler warnings (bsc#1112178).
• ASoC: kirkwood: fix IRQ error handling (git-fixes).
• ASoC: tegra: Fix reference count leaks (git-fixes).
• ath10k: fix array out-of-bounds access (git-fixes).
• ath10k: fix memory leak for tpc_stats_final (git-fixes).
• ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read (git-fixes).
• batman-adv: Add missing include for in_interrupt() (git-fixes).
• batman-adv: Avoid uninitialized chaddr when handling DHCP (git-fixes).
• batman-adv: bla: fix type misuse for backbone_gw hash indexing (git-fixes).
• batman-adv: bla: use netif_rx_ni when not in interrupt context (git-fixes).
• batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh (git-fixes).
• batman-adv: mcast/TT: fix wrongly dropped or rerouted packets (git-fixes).
• bcache: Convert pr_<level> uses to a more typical style (git fixes (block drivers)).
• bcache: fix overflow in offset_to_stripe() (git fixes (block drivers)).
• bcm63xx_enet: correct clock usage (git-fixes).
• bcm63xx_enet: do not write to random DMA channel on BCM6345 (git-fixes).
• bitfield.h: do not compile-time validate _val in FIELD_FIT (git fixes (bitfield)).
• blktrace: fix debugfs use after free (git fixes (block drivers)).
• block: add docs for gendisk / request_queue refcount helpers (git fixes (block drivers)).
• block: revert back to synchronous request_queue removal (git fixes (block drivers)).
• block: Use non _rcu version of list functions for tag_set_list (git-fixes).
• Bluetooth: Fix refcount use-after-free issue (git-fixes).
• Bluetooth: guard against controllers sending zero'd events (git-fixes).
• Bluetooth: Handle Inquiry…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth' aka 'BadVibes' (bsc#1177726).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' aka 'BadChoice' (bsc#1177725).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177511).

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• airo: Fix read overflows sending packets (git-fixes).
• ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter (git-fixes).
• arm64: Enable PCI write-combine resources under sysfs (bsc#1175807).
• ASoC: img-i2s-out: Fix runtime PM imbalance on error (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1 (git-fixes).
• ASoC: kirkwood: fix IRQ error handling (git-fixes).
• ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions (git-fixes).
• ASoC: wm8994: Skip setting of the WM8994_MICBIAS register for WM1811 (git-fixes).
• ata: ahci: mvebu: Make SATA PHY optional for Armada 3720 (git-fixes).
• ath10k: fix array out-of-bounds access (git-fixes).
• ath10k: fix memory leak for tpc_stats_final (git-fixes).
• ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read (git-fixes).
• Bluetooth: Fix refcount use-after-free issue (git-fixes).
• Bluetooth: guard against controllers sending zero'd events (git-fixes).
• Bluetooth: Handle Inquiry Cancel error after Inquiry Complete (git-fixes).
• Bluetooth: L2CAP: handle l2cap config request during open state (git-fixes).
• Bluetooth: prefetch channel before killing sock (git-fixes).
• brcmfmac: Fix double freeing in the fmac usb data path (git-fixes).
• btrfs: block-group: do not set the wrong READA flag for btrfs_read_block_groups() (bsc#1176019).
• btrfs: block-group: fix free-space bitmap threshold (bsc#1176019).
• btrfs: block-group: refactor how we delete one block group item (bsc#1176019).
• btrfs: block-group: refactor how we insert a block group item (bsc#1176019).
• btrfs: block-group: refactor how we read one block group item (bsc#1176019).
• btrfs: block-group: rename write_one_cache_group() (bsc#1176019).
• btrfs: check the right error variable in btrfs_del_dir_entries_in_log (bsc#1177687).
• btrfs: do not set the full sync flag on the inode during page release (bsc#1177687).
• btrfs: do not take an extra root ref at allocation time (bsc#1176019).
• btrfs: drop logs when we've aborted a transaction (bsc#1176019).
• btrfs: fix a race between scrub and block group removal/allocation (bsc#1176019).
• Btrfs: fix crash during unmount due to race with delayed inode workers (bsc#1176019).
• btrfs: fix race between page release and a fast fsync (bsc#1177687).
• btrfs: free block groups after free'ing fs trees (bsc#1176019).
• btrfs: hold a ref on the root on the dead roots list (bsc#1176019).
• btrfs: kill the subvol_srcu (bsc#1176019).
• btrfs: make btrfs_cleanup_fs_roots use the radix tree lock (bsc#1176019).
• btrfs: make inodes hold a ref on their roots (bsc#1176019).
• btrfs: make the extent buffer leak check per fs info (bsc#1176019). -…

The SUSE Linux Enterprise 12 SP5 kernel RT was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2020-14386: Fixed a memory corruption which could have been exploited to gain root privileges from unprivileged processes (bsc#1176069).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-25212: Fixed A TOCTOU mismatch in the NFS client code which could have been used by local attackers to corrupt memory (bsc#1176381).
• CVE-2020-2521: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177511).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

The following non-security bugs were fixed:

• ACPI: EC: Reference count query handlers under lock (git-fixes).
• airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: asihpi: fix iounmap in error handler (git-fixes).
• ALSA: firewire-digi00x: exclude Avid Adrenaline from detection (git-fixes).
• ALSA; firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).
• ALSA: hda: Fix 2 channel swapping for Tegra (git-fixes).
• ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A (git-fixes).
• ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen (git-fixes).
• altera-stapl: altera_get_note: prevent write beyond end of 'key' (git-fixes).
• amd-xgbe: Add a check for an skb in the timestamp path (git-fixes).
• amd-xgbe: Add additional dynamic debug messages (git-fixes).
• amd-xgbe: Add additional ethtool statistics (git-fixes).
• amd-xgbe: Add ethtool show/set channels support (git-fixes).
• amd-xgbe: Add ethtool show/set ring parameter support (git-fixes).
• amd-xgbe: Add ethtool support to retrieve SFP module info (git-fixes).
• amd-xgbe: Add hardware features debug output (git-fixes).
• amd-xgbe: Add NUMA affinity support for IRQ hints (git-fixes).
• amd-xgbe: Add NUMA affinity support for memory allocations (git-fixes).
• amd-xgbe: Add per queue Tx and Rx statistics (git-fixes).
• amd-xgbe: Advertise FEC support with the KR re-driver (git-fixes).
• amd-xgbe: Always attempt link training in KR mode (git-fixes).
• amd-xgbe: Be sure driver shuts down cleanly on module removal (git-fixes). -…

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25643: Added range checks in ppp_cp_parse_cr() (bsc#1177206).
• CVE-2020-25641: Allowed for_each_bvec to support zero len bvec (bsc#1177121).
• CVE-2020-25645: Added transport ports in route lookup for geneve (bsc#1177511).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2020-14386: Fixed a memory corruption which could have been exploited to gain root privileges from unprivileged processes (bsc#1176069).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

The following non-security bugs were fixed:

• ALSA: firewire-digi00x: exclude Avid Adrenaline from detection (git-fixes).
• ALSA; firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A (git-fixes).
• ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen (git-fixes).
• arm64: KVM: Do not generate UNDEF when LORegion feature is present (jsc#SLE-4084).
• arm64: KVM: regmap: Fix unexpected switch fall-through (jsc#SLE-4084).
• asm-generic: fix -Wtype-limits compiler warnings (bsc#1112178).
• ASoC: tegra: Fix reference count leaks (git-fixes).
• batman-adv: Avoid uninitialized chaddr when handling DHCP (git-fixes).
• batman-adv: bla: use netif_rx_ni when not in interrupt context (git-fixes).
• bcache: allocate meta data pages as compound pages (bsc#1172873).
• bcache: Convert pr_<level> uses to a more typical style (git fixes (block drivers)).
• bcache: fix overflow in offset_to_stripe() (git fixes (block drivers)).
• bcm63xx_enet: correct clock usage (git-fixes).
• bcm63xx_enet: do not write to random DMA channel on BCM6345 (git-fixes).
• bitfield.h: do not compile-time validate _val in FIELD_FIT (git fixes (bitfield)).
• blktrace: fix debugfs use after free (git fixes (block drivers)).
• block: add docs for gendisk / request_queue refcount helpers (git fixes (block drivers)).
• block: check queue's limits.discard_granularity in __blkdev_issue_discard() (bsc#1152148).
• block: improve discard bio alignment in __blkdev_issue_discard() (bsc#1152148).
• block: revert back to synchronous request_queue removal (git fixes (block drivers)).
• block: Use non _rcu version of list functions for tag_set_list (git-fixes).
• bnxt_en: Fix completion ring sizing with TPA enabled (networking-stable-20_07_29).
• bonding: check error value of register_netdevice() immediately (git-fixes).
• bonding: check return value of register_netdevice() in bond_newlink() (git-fixes).
• bonding: use nla_get_u64 to extract the value for IFLA_BOND_AD_ACTOR_SYSTEM (git-fixes).
• btrfs: require only sector size alignment for parent eb bytenr (bsc#1176789).
• btrfs: tree-checker: fix the error message for transid error (bsc#1176788).
• ceph: do not allow setlease on cephfs (bsc#1177041).
• ceph: fix potential mdsc use-after-free crash…

The SUSE Linux Enterprise 15 SP2 kernel RT was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25643: Added range checks in ppp_cp_parse_cr() (bsc#1177206).
• CVE-2020-25641: Allowed for_each_bvec to support zero len bvec (bsc#1177121).
• CVE-2020-25645: Added transport ports in route lookup for geneve (bsc#1177511).

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• airo: Fix read overflows sending packets (git-fixes).
• ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter (git-fixes).
• ASoC: img-i2s-out: Fix runtime PM imbalance on error (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1 (git-fixes).
• ASoC: kirkwood: fix IRQ error handling (git-fixes).
• ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions (git-fixes).
• ASoC: wm8994: Skip setting of the WM8994_MICBIAS register for WM1811 (git-fixes).
• ath10k: fix array out-of-bounds access (git-fixes).
• ath10k: fix memory leak for tpc_stats_final (git-fixes).
• ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read (git-fixes).
• Bluetooth: Fix refcount use-after-free issue (git-fixes).
• Bluetooth: guard against controllers sending zero'd events (git-fixes).
• Bluetooth: Handle Inquiry Cancel error after Inquiry Complete (git-fixes).
• Bluetooth: L2CAP: handle l2cap config request during open state (git-fixes).
• Bluetooth: prefetch channel before killing sock (git-fixes).
• brcmfmac: Fix double freeing in the fmac usb data path (git-fixes).
• btrfs: block-group: do not set the wrong READA flag for btrfs_read_block_groups() (bsc#1176019).
• btrfs: block-group: fix free-space bitmap threshold (bsc#1176019).
• btrfs: block-group: refactor how we delete one block group item (bsc#1176019).
• btrfs: block-group: refactor how we insert a block group item (bsc#1176019).
• btrfs: block-group: refactor how we read one block group item (bsc#1176019).
• btrfs: block-group: rename write_one_cache_group() (bsc#1176019).
• btrfs: do not take an extra root ref at allocation time (bsc#1176019).
• btrfs: drop logs when we've aborted a transaction (bsc#1176019).
• btrfs: fix a race between scrub and block group removal/allocation (bsc#1176019).
• btrfs: fix crash during unmount due to race with delayed inode workers (bsc#1176019).
• btrfs: free block groups after free'ing fs trees (bsc#1176019).
• btrfs: hold a ref on the root on the dead roots list (bsc#1176019).
• btrfs: kill the subvol_srcu (bsc#1176019).
• btrfs: make btrfs_cleanup_fs_roots use the radix tree lock (bsc#1176019).
• btrfs: make inodes hold a ref on their roots (bsc#1176019).
• btrfs: make the extent buffer leak check per fs info (bsc#1176019).
• btrfs: move ino_cache_inode dropping out of btrfs_free_fs_root (bsc#1176019).
• btrfs: move the block group freeze/unfreeze helpers into block-group.c (bsc#1176019).
• btrfs: move the root freeing stuff into btrfs_put_root (bsc#1176019).
• btrfs: remove no longer necessary chunk mutex locking cases (bsc#1176019).
• btrfs: rename member 'trimming' of block group to a more generic name (bsc#1176019).
• btrfs: scrub, only lookup for csums if we are dealing with a data extent (bsc#1176019).
• bus: hisi_lpc: Fixup IO ports addresses to avoid use-after-free in host removal (git-fixes).
• clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED (git-fixes).
• clk: socfpga: stratix10: fix the divider for the emac_ptp_free_clk (git-fixes).
• clk: tegra: Always program PLL_E when enabled (git-fixes).
• clk/ti/adpll: allocate room for terminating null (git-fixes).
• clocksource/drivers/h8300_timer8: Fix wrong return value in h8300_8timer_init() (git-fixes).
• clocksource/drivers/timer-gx6605s: Fixup counter reload (git-fixes).
• cpuidle: Poll for a minimum of 30ns and poll for a tick…

The SUSE Linux Enterprise 15 SP2 kernel Azure was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).
• CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth' aka 'BadVibes' (bsc#1177726).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).
• CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: Always build evged in (git-fixes).
• ACPI: button: fix handling lid state changes when input device closed (git-fixes).
• ACPI: configfs: Add missing config_item_put() to fix refcount leak (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• act_ife: load meta modules before tcf_idr_check_alloc() (networking-stable-20_09_24).
• Add CONFIG_CHECK_CODESIGN_EKU
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: ac97: (cosmetic) align argument names (git-fixes).
• ALSA: aoa: i2sbus: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: asihpi: fix spellint typo in comments (git-fixes).
• ALSA: atmel: ac97: clarify operator precedence (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: fireworks: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda: (cosmetic) align function parameters (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - set mic to auto detect on a HP AIO machine (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2017-18204: Fixed a denial of service in the ocfs2_setattr function of fs/ocfs2/file.c (bnc#1083244).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-25212: Fixed A TOCTOU mismatch in the NFS client code which could have been used by local attackers to corrupt memory (bsc#1176381).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).

The following non-security bugs were fixed:

• btrfs: fix race with relocation recovery and fs_root setup (bsc#1131277).
• btrfs: flush_space always takes fs_info->fs_root (bsc#1131277).
• btrfs: btrfs_init_new_device should use fs_info->dev_root (bsc#1131277, bsc#1176922).
• btrfs: btrfs_test_opt and friends should take a btrfs_fs_info (bsc#1131277, bsc#1176922).
• btrfs: call functions that always use the same root with fs_info instead (bsc#1131277, bsc#1176922).
• btrfs: call functions that overwrite their root parameter with fs_info (bsc#1131277, bsc#1176922).
• btrfs: flush_space always takes fs_info->fs_root (bsc#1131277, bsc#1176922).
• btrfs: pull node/sector/stripe sizes out of root and into fs_info (bsc#1131277, bsc#1176922).
• btrfs: Remove fs_info argument of btrfs_write_and_wait_transaction (bsc#1131277, bsc#1176922).
• btrfs: remove root parameter from transaction commit/end routines (bsc#1131277, bsc#1176922).
• btrfs: remove root usage from can_overcommit (bsc#1131277, bsc#1176922).
• btrfs: root->fs_info cleanup, access fs_info->delayed_root directly (bsc#1131277, bsc#1176922).
• btrfs: root->fs_info cleanup, add fs_info convenience variables (bsc#1131277, bsc#1176922).
• btrfs: root->fs_info cleanup, btrfs_calc_{trans,trunc}_metadata_size (bsc#1131277, bsc#1176922).
• btrfs: root->fs_info cleanup, update_block_group{,flags} (bsc#1131277, bsc#1176922).
• btrfs:…

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177511).
• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-25212: Fixed A TOCTOU mismatch in the NFS client code which could have been used by local attackers to corrupt memory (bsc#1176381).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2019-19063: Fixed two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c, which could have allowed an attacker to cause a denial of service (memory consumption) (bsc#1157298).
• CVE-2019-6133: In PolicyKit (aka polkit), the 'start time' protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c (bsc#1121872).
• CVE-2017-18204: Fixed a denial of service in the ocfs2_setattr function of fs/ocfs2/file.c (bnc#1083244).

The following non-security bugs were fixed:

• hv: vmbus: Add timeout to vmbus_wait_for_unload (bsc#1177816).
• hyperv_fb: disable superfluous VERSION_WIN10_V5 case (bsc#1175306).
• hyperv_fb: Update screen_info after removing old framebuffer (bsc#1175306).
• mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa (bsc#1176816).
• net/packet: fix overflow in tpacket_rcv (bsc#1176069).
• ocfs2: give applications more IO opportunities…

The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470).
• CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).
• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-2521: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).

The following non-security bugs were fixed:

• btrfs: cleanup root usage by btrfs_get_alloc_profile (bsc#1131277).
• btrfs: reloc: clear DEAD_RELOC_TREE bit for orphan roots to prevent runaway balance (bsc#1171417 bsc#1160947 bsc#1172366 bsc#1176922).
• btrfs: reloc: fix reloc root leak and NULL pointer dereference (bsc#1171417…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).
• CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).
• CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-14381: Fixed a UAF in the fast user mutex (futex) wait operation (bsc#1176011).
• CVE-2020-25643: Fixed an improper input validation in the ppp_cp_parse_cr function of the HDLC_PPP module (bnc#1177206).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).

The following non-security bugs were fixed:

• btrfs: remove root usage from can_overcommit (bsc#1131277).
• hv: vmbus: Add timeout to vmbus_wait_for_unload (bsc#1177816).
• hyperv_fb: disable superfluous VERSION_WIN10_V5 case (bsc#1175306).
• hyperv_fb: Update screen_info after removing old framebuffer (bsc#1175306).
• livepatch: Add -fdump-ipa-clones to build (). Add support for -fdump-ipa-clones GCC option. Update config files accordingly.
• livepatch: Test if -fdump-ipa-clones is really available As of now we add -fdump-ipa-clones unconditionally. It does not cause a trouble if the kernel is build with the supported toolchain. Otherwise it could fail easily. Do the correct thing and test for the availability.
• NFS: On fatal…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-14353: Fixed an issue where keys - for keyctl prevent creating a different user's keyrings (bsc#1174993).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/hugetlb.c could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact (bnc#1176485 ).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service (bsc#1179140).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206). -…

Elena Petrova discovered that the pin controller device tree implementation in the Linux kernel did not properly handle string references. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-0427)

Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. A physically proximate attacker could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). (CVE-2020-12352)

It was discovered that a race condition existed in the perf subsystem of the Linux kernel, leading to a use-after-free vulnerability. An attacker with access to the perf subsystem could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)

It was discovered that the frame buffer implementation in the Linux kernel did not properly handle some edge cases in software scrollback. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14390)

It was discovered that the netfilter connection tracker for netlink in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-25211)

It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform privilege checks for access to rbd devices in some situations. A local attacker could use this to map or unmap rbd block devices. (CVE-2020-25284)

It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25643)

It was discovered that the GENEVE tunnel implementation in the Linux kernel when combined with IPSec did not properly select IP routes in some situations. An attacker could use this to expose sensitive information (unencrypted network traffic). (CVE-2020-25645)

Keyu Man discovered that the ICMP global rate limiter in the Linux kernel could be used to assist in scanning open UDP ports. A remote attacker could use to facilitate attacks on UDP based services that depend on source port randomization. (CVE-2020-25705)

It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range checks in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28915)

It was discovered that Power 9 processors could be coerced to expose information from the L1 cache in certain situations. A local attacker could use this to expose sensitive information. (CVE-2020-4788)

It was discovered that a race condition existed in the binder IPC implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-0423)

Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. A physically proximate attacker could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

It was discovered that a race condition existed in the perf subsystem of the Linux kernel, leading to a use-after-free vulnerability. An attacker with access to the perf subsystem could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)

It was discovered that the frame buffer implementation in the Linux kernel did not properly handle some edge cases in software scrollback. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14390)

It was discovered that the netfilter connection tracker for netlink in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-25211)

It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform privilege checks for access to rbd devices in some situations. A local attacker could use this to map or unmap rbd block devices. (CVE-2020-25284)

It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25643)

It was discovered that the GENEVE tunnel implementation in the Linux kernel when combined with IPSec did not properly select IP routes in some situations. An attacker could use this to expose sensitive information (unencrypted network traffic). (CVE-2020-25645)

Keyu Man discovered that the ICMP global rate limiter in the Linux kernel could be used to assist in scanning open UDP ports. A remote attacker could use to facilitate attacks on UDP based services that depend on source port randomization. (CVE-2020-25705)

It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range checks in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28915)

It was discovered that Power 9 processors could be coerced to expose information from the L1 cache in certain situations. A local attacker could use this to expose sensitive information. (CVE-2020-4788)

It was discovered that a race condition existed in the perf subsystem of the Linux kernel, leading to a use-after-free vulnerability. An attacker with access to the perf subsystem could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)

It was discovered that the frame buffer implementation in the Linux kernel did not properly handle some edge cases in software scrollback. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14390)

It was discovered that the netfilter connection tracker for netlink in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-25211)

It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform privilege checks for access to rbd devices in some situations. A local attacker could use this to map or unmap rbd block devices. (CVE-2020-25284)

It was discovered that a race condition existed in the hugetlb sysctl implementation in the Linux kernel. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2020-25285)

It was discovered that the block layer subsystem in the Linux kernel did not properly handle zero-length requests. A local attacker could use this to cause a denial of service. (CVE-2020-25641)

It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25643)

It was discovered that the GENEVE tunnel implementation in the Linux kernel when combined with IPSec did not properly select IP routes in some situations. An attacker could use this to expose sensitive information (unencrypted network traffic). (CVE-2020-25645)

It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range checks in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28915)

It was discovered that Power 9 processors could be coerced to expose information from the L1 cache in certain situations. A local attacker could use this to expose sensitive information. (CVE-2020-4788)

Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. A physically proximate attacker could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

Jay Shin discovered that the ext4 file system implementation in the Linux kernel did not properly handle directory access with broken indexing, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-14314)

It was discovered that the block layer implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-15436)

It was discovered that the serial port driver in the Linux kernel did not properly initialize a pointer in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2020-15437)

Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-24490)

It was discovered that the NFS client implementation in the Linux kernel did not properly perform bounds checking before copying security labels in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25212)

It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform privilege checks for access to rbd devices in some situations. A local attacker could use this to map or unmap rbd block devices. (CVE-2020-25284)

It was discovered that the block layer subsystem in the Linux kernel did not properly handle zero-length requests. A local attacker could use this to cause a denial of service. (CVE-2020-25641)

It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25643)

Kiyin (尹亮) discovered that the perf subsystem in the Linux kernel did not properly deallocate memory in some situations. A privileged attacker could use this to cause a denial of service (kernel memory exhaustion). (CVE-2020-25704)

It was discovered that the KVM hypervisor in the Linux kernel did not properly handle interrupts in certain situations. A local attacker in a guest VM could possibly use this to cause a denial of service (host system crash). (CVE-2020-27152)

It was discovered that the jfs file system implementation in the Linux kernel contained an out-of-bounds read vulnerability. A local attacker could use this to possibly cause a denial of service (system crash). (CVE-2020-27815)

It was discovered that an information leak existed in the syscall implementation in the Linux kernel on 32 bit systems. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28588)

It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range checks in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28915)

Jann Horn discovered a race condition in the copy-on-write implementation in the Linux kernel when handling hugepages. A local attacker could use this to gain unintended write access to read-only memory pages. (CVE-2020-29368)

Jann Horn discovered that the mmap implementation in the Linux kernel contained a race…