CVE-2020-25705

A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free (CVE-2020-29661)

• kernel: performance counters race condition use-after-free (CVE-2020-14351)

• kernel: ICMP rate limiting can be used for DNS poisoning attack (CVE-2020-25705)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Final fixes + drop alpha_support flag requirement for Tigerlake (BZ#1882620)

• OVS complains Invalid Argument on TCP packets going into conntrack (BZ#1892744)

• BUG: using smp_processor_id() in preemptible [00000000] code: handler106/3082 (BZ#1893281)

• Icelake performance - add intel_idle: Customize IceLake server support to AlmaLinux-8 (BZ#1897183)

• [mlx5] IPV6 TOS rewrite flows are not getting offloaded in HW (BZ#1897688)

• AlmaLinux 8.3 SAS - multipathd fails to re-establish paths during controller random reset (BZ#1900112)

• AlmaLinux8.3 Beta - AlmaLinux8.3 hangs on dbginfo.sh execution, crash dump generated (mm-) (BZ#1903019)

• Win10 guest automatic reboot after migration in Win10 and WSL2 on AMD hosts (BZ#1905084)

• block, dm: fix IO splitting for stacked devices (BZ#1905136)

• Failed to hotplug scsi-hd disks (BZ#1905214)

• PCI quirk needed to prevent GPU hang (BZ#1906516)

• AlmaLinux8.2 - various patches to stabilize the OPAL error log processing and the powernv dump processing (ESS) (BZ#1907301)

• pmtu not working with tunnels as bridge ports and br_netfilter loaded (BZ#1907576)

• [ThinkPad X13/T14/T14s AMD]: Kdump failed (BZ#1907775)

• NFSv4 client improperly handles interrupted slots (BZ#1908312)

• NFSv4.1 client ignores ERR_DELAY during LOCK recovery, could lead to data corruption (BZ#1908313)

• [Regression] AlmaLinux8.2 - [kernel 148.el8] cpu (sys) time regression in SAP HANA 2.0 benchmark benchInsertSubSelectPerformance (BZ#1908519)

• AlmaLinux8: kernel-rt: kernel BUG at kernel/sched/deadline.c:1462! (BZ#1908731)

• SEV VM hang at efi_mokvar_sysfs_init+0xa9/0x19d during boot (BZ#1909243)

• C6gn support requires "Ensure dirty bit is preserved across pte_wrprotect" patch (BZ#1909577)

• [Lenovo 8.3 & 8.4 Bug] [Regression] No response from keyboard and mouse when boot from tboot kernel (BZ#1911555)

• Kernel crash with krb5p (BZ#1912478)

• [AlmaLinux8] Need additional backports for FIPS 800-90A DRBG entropy seeding source (BZ#1912872)

• [Hyper-V][AlmaLinux-8] Request to included a commit that adds a timeout to vmbus_wait_for_unload (BZ#1913528)

• Host becomes unresponsive during stress-ng --cyclic test rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: (BZ#1913964)

• AlmaLinux8.4: Backport upstream RCU patches up to v5.6 (BZ#1915638)

• Missing mm backport to fix regression introduced by another mm backport (BZ#1915814)

• [Hyper-V][AlmaLinux-8]video: hyperv_fb: Fix the cache type when mapping the VRAM Edit (BZ#1917711)

• ionic 0000:39:00.0 ens2: IONIC_CMD_Q_INIT (40) failed: IONIC_RC_ERROR (-5) (BZ#1918372)

• [certification] mlx5_core depends on tls triggering TAINT_TECH_PREVIEW even if no ConnectX-6 card is present (BZ#1918743)

• kvm-almalinux8.3 [AMD] - system crash observed while powering on virtual machine with attached VF interfaces. (BZ#1919885)

Enhancement(s):

• [Mellanox 8.4 FEAT] mlx5: Add messages when VF-LAG fails to start (BZ#1892344)

In icmp_global_allow of icmp.c, there is a possible disclosure of UDP source ports due to a side channel information disclosure. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

This update provides an upgrade to the new upstream 5.10 longterm branch, currently based on 5.10.6, adding new features and new and improved hardware support.

This update also fixes at least the following security issues:

In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation (CVE-2020-0423).

In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (CVE-2020-0465).

Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2020-8694).

A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access (CVE-2020-12912).

A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2020-14351).

A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality (CVE-2020-25656).

Linux kernel concurrency use-after-free in vt (CVE-2020-25668).

Linux Kernel use-after-free in sunkbd_reinit (CVE-2020-25669).

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service (CVE-2020-25704).

A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allows to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well (CVE-2020-25705).

An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering (CVE-2020-27152).

An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values (CVE-2020-27194).

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0 (CVE-2020-27673).

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device (CVE-2020-27675).

A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat…

This update provides an upgrade to the new upstream 5.10 longterm branch, currently based on 5.10.6, adding new features and new and improved hardware support.

This update also fixes at least the following security issues:

In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation (CVE-2020-0423).

In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (CVE-2020-0465).

Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2020-8694).

A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access (CVE-2020-12912).

A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2020-14351).

A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality (CVE-2020-25656).

Linux kernel concurrency use-after-free in vt (CVE-2020-25668).

Linux Kernel use-after-free in sunkbd_reinit (CVE-2020-25669).

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service (CVE-2020-25704).

A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allows to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well (CVE-2020-25705).

An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering (CVE-2020-27152).

An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values (CVE-2020-27194).

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0 (CVE-2020-27673).

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device (CVE-2020-27675).

A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat…

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25668: Make FONTX ioctl use the tty pointer they were actually passed (bsc#1178123).
• CVE-2020-25656: Extend func_buf_lock to readers (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812 (bnc#1176485).
• CVE-2020-14351: Fixed race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-8694: Restrict energy meter to root access (bsc#1170415).
• CVE-2020-16120: Check permission to open real file in overlayfs (bsc#1177470).
• CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The following non-security bugs were fixed:

• ACPI: Always build evged in (git-fixes).
• ACPI: button: fix handling lid state changes when input device closed (git-fixes).
• ACPI: configfs: Add missing config_item_put() to fix refcount leak (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• act_ife: load meta modules before tcf_idr_check_alloc() (networking-stable-20_09_24).
• Add CONFIG_CHECK_CODESIGN_EKU
• ALSA: ac97: (cosmetic) align argument names (git-fixes).
• ALSA: aoa: i2sbus: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: asihpi: fix spellint typo in comments (git-fixes).
• ALSA: atmel: ac97: clarify operator precedence (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: fireworks: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: fix kernel-doc markups (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda: (cosmetic) align function parameters (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - Enable headphone for ASUS TM420 (git-fixes).
• ALSA: hda/realtek - Fixed HP headset Mic can't be detected (git-fixes).
• ALSA: hda/realtek - set mic to auto detect on a HP AIO machine (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: hdspm: Fix typo arbitary (git-fixes).
• ALSA: mixart: Correct comment wrt obsoleted tasklet usage (git-fixes).
• ALSA: portman2x4: fix repeated word 'if' (git-fixes).
• ALSA: rawmidi: (cosmetic) align function parameters (git-fixes).
• ALSA: seq: oss: Avoid mutex lock for a long-time ioctl (git-fixes).
• ALSA: sparc: dbri: fix repeated word 'the' (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for MODX (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for Qu-16…

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-28915: A buffer over-read (at the framebuffer layer) in the fbcon code could be used by local attackers to read kernel memory, aka CID-6735b4632def (bnc#1178886).
• CVE-2020-25669: A use-after-free in teardown paths of sunkbd was fixed (bsc#1178182).
• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well. Kernel versions may be vulnerable to this issue (bnc#1175721 bnc#1178782).
• CVE-2020-25704: A a memory leak in perf_event_parse_addr_filter() was foxed (bsc#1178393, CVE-2020-25704).

The following non-security bugs were fixed:

• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• bpf: Zero-fill re-used per-cpu map element (git-fixes).
• can: af_can: prevent potential access of uninitialized member in canfd_rcv() (git-fixes).
• can: af_can: prevent potential access of uninitialized member in can_rcv() (git-fixes).
• can: dev: can_restart(): post buffer from the right context (git-fixes).
• can: m_can: m_can_handle_state_change(): fix state change (git-fixes).
• can: m_can: m_can_stop(): set device to software init mode before closing (git-fixes).
• can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() (git-fixes).
• can: peak_usb: fix potential integer overflow on shift of a int (git-fixes).
• docs: ABI: sysfs-c2port: remove a duplicated entry (git-fixes).
• drbd: code cleanup by using sendpage_ok() to check page for kernel_sendpage() (bsc#1172873).
• drm/i915: Break up error capture compression loops with cond_resched() (git-fixes).
• drm/vc4: drv: Add error handding for bind (git-fixes).
• Drop sysctl files for dropped archs, add ppc64le and arm64 (bsc#1178838). Also fix the ppc64 page size.
• fs/proc/array.c: allow reporting eip/esp for all coredumping threads (bsc#1050549).
• ftrace: Fix recursion check for NMI test (git-fixes).
• ftrace: Handle tracing when switching between context (git-fixes).
• futex: Do not enable IRQs unconditionally in put_pi_state() (bsc#1067665).
• futex: Handle transient 'ownerless' rtmutex state correctly (bsc#1067665).
• hv_netvsc: Add XDP support (bsc#1177819, bsc#1177820).
• hv_netvsc: deal with bpf API differences in 4.12 (bsc#1177819, bsc#1177820).
• hv_netvsc: Fix XDP refcnt for synthetic and VF NICs (bsc#1177819, bsc#1177820).
• hv_netvsc: make recording RSS hash depend on feature flag (bsc#1178853, bsc#1178854).
• hv_netvsc: record hardware hash in skb (bsc#1178853, bsc#1178854).
• hyperv_fb: Update screen_info after removing old framebuffer (bsc#1175306).
• inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() (git-fixes).
• Input: adxl34x - clean up a data type in adxl34x_probe() (git-fixes).
• kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled (git-fixes).
• libceph: use sendpage_ok() in ceph_tcp_sendpage() (bsc#1172873).
• locking/lockdep: Add debug_locks check in __lock_downgrade() (bsc#1050549).
• locking/percpu-rwsem: Use this_cpu_{inc,dec}() for read_count (bsc#1050549).
• locktorture: Print ratio of acquisitions, not failures (bsc#1050549).
• mac80211: minstrel: fix tx status processing corner case (git-fixes).
• mac80211: minstrel: remove deferred sampling code (git-fixes).
• memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event (bsc#1177703).
• mmc: sdhci-of-esdhc: Handle pulse width detection erratum for more SoCs (git-fixes).
• mm/memcg: fix refcount error while moving and swapping (bsc#1178686).
• net: add WARN_ONCE in kernel_sendpage() for improper…

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth' aka 'BadVibes' (bsc#1177726).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' aka 'BadChoice' (bsc#1177725).
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code in the Linux kernel could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452 (bnc#1176381).
• CVE-2020-25645: Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality (bnc#1177511).
• CVE-2020-25643: Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (bnc#1177206).
• CVE-2020-25641: A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allowed a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability (bnc#1177121).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25668: Make FONTX ioctl use the tty pointer they were actually passed (bsc#1178123).
• CVE-2020-25656: Extend func_buf_lock to readers (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812 (bnc#1176485).
• CVE-2020-14351: Fixed race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-8694: Restrict energy meter to root access (bsc#1170415).
• CVE-2020-16120: Check permission to open real file in overlayfs (bsc#1177470).
• CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: Always build evged in (git-fixes).
• ACPI: button: fix handling lid state changes when input device closed (git-fixes).
• ACPI: configfs: Add missing config_item_put() to fix refcount leak (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• act_ife: load meta modules before tcf_idr_check_alloc() (networking-stable-20_09_24).
• Add CONFIG_CHECK_CODESIGN_EKU
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: ac97: (cosmetic) align argument names (git-fixes).
• ALSA: aoa: i2sbus: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: asihpi: fix spellint typo in comments (git-fixes).
• ALSA: atmel: ac97: clarify operator precedence (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm:…

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-29369: There was a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe (bnc#1173504 bnc#1179432).
• CVE-2020-29371: An issue was discovered in romfs_dev_read in fs/romfs/storage.c, where uninitialized memory could leak to userspace, aka CID-bcf85fcedfdd (bnc#1179429).
• CVE-2020-15436: Use-after-free vulnerability in fs/block_dev.c allowed local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field (bnc#1179141).
• CVE-2020-25705: A flaw in the way reply ICMP packets are limited was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well. Kernel versions may be vulnerable to this issue (bnc#1175721 bnc#1178782).
• CVE-2020-15437: The Linux kernel was vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allowed local users to cause a denial of service by using the p->serial_in pointer which uninitialized (bnc#1179140).
• CVE-2020-27777: Restricted RTAS requests from userspace (bsc#1179107).
• CVE-2020-28974: A slab-out-of-bounds read in fbcon could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height (bnc#1178589).
• CVE-2020-4788: IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296 (bnc#1177666).
• CVE-2020-28941: Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once (bnc#1178740).
• CVE-2020-28915: A buffer over-read (at the framebuffer layer) in the fbcon code could be used by local attackers to read kernel memory, aka CID-6735b4632def (bnc#1178886).
• CVE-2020-25669: Avoid a use-after-free in teardown paths in sunkbd (bsc#1178182).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• ACPI: GED: fix -Wformat (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: button: Add DMI quirk for Medion Akoya E2228T (git-fixes).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPICA: Add NHLT table signature (bsc#1176200).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button (git-fixes).
• ALSA: hda/realtek - Add supported mute Led for HP (git-fixes).
• ALSA: hda/realtek - HP Headset Mic can't detect after boot (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda: Reinstate runtime_allow() for all hda controllers (git-fixes).
• ALSA: hda: fix jack detection with Realtek codecs when in D3 (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes).
• ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).
• Add bug reference to two hv_netvsc patches (bsc#1178853).
• Convert trailing spaces and periods in path components (bsc#1179424).
• Documentation/admin-guide/module-signing.rst: add openssl command option example for CodeSign EKU (bsc#1177353, bsc#1179076).
• Drop sysctl files for…

This update syncs the RT kernel from the SUSE Linux Enterprise 15-SP2 codestream.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the sca-patterns-sle12-1.0.8-2.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sca-patterns-sle15-1.0.8-2.2 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).
• CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The following non-security bugs were fixed:

• act_ife: load meta modules before tcf_idr_check_alloc() (networking-stable-20_09_24).
• ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n() (git-fixes).
• ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs() (git-fixes).
• block: Set same_page to false in __bio_try_merge_page if ret is false (git-fixes).
• Bluetooth: btusb: Fix memleak in btusb_mtk_submit_wmt_recv_urb (git-fixes).
• Bluetooth: Only mark socket zapped after unlocking (git-fixes).
• bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex (git-fixes).
• bonding: show saner speed for broadcast mode (networking-stable-20_08_24).
• brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach (git-fixes).
• brcmsmac: fix memory leak in wlc_phy_attach_lcnphy (git-fixes).
• btrfs: allocate scrub workqueues outside of locks (bsc#1178183).
• btrfs: do not force read-only after error in drop snapshot (bsc#1176354).
• btrfs: drop path before adding new uuid tree entry (bsc#1178176).
• btrfs: fix filesystem corruption after a device replace (bsc#1178395).
• btrfs: fix NULL pointer dereference after failure to create snapshot (bsc#1178190).
• btrfs: fix overflow when copying corrupt csums for a message (bsc#1178191).
• btrfs: fix space cache memory leak after transaction abort (bsc#1178173).
• btrfs: move btrfs_rm_dev_replace_free_srcdev outside of all locks (bsc#1178395).
• btrfs: move btrfs_scratch_superblocks into btrfs_dev_replace_finishing (bsc#1178395).
• btrfs: set the correct lockdep class for new nodes (bsc#1178184).
• btrfs: set the lockdep class for log tree extent buffers (bsc#1178186).
• can: flexcan: flexcan_chip_stop(): add error handling and propagate error value (git-fixes).
• ceph: promote to unsigned long long before shifting (bsc#1178175).
• crypto: ccp - fix error handling (git-fixes).
• cxgb4: fix memory leak during module unload (networking-stable-20_09_24).
• cxgb4: Fix offset when clearing filter byte counters (networking-stable-20_09_24).
• Disable ipa-clones dump for KMP builds (bsc#1178330) The feature is not really useful for KMP, and rather confusing, so let's disable it at building out-of-tree codes
• Disable module compression on SLE15 SP2 (bsc#1178307)
• dmaengine: dw: Activate FIFO-mode for memory peripherals only (git-fixes).
• eeprom: at25: set minimum read/write access stride to 1 (git-fixes).
• futex: Adjust absolute futex timeouts with per time namespace offset (bsc#1164648).
• futex: Consistently use fshared as boolean (bsc#1149032).
• futex: Fix incorrect should_fail_futex() handling (bsc#1149032).
• futex: Remove put_futex_key() (bsc#1149032).
• futex: Remove unused or redundant includes (bsc#1149032).
• gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY (networking-stable-20_08_24).
• gtp: add GTPA_LINK info to msg sent to userspace (networking-stable-20_09_11).
• HID: ite: Add USB id match for Acer One S1003 keyboard dock (git-fixes).
• ibmveth: Identify ingress large send packets (bsc#1178185 ltc#188897).
• ibmvnic: fix ibmvnic_set_mac (bsc#1066382 ltc#160943 git-fixes).
• icmp: randomize the global rate limiter (git-fixes).
• ip: fix tos reflection in ack and reset packets (networking-stable-20_09_24).
• ipv4: Initialize flowi4_multipath_hash in data path (networking-stable-20_09_24).
• ipv4: Restore flowi4_oif update before call to xfrm_lookup_route (git-fixes).
• ipv4: Update exception handling for multipath routes via same device (networking-stable-20_09_24).
• ipv6: avoid lockdep issue in fib6_del()…

The SUSE Linux Enterprise 12 SP5 kernel Azure was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).
• CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).
• CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The following non-security bugs were fixed:

• ACPI: dock: fix enum-conversion warning (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: mixart: Correct comment wrt obsoleted tasklet usage (git-fixes).
• ALSA: rawmidi: (cosmetic) align function parameters (git-fixes).
• ALSA: seq: oss: Avoid mutex lock for a long-time ioctl (git-fixes).
• ALSA: usb-audio: Add mixer support for Pioneer DJ DJM-250MK2 (git-fixes).
• ALSA: usb-audio: endpoint.c: fix repeated word 'there' (git-fixes).
• ALSA: usb-audio: fix spelling mistake 'Frequence' -> 'Frequency' (git-fixes).
• amd-xgbe: Add a check for an skb in the timestamp path (git-fixes).
• amd-xgbe: Add additional dynamic debug messages (git-fixes).
• amd-xgbe: Add additional ethtool statistics (git-fixes).
• amd-xgbe: Add ethtool show/set channels support (git-fixes).
• amd-xgbe: Add ethtool show/set ring parameter support (git-fixes).
• amd-xgbe: Add ethtool support to retrieve SFP module info (git-fixes).
• amd-xgbe: Add hardware features debug output (git-fixes).
• amd-xgbe: Add NUMA affinity support for IRQ hints (git-fixes).
• amd-xgbe: Add NUMA affinity support for memory allocations (git-fixes).
• amd-xgbe: Add per queue Tx and Rx statistics (git-fixes).
• amd-xgbe: Advertise FEC support with the KR re-driver (git-fixes).
• amd-xgbe: Always attempt link training in KR mode (git-fixes).
• amd-xgbe: Be sure driver shuts down cleanly on module removal (git-fixes).
• amd-xgbe: Convert to generic power management (git-fixes).
• amd-xgbe: Fix debug output of max channel counts (git-fixes).
• amd-xgbe: Fix error path in xgbe_mod_init() (git-fixes).
• amd-xgbe: Fixes for working with PHYs that support 2.5GbE (git-fixes).…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).
• CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).
• CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The following non-security bugs were fixed:

• ACPI: dock: fix enum-conversion warning (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: mixart: Correct comment wrt obsoleted tasklet usage (git-fixes).
• ALSA: rawmidi: (cosmetic) align function parameters (git-fixes).
• ALSA: seq: oss: Avoid mutex lock for a long-time ioctl (git-fixes).
• ALSA: usb-audio: Add mixer support for Pioneer DJ DJM-250MK2 (git-fixes).
• ALSA: usb-audio: endpoint.c: fix repeated word 'there' (git-fixes).
• ALSA: usb-audio: fix spelling mistake 'Frequence' -> 'Frequency' (git-fixes).
• ASoC: qcom: lpass-cpu: fix concurrency issue (git-fixes).
• ASoC: qcom: lpass-platform: fix memory leak (git-fixes).
• ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n() (git-fixes).
• ath10k: Fix the size used in a 'dma_free_coherent()' call in an error handling path (git-fixes).
• ath10k: provide survey info as accumulated data (git-fixes).
• ath6kl: prevent potential array overflow in ath6kl_add_new_sta() (git-fixes).
• ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd() (git-fixes).
• ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() (git-fixes).
• ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs() (git-fixes).
• blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART (bsc#1177750).
• block: ensure bdi->io_pages is always initialized (bsc#1177749).
• Bluetooth: MGMT: Fix not checking if BT_HS is enabled (git-fixes).
• Bluetooth: Only mark socket zapped after unlocking (git-fixes).
• bnxt: do not enable NAPI until rings are ready (networking-stable-20_09_11).
• bnxt_en: Check for zero dir entries in NVRAM (networking-stable-20_09_11).
• brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach (git-fixes).
• brcmfmac: check ndev pointer (git-fixes).
• brcmsmac: fix memory leak in wlc_phy_attach_lcnphy (git-fixes).
• btrfs: do not force read-only after error in drop snapshot (bsc#1176354).
• btrfs: qgroup: fix qgroup meta rsv leak for subvolume operations (bsc#1177856).
• btrfs: qgroup: fix wrong qgroup metadata reserve for delayed inode (bsc#1177855).
• btrfs: remove root usage from can_overcommit (bsc#1131277).
• btrfs: take overcommit into account in inc_block_group_ro (bsc#1176560). -…

The SUSE Linux Enterprise 15 SP1 Azure kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-8694: Insufficient access control for some Intel(R) Processors may have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1170415).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).
• CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: mixart: Correct comment wrt obsoleted tasklet usage (git-fixes).
• ALSA: rawmidi: (cosmetic) align function parameters (git-fixes).
• ALSA: seq: oss: Avoid mutex lock for a long-time ioctl (git-fixes).
• ALSA: usb-audio: Add mixer support for Pioneer DJ DJM-250MK2 (git-fixes).
• ALSA: usb-audio: endpoint.c: fix repeated word 'there' (git-fixes).
• ALSA: usb-audio: fix spelling mistake 'Frequence' -> 'Frequency' (git-fixes).
• amd-xgbe: Add a check for…

The SUSE Linux Enterprise 15 SP2 kernel Azure was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).
• CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth' aka 'BadVibes' (bsc#1177726).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).
• CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: Always build evged in (git-fixes).
• ACPI: button: fix handling lid state changes when input device closed (git-fixes).
• ACPI: configfs: Add missing config_item_put() to fix refcount leak (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• act_ife: load meta modules before tcf_idr_check_alloc() (networking-stable-20_09_24).
• Add CONFIG_CHECK_CODESIGN_EKU
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: ac97: (cosmetic) align argument names (git-fixes).
• ALSA: aoa: i2sbus: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: asihpi: fix spellint typo in comments (git-fixes).
• ALSA: atmel: ac97: clarify operator precedence (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: fireworks: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda: (cosmetic) align function parameters (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - set mic to auto detect on a HP AIO machine (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2017-18204: Fixed a denial of service in the ocfs2_setattr function of fs/ocfs2/file.c (bnc#1083244).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-25212: Fixed A TOCTOU mismatch in the NFS client code which could have been used by local attackers to corrupt memory (bsc#1176381).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).

The following non-security bugs were fixed:

• btrfs: fix race with relocation recovery and fs_root setup (bsc#1131277).
• btrfs: flush_space always takes fs_info->fs_root (bsc#1131277).
• btrfs: btrfs_init_new_device should use fs_info->dev_root (bsc#1131277, bsc#1176922).
• btrfs: btrfs_test_opt and friends should take a btrfs_fs_info (bsc#1131277, bsc#1176922).
• btrfs: call functions that always use the same root with fs_info instead (bsc#1131277, bsc#1176922).
• btrfs: call functions that overwrite their root parameter with fs_info (bsc#1131277, bsc#1176922).
• btrfs: flush_space always takes fs_info->fs_root (bsc#1131277, bsc#1176922).
• btrfs: pull node/sector/stripe sizes out of root and into fs_info (bsc#1131277, bsc#1176922).
• btrfs: Remove fs_info argument of btrfs_write_and_wait_transaction (bsc#1131277, bsc#1176922).
• btrfs: remove root parameter from transaction commit/end routines (bsc#1131277, bsc#1176922).
• btrfs: remove root usage from can_overcommit (bsc#1131277, bsc#1176922).
• btrfs: root->fs_info cleanup, access fs_info->delayed_root directly (bsc#1131277, bsc#1176922).
• btrfs: root->fs_info cleanup, add fs_info convenience variables (bsc#1131277, bsc#1176922).
• btrfs: root->fs_info cleanup, btrfs_calc_{trans,trunc}_metadata_size (bsc#1131277, bsc#1176922).
• btrfs: root->fs_info cleanup, update_block_group{,flags} (bsc#1131277, bsc#1176922).
• btrfs:…

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177511).
• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-25212: Fixed A TOCTOU mismatch in the NFS client code which could have been used by local attackers to corrupt memory (bsc#1176381).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2019-19063: Fixed two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c, which could have allowed an attacker to cause a denial of service (memory consumption) (bsc#1157298).
• CVE-2019-6133: In PolicyKit (aka polkit), the 'start time' protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c (bsc#1121872).
• CVE-2017-18204: Fixed a denial of service in the ocfs2_setattr function of fs/ocfs2/file.c (bnc#1083244).

The following non-security bugs were fixed:

• hv: vmbus: Add timeout to vmbus_wait_for_unload (bsc#1177816).
• hyperv_fb: disable superfluous VERSION_WIN10_V5 case (bsc#1175306).
• hyperv_fb: Update screen_info after removing old framebuffer (bsc#1175306).
• mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa (bsc#1176816).
• net/packet: fix overflow in tpacket_rcv (bsc#1176069).
• ocfs2: give applications more IO opportunities…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ata: sata_rcar: Fix DMA boundary mask (git-fixes).
• ath10k: fix VHT NSS calculation when STBC is enabled (git-fixes).
• ath10k: start recovery process when payload length exceeds max htc length for sdio (git-fixes).
• bus/fsl_mc: Do not rely on caller to provide non NULL mc_io (git-fixes).
• can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() (git-fixes).
• can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames (git-fixes).
• can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context (git-fixes).
• can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on (git-fixes).
• can: peak_usb: add range checking in decode operations (git-fixes).
• can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping (git-fixes).
• can: rx-offload: do not call kfree_skb() from IRQ context (git-fixes).
• clk: ti: clockdomain: fix static checker warning (git-fixes).
• crypto: bcm - Verify GCM/CCM key length in setkey (git-fixes).
• device property: Do not clear secondary pointer for shared primary firmware node (git-fixes).
• device property: Keep secondary firmware node secondary by type (git-fixes).
• drbd: code cleanup by using sendpage_ok() to check page for kernel_sendpage() (bsc#1172873).
• drm/amd/display: Do not invoke kgdb_breakpoint() unconditionally (git-fixes).
• drm/amd/display: HDMI remote sink need mode validation for Linux (git-fixes).
• drm/amdgpu: do not map BO in reserved region (git-fixes).
• drm/bridge/synopsys: dsi: add support for non-continuous HS clock (git-fixes).
• drm/brige/megachips: Add checking if ge_b850v3_lvds_init() is working correctly (git-fixes).
• drm/i915: Break up error capture compression loops with cond_resched() (git-fixes).
• drm/i915: Force VT'd workarounds when running as a guest OS (git-fixes).
• drm/imx: tve remove extraneous type qualifier (git-fixes).
• drm/ttm: fix eviction valuable range check (git-fixes).
• drm/vc4: drv: Add error handding for bind (git-fixes).
• efivarfs: Replace invalid slashes with exclamation marks in dentries (git-fixes).
• ftrace: Fix recursion check for NMI test (git-fixes).
• ftrace: Handle tracing when switching between context (git-fixes).
• hv_netvsc: Add XDP support (bsc#1177819, bsc#1177820).
• hv_netvsc: Fix XDP refcnt for synthetic and VF NICs (bsc#1177819, bsc#1177820).
• hyperv_fb: Update screen_info after removing old framebuffer (bsc#1175306).
• icmp: randomize the global rate limiter (git-fixes).
• kthread_worker: prevent queuing delayed work from…

The SUSE Linux Enterprise 12 SP5 realtime kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-8694: Insufficient access control for some Intel(R) Processors may have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1170415).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470).
• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: mixart: Correct comment wrt obsoleted tasklet usage (git-fixes).
• ALSA: rawmidi: (cosmetic) align function parameters (git-fixes).
• ALSA: seq: oss: Avoid mutex lock for a long-time ioctl (git-fixes).
• ALSA: usb-audio: Add mixer support for Pioneer DJ DJM-250MK2 (git-fixes).
• ALSA: usb-audio: endpoint.c: fix repeated word 'there' (git-fixes).
• ALSA: usb-audio: Fix potential use-after-free of streams (gix-fixes).
• ALSA: usb-audio: fix spelling mistake 'Frequence' -> 'Frequency' (git-fixes).
• arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs…

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-8694: Insufficient access control for some Intel(R) Processors may have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1170415).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470).
• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: mixart: Correct comment wrt obsoleted tasklet usage (git-fixes).
• ALSA: rawmidi: (cosmetic) align function parameters (git-fixes).
• ALSA: seq: oss: Avoid mutex lock for a long-time ioctl (git-fixes).
• ALSA: usb-audio: Add mixer support for Pioneer DJ DJM-250MK2 (git-fixes).
• ALSA: usb-audio: endpoint.c: fix repeated word 'there' (git-fixes).
• ALSA: usb-audio: fix spelling mistake 'Frequence' -> 'Frequency' (git-fixes).
• ASoC: qcom: lpass-cpu: fix concurrency issue (git-fixes).
• ASoC: qcom: lpass-platform: fix memory leak (git-fixes).
• ata:…

The SUSE Linux Enterprise 15 SP2 realtime kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-8694: Insufficient access control for some Intel(R) Processors may have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1170415).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470).
• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth (bsc#1177726).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon (bsc#1178589)

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• ACPI: Always build evged in (git-fixes).
• ACPI: button: fix handling lid state changes when input device closed (git-fixes).
• ACPI: configfs: Add missing config_item_put() to fix refcount leak (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: GED: fix -Wformat (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• act_ife: load meta modules before tcf_idr_check_alloc() (networking-stable-20_09_24).
• ALSA: ac97: (cosmetic) align argument names (git-fixes).
• ALSA: aoa: i2sbus: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: asihpi: fix spellint typo in comments (git-fixes).
• ALSA: atmel: ac97: clarify operator precedence (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: fireworks: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: fix kernel-doc markups (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda: (cosmetic) align function parameters (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close…

The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470).
• CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).
• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-2521: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).

The following non-security bugs were fixed:

• btrfs: cleanup root usage by btrfs_get_alloc_profile (bsc#1131277).
• btrfs: reloc: clear DEAD_RELOC_TREE bit for orphan roots to prevent runaway balance (bsc#1171417 bsc#1160947 bsc#1172366 bsc#1176922).
• btrfs: reloc: fix reloc root leak and NULL pointer dereference (bsc#1171417…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).
• CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).
• CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-14381: Fixed a UAF in the fast user mutex (futex) wait operation (bsc#1176011).
• CVE-2020-25643: Fixed an improper input validation in the ppp_cp_parse_cr function of the HDLC_PPP module (bnc#1177206).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).

The following non-security bugs were fixed:

• btrfs: remove root usage from can_overcommit (bsc#1131277).
• hv: vmbus: Add timeout to vmbus_wait_for_unload (bsc#1177816).
• hyperv_fb: disable superfluous VERSION_WIN10_V5 case (bsc#1175306).
• hyperv_fb: Update screen_info after removing old framebuffer (bsc#1175306).
• livepatch: Add -fdump-ipa-clones to build (). Add support for -fdump-ipa-clones GCC option. Update config files accordingly.
• livepatch: Test if -fdump-ipa-clones is really available As of now we add -fdump-ipa-clones unconditionally. It does not cause a trouble if the kernel is build with the supported toolchain. Otherwise it could fail easily. Do the correct thing and test for the availability.
• NFS: On fatal…

This update for the Linux Kernel 4.4.180-94_130 fixes several issues.

The following security issues were fixed:

• CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178622).
• CVE-2020-8694: Fixed an insufficient access control in the Linux kernel driver for some Intel(R) Processors which might have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1178700).
• CVE-2020-25705: Fixed a flaw which could have allowed an off-path remote user to effectively bypass source port UDP randomization (bsc#1178783).

This update for the Linux Kernel 4.12.14-197_64 fixes several issues.

The following security issues were fixed:

• CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178622).
• CVE-2020-8694: Fixed an insufficient access control in the Linux kernel driver for some Intel(R) Processors which might have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1178700).
• CVE-2020-25705: Fixed a flaw which could have allowed an off-path remote user to effectively bypass source port UDP randomization (bsc#1178783).
• Fixed an issue where system was hanging due to a massive amount of soft lockups in btrfs_drop_and_free_fs_root() (bsc#1178046).

This update for the Linux Kernel 4.12.14-197_67 fixes several issues.

The following security issues were fixed:

• CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178622).
• CVE-2020-25705: Fixed a flaw which could have allowed an off-path remote user to effectively bypass source port UDP randomization (bsc#1178783).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178123).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25704: Fixed a leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107)
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-25705: Fixed an issue which could have allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization (bsc#1175721).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• ACPI: GED: fix -Wformat (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• arm64: KVM: Fix system register enumeration (bsc#1174726).
• arm/arm64: KVM: Add PSCI version selection API (bsc#1174726).
• ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).
• ath10k: Acquire tx_lock in tx error paths (git-fixes).
• batman-adv: set .owner to THIS_MODULE (git-fixes).
• Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers (git-fixes).
• Bluetooth: hci_bcm: fix freeing not-requested IRQ (git-fixes).
• bpf: Zero-fill re-used per-cpu map element (git-fixes).
• btrfs: account ticket size at add/delete time (bsc#1178897).
• btrfs: add helper to obtain number of devices with ongoing dev-replace (bsc#1178897).
• btrfs: check rw_devices, not num_devices for balance (bsc#1178897).
• btrfs: do not delete mismatched root refs (bsc#1178962).
• btrfs: fix btrfs_calc_reclaim_metadata_size calculation (bsc#1178897).
• btrfs: fix force usage in inc_block_group_ro (bsc#1178897).
• btrfs: fix invalid removal of root ref (bsc#1178962).
• btrfs: fix reclaim counter leak of space_info objects (bsc#1178897).
• btrfs: fix reclaim_size counter leak after stealing from global reserve (bsc#1178897).
• btrfs: kill min_allocable_bytes in inc_block_group_ro (bsc#1178897).
• btrfs: rework arguments of btrfs_unlink_subvol (bsc#1178962).
• btrfs: split dev-replace locking helpers for read and write (bsc#1178897).
• can: af_can: prevent potential access of uninitialized member in canfd_rcv() (git-fixes).
• can: af_can: prevent potential access of uninitialized member in can_rcv() (git-fixes).
• can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() (git-fixes).
• can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames (git-fixes).
• can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context (git-fixes).
• can: dev: can_restart(): post buffer from the right context (git-fixes).
• can: gs_usb: fix endianess problem with candleLight firmware (git-fixes).
• can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 (git-fixes).
• can: m_can:…

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25705: Fixed A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107)
• CVE-2020-27786: Fixed a use after free in kernel midi subsystem snd_rawmidi_kernel_read1() (bsc#1179601).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28941: Fixed an issue where local attackers on systems with the speakup driver could cause a local denial of service attack (bsc#1178740).
• CVE-2020-29369: Fixed a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe (bnc#1173504 bsc#1179432).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).

The following non-security bugs were fixed:

• ACPI: APEI: Kick the memory_failure() queue for synchronous errors (jsc#SLE-16610).
• ACPI: button: Add DMI quirk for Medion Akoya E2228T (git-fixes).
• ACPICA: Add NHLT table signature (bsc#1176200).
• Add bug reference to two hv_netvsc patches (bsc#1178853).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: hda: fix jack detection with Realtek codecs when in D3 (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button (git-fixes).
• ALSA: hda/realtek - Add supported mute Led for HP (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC assignment on Asus Zephyrus G14 (git-fixes).
• ALSA: hda/realtek - Fixed Dell AIO wrong sound tone (git-fixes).
• ALSA: hda/realtek - HP Headset Mic can't detect after boot (git-fixes).
• ALSA: hda: Reinstate runtime_allow() for all hda controllers (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes).
• ALSA: usb-audio: Convert to the common vmalloc memalloc (bsc#1178203).
• ALSA: usb-audio: Correct wrongly matching entries with audio class (bsc#1178203).
• ALSA: usb-audio: Move device rename and profile quirks to an internal table (bsc#1178203).
• ALSA: usb-audio: Properly match with audio interface class (bsc#1178203).
• ALSA: usb-audio: Simplify quirk entries with a macro (bsc#1178203).
• ALSA: usb-audio: Support PCM sync_stop (bsc#1178203).
• ALSA: usb-audio: US16x08: fix value…

Elena Petrova discovered that the pin controller device tree implementation in the Linux kernel did not properly handle string references. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-0427)

Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. A physically proximate attacker could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). (CVE-2020-12352)

It was discovered that a race condition existed in the perf subsystem of the Linux kernel, leading to a use-after-free vulnerability. An attacker with access to the perf subsystem could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)

It was discovered that the frame buffer implementation in the Linux kernel did not properly handle some edge cases in software scrollback. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14390)

It was discovered that the netfilter connection tracker for netlink in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-25211)

It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform privilege checks for access to rbd devices in some situations. A local attacker could use this to map or unmap rbd block devices. (CVE-2020-25284)

It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25643)

It was discovered that the GENEVE tunnel implementation in the Linux kernel when combined with IPSec did not properly select IP routes in some situations. An attacker could use this to expose sensitive information (unencrypted network traffic). (CVE-2020-25645)

Keyu Man discovered that the ICMP global rate limiter in the Linux kernel could be used to assist in scanning open UDP ports. A remote attacker could use to facilitate attacks on UDP based services that depend on source port randomization. (CVE-2020-25705)

It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range checks in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28915)

It was discovered that Power 9 processors could be coerced to expose information from the L1 cache in certain situations. A local attacker could use this to expose sensitive information. (CVE-2020-4788)

It was discovered that a race condition existed in the binder IPC implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-0423)

Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. A physically proximate attacker could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

It was discovered that a race condition existed in the perf subsystem of the Linux kernel, leading to a use-after-free vulnerability. An attacker with access to the perf subsystem could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)

It was discovered that the frame buffer implementation in the Linux kernel did not properly handle some edge cases in software scrollback. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14390)

It was discovered that the netfilter connection tracker for netlink in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-25211)

It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform privilege checks for access to rbd devices in some situations. A local attacker could use this to map or unmap rbd block devices. (CVE-2020-25284)

It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25643)

It was discovered that the GENEVE tunnel implementation in the Linux kernel when combined with IPSec did not properly select IP routes in some situations. An attacker could use this to expose sensitive information (unencrypted network traffic). (CVE-2020-25645)

Keyu Man discovered that the ICMP global rate limiter in the Linux kernel could be used to assist in scanning open UDP ports. A remote attacker could use to facilitate attacks on UDP based services that depend on source port randomization. (CVE-2020-25705)

It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range checks in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28915)

It was discovered that Power 9 processors could be coerced to expose information from the L1 cache in certain situations. A local attacker could use this to expose sensitive information. (CVE-2020-4788)

It was discovered that debugfs in the Linux kernel as used by blktrace contained a use-after-free in some situations. A privileged local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-19770)

It was discovered that a race condition existed in the binder IPC implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-0423)

Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. A physically proximate attacker could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

It was discovered that the console keyboard driver in the Linux kernel contained a race condition. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-25656)

Minh Yuan discovered that the tty driver in the Linux kernel contained race conditions when handling fonts. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2020-25668)

Keyu Man discovered that the ICMP global rate limiter in the Linux kernel could be used to assist in scanning open UDP ports. A remote attacker could use to facilitate attacks on UDP based services that depend on source port randomization. (CVE-2020-25705)

Jinoh Kang discovered that the Xen event channel infrastructure in the Linux kernel contained a race condition. An attacker in guest could possibly use this to cause a denial of service (dom0 crash). (CVE-2020-27675)

Daniel Axtens discovered that PowerPC RTAS implementation in the Linux kernel did not properly restrict memory accesses in some situations. A privileged local attacker could use this to arbitrarily modify kernel memory, potentially bypassing kernel lockdown restrictions. (CVE-2020-27777)

Minh Yuan discovered that the framebuffer console driver in the Linux kernel did not properly handle fonts in some conditions. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2020-28974)