CVE-2020-29661

A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-14351)

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5.(CVE-2020-27675)

A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.(CVE-2020-25656)

Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access.(CVE-2020-12352)

A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.(CVE-2020-29661)

A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.(CVE-2020-27777)

A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24.(CVE-2020-29660)

An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-use a pointer after it was freed. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback.(CVE-2020-29569)

A flaw was found in the JFS filesystem code. This flaw allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2020-27815)

A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash.(CVE-2020-27830)

A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free (CVE-2020-29661)

• kernel: performance counters race condition use-after-free (CVE-2020-14351)

• kernel: ICMP rate limiting can be used for DNS poisoning attack (CVE-2020-25705)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Final fixes + drop alpha_support flag requirement for Tigerlake (BZ#1882620)

• OVS complains Invalid Argument on TCP packets going into conntrack (BZ#1892744)

• BUG: using smp_processor_id() in preemptible [00000000] code: handler106/3082 (BZ#1893281)

• Icelake performance - add intel_idle: Customize IceLake server support to AlmaLinux-8 (BZ#1897183)

• [mlx5] IPV6 TOS rewrite flows are not getting offloaded in HW (BZ#1897688)

• AlmaLinux 8.3 SAS - multipathd fails to re-establish paths during controller random reset (BZ#1900112)

• AlmaLinux8.3 Beta - AlmaLinux8.3 hangs on dbginfo.sh execution, crash dump generated (mm-) (BZ#1903019)

• Win10 guest automatic reboot after migration in Win10 and WSL2 on AMD hosts (BZ#1905084)

• block, dm: fix IO splitting for stacked devices (BZ#1905136)

• Failed to hotplug scsi-hd disks (BZ#1905214)

• PCI quirk needed to prevent GPU hang (BZ#1906516)

• AlmaLinux8.2 - various patches to stabilize the OPAL error log processing and the powernv dump processing (ESS) (BZ#1907301)

• pmtu not working with tunnels as bridge ports and br_netfilter loaded (BZ#1907576)

• [ThinkPad X13/T14/T14s AMD]: Kdump failed (BZ#1907775)

• NFSv4 client improperly handles interrupted slots (BZ#1908312)

• NFSv4.1 client ignores ERR_DELAY during LOCK recovery, could lead to data corruption (BZ#1908313)

• [Regression] AlmaLinux8.2 - [kernel 148.el8] cpu (sys) time regression in SAP HANA 2.0 benchmark benchInsertSubSelectPerformance (BZ#1908519)

• AlmaLinux8: kernel-rt: kernel BUG at kernel/sched/deadline.c:1462! (BZ#1908731)

• SEV VM hang at efi_mokvar_sysfs_init+0xa9/0x19d during boot (BZ#1909243)

• C6gn support requires "Ensure dirty bit is preserved across pte_wrprotect" patch (BZ#1909577)

• [Lenovo 8.3 & 8.4 Bug] [Regression] No response from keyboard and mouse when boot from tboot kernel (BZ#1911555)

• Kernel crash with krb5p (BZ#1912478)

• [AlmaLinux8] Need additional backports for FIPS 800-90A DRBG entropy seeding source (BZ#1912872)

• [Hyper-V][AlmaLinux-8] Request to included a commit that adds a timeout to vmbus_wait_for_unload (BZ#1913528)

• Host becomes unresponsive during stress-ng --cyclic test rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: (BZ#1913964)

• AlmaLinux8.4: Backport upstream RCU patches up to v5.6 (BZ#1915638)

• Missing mm backport to fix regression introduced by another mm backport (BZ#1915814)

• [Hyper-V][AlmaLinux-8]video: hyperv_fb: Fix the cache type when mapping the VRAM Edit (BZ#1917711)

• ionic 0000:39:00.0 ens2: IONIC_CMD_Q_INIT (40) failed: IONIC_RC_ERROR (-5) (BZ#1918372)

• [certification] mlx5_core depends on tls triggering TAINT_TECH_PREVIEW even if no ConnectX-6 card is present (BZ#1918743)

• kvm-almalinux8.3 [AMD] - system crash observed while powering on virtual machine with attached VF interfaces. (BZ#1919885)

Enhancement(s):

• [Mellanox 8.4 FEAT] mlx5: Add messages when VF-LAG fails to start (BZ#1892344)

In tiocspgrp of tty_jobctrl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

• CKSIX-277: CVE-2020-29661: tty: Fix ->pgrp locking in tiocspgrp()
• CKSIX-277: CVE-2020-25656: vt: keyboard, extend func_buf_lock to readers
• CKSIX-277: CVE-2020-25656: tty/vt: fix write/write race in ioctl(KDSKBSENT) handler
• CKSIX-277: CVE-2020-25656: vt: keyboard, simplify vt_kdgkbsent
• CKSIX-277: CVE-2020-25211: netfilter: ctnetlink: add a range check for l3/l4 protonum
• CKSIX-277: CKSIX-276: CVE-2019-19532: HID: Fix assumption that devices have inputs

• CKSIX-277: CVE-2020-29661: tty: Fix ->pgrp locking in tiocspgrp()
• CKSIX-277: CVE-2020-25656: vt: keyboard, extend func_buf_lock to readers
• CKSIX-277: CVE-2020-25656: tty/vt: fix write/write race in ioctl(KDSKBSENT) handler
• CKSIX-277: CVE-2020-25656: vt: keyboard, simplify vt_kdgkbsent
• CKSIX-277: CVE-2020-25211: netfilter: ctnetlink: add a range check for l3/l4 protonum
• CKSIX-277: CKSIX-276: CVE-2019-19532: HID: Fix assumption that devices have inputs

• ELS-138: netfilter: x_tables: add missing tables zeroing
• ELS-138: CVE-2021-33909: seq_file: disallow extremely large seq buffer allocation
• ELS-138: CVE-2021-22555: netfilter: x_tables: fix compat match/target pad out-of-bound write
• ELS-138: CVE-2020-29661: tty: Fix ->pgrp locking in tiocspgrp()
• ELS-138: CVE-2020-25656: vt: keyboard, extend func_buf_lock to readers
• ELS-138: CVE-2020-25656: tty/vt: fix write/write race in ioctl(KDSKBSENT) handler
• ELS-138: CVE-2020-25656: vt: keyboard, simplify vt_kdgkbsent
• ELS-138: CVE-2020-25211: netfilter: ctnetlink: add a range check for l3/l4 protonum
• ELS-138: CKSIX-276: CVE-2019-19532: HID: Fix assumption that devices have inputs
• ELS-138: CVE-2021-27365: scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE
• ELS-138: CVE-2021-27365: scsi: iscsi: Verify lengths on passthrough PDUs
• ELS-138: CVE-2021-27363: CVE-2021-27364: scsi: iscsi: Restrict sessions and handles to admin capabilities
• ELS-138: sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output
• ELS-138: USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
• ELS-138: CVE-2019-14615: drm/i915/gen9: Clear residual context state on context switch
• ELS-138: CVE-2020-8647, CVE-2020-8649: vgacon: Fix a UAF in vgacon_invert_region
• ELS-138: CVE-2020-14331: vgacon: Fix for missing check in scrollback handling
• ELS-138: CVE-2021-3347: futex: Handle faults correctly for PI futexes
• ELS-138: CVE-2021-3347: futex: Provide and use pi_state_update_owner()
• ELS-138: KEYS: allow reaching the keys quotas exactly
• ELS-138: KEYS: reaching the keys quotas correctly
• ELS-138: fix -ENOMEM result with invalid user space pointer in sendto() syscall
• ELS-138: CVE-2017-18344: posix-timer: Properly check sigevent->sigev_notify
• ELS-138: CVE-2018-6927: futex: Prevent overflow by strengthen input validation
• ELS-138: CVE-2017-6951: KEYS: Change the name of the dead type to ".dead" to prevent user access
• ELS-138: CVE-2017-15299: KEYS: don't let add_key() update an uninstantiated key
• ELS-138: fix CVE-2016-9604
• ELS-138: KEYS: add missing permission check for request_key() destination
• ELS-138: CVE-2017-10661: timerfd: Protect the might cancel mechanism proper
• ELS-138: fix CVE-2017-7472
• ELS-138: fix CVE-2017-15274

Jann Horn discovered that the tty subsystem of the Linux kernel did not use consistent locking in some situations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory).(CVE-2020-29660)

Jann Horn discovered a race condition in the tty subsystem of the Linux kernel in the locking for the TIOCSPGRP ioctl(), leading to a use-after- free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2020-29661)

De4dCr0w of 360 Alpha Lab discovered that the BPF verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker could use this to expose sensitive information (kernel memory) or possibly execute arbitrary code.(CVE-2021-3444)

kernel: use-after-free in route4_change() in net/sched/cls_route.c(CVE-2021-3715)

This update provides an upgrade to the new upstream 5.10 longterm branch, currently based on 5.10.6, adding new features and new and improved hardware support.

This update also fixes at least the following security issues:

In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation (CVE-2020-0423).

In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (CVE-2020-0465).

Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2020-8694).

A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access (CVE-2020-12912).

A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2020-14351).

A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality (CVE-2020-25656).

Linux kernel concurrency use-after-free in vt (CVE-2020-25668).

Linux Kernel use-after-free in sunkbd_reinit (CVE-2020-25669).

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service (CVE-2020-25704).

A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allows to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well (CVE-2020-25705).

An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering (CVE-2020-27152).

An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values (CVE-2020-27194).

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0 (CVE-2020-27673).

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device (CVE-2020-27675).

A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat…

This update provides an upgrade to the new upstream 5.10 longterm branch, currently based on 5.10.6, adding new features and new and improved hardware support.

This update also fixes at least the following security issues:

In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation (CVE-2020-0423).

In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (CVE-2020-0465).

Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2020-8694).

A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access (CVE-2020-12912).

A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2020-14351).

A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality (CVE-2020-25656).

Linux kernel concurrency use-after-free in vt (CVE-2020-25668).

Linux Kernel use-after-free in sunkbd_reinit (CVE-2020-25669).

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service (CVE-2020-25704).

A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allows to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well (CVE-2020-25705).

An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering (CVE-2020-27152).

An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values (CVE-2020-27194).

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0 (CVE-2020-27673).

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device (CVE-2020-27675).

A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat…

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-27835: A use after free in the Linux kernel infiniband hfi1 driver was found in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-28374: In drivers/target/target_core_xcopy.c insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore (bnc#1178372).
• CVE-2020-36158: mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c might have allowed remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332 (bnc#1180559).
• CVE-2020-27825: A use-after-free flaw was found in kernel/trace/ring_buffer.c. There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat (bnc#1179960).
• CVE-2020-0466: In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1180031).
• CVE-2020-27068: In the nl80211_policy policy of nl80211.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation (bnc#1180086).
• CVE-2020-0444: In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1180027).
• CVE-2020-0465: In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1180029).
• CVE-2020-29661: A locking issue was discovered in the tty subsystem of the Linux kernel drivers/tty/tty_jobctrl.c allowed a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b (bnc#1179745).
• CVE-2020-29660: A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may have allowed a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24 (bnc#1179745).
• CVE-2020-27777: A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel (bnc#1179107).
• CVE-2020-29373: An issue was discovered in fs/io_uring.c in the Linux kernel It unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations, aka CID-ff002b30181d (bnc#1179434).
• CVE-2020-11668: drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandled invalid descriptors, aka CID-a246b4d54770 (bnc#1168952).
• CVE-2020-27830: Fixed a NULL-ptr deref bug in spk_ttyio_receive_buf2 (bnc#1179656).
• CVE-2020-29370: An issue was discovered in…

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-29568: An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable (bnc#1179508).
• CVE-2020-29569: The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-use a pointer after it was freed. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback (bnc#1179509).
• CVE-2020-25639: Bail out of nouveau_channel_new if channel init fails (bsc#1176846).
• CVE-2020-28374: In drivers/target/target_core_xcopy.c insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore (bnc#1178372 1180676).
• CVE-2020-36158: mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332 (bnc#1180559).
• CVE-2020-27825: A use-after-free flaw was found in kernel/trace/ring_buffer.c. There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat (bnc#1179960).
• CVE-2020-0466: In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1180031).
• CVE-2020-27068: In the nl80211_policy policy of nl80211.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation (bnc#1180086).
• CVE-2020-0465: In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1180029).
• CVE-2020-0444: In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1180027).
• CVE-2020-29660: A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may have allowed a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24 (bnc#1179745).
• CVE-2020-29661: A locking issue was discovered in the tty subsystem of the Linux kernel drivers/tty/tty_jobctrl.c allowed a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b (bnc#1179745).
• CVE-2020-27777: A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure…

This update syncs the RT kernel from the SUSE Linux Enterprise 15-SP2 codestream.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the kernel-devel-5.14.6-1.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following non-security bug was fixed:

• Fixed a regression where KVM VM hangs caused by the fix CVE-2020-29660 and CVE-2020-29661 (bsc#1182505).

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).

The following non-security bugs were fixed:

• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ASoC: arizona: Fix a wrong free in wm8997_probe (git-fixes).
• ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams (git-fixes).
• ASoC: jz4740-i2s: add missed checks for clk_get() (git-fixes).
• ASoC: pcm: DRAIN support reactivation (git-fixes).
• ASoC: wm8998: Fix PM disable depth imbalance on error (git-fixes).
• ASoC: wm_adsp: remove 'ctl' from list on error in wm_adsp_create_control() (git-fixes).
• ath10k: Fix an error handling path (git-fixes).
• ath10k: Release some resources in an error handling path (git-fixes).
• ath10k: Remove msdu from idr when management pkt send fails (git-fixes).
• ath6kl: fix enum-conversion warning (git-fixes).
• Bluetooth: btusb: Fix detection of some fake CSR controllers with a bcdDevice val of 0x0134 (git-fixes).
• Bluetooth: Fix null pointer dereference in hci_event_packet() (git-fixes).
• Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() (git-fixes).
• btmrvl: Fix firmware filename for sd8997 chipset (bsc#1172694).
• btrfs: fix use-after-free on readahead extent after failure to create it (bsc#1179963).
• btrfs: remove a BUG_ON() from merge_reloc_roots() (bsc#1174784).
• bus: fsl-mc: fix error return code in fsl_mc_object_allocate() (git-fixes).
• can: mcp251x: add error check when wq alloc failed (git-fixes).
• can: softing: softing_netdev_open(): fix error handling (git-fixes).
• cirrus: cs89x0: remove set but not used variable 'lp' (git-fixes).
• cirrus: cs89x0: use devm_platform_ioremap_resource() to simplify code (git-fixes).
• cpufreq: highbank: Add missing MODULE_DEVICE_TABLE (git-fixes).
• cpufreq: loongson1: Add missing MODULE_ALIAS (git-fixes).
• cpufreq: scpi: Add missing MODULE_ALIAS (git-fixes).
• cpufreq: st: Add missing MODULE_DEVICE_TABLE (git-fixes).
• crypto: af_alg - avoid undefined behavior accessing salg_name (git-fixes).
• crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe (git-fixes).
• crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() (git-fixes).
• crypto: talitos - Fix return type of current_desc_hdr() (git-fixes).
• cw1200: fix missing destroy_workqueue() on error in cw1200_init_common (git-fixes).
• drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe (git-fixes).
• drm/amd/display: remove useless if/else (git-fixes).
• drm/amdgpu: fix build_coefficients() argument (git-fixes).
• drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() (git-fixes).
• drm/gma500: fix double free of gma_connector (git-fixes).
• drm/meson: dw-hdmi: Register a callback…

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).

The following non-security bugs were fixed:

• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 (git-fixes).
• ACPICA: Do not increment operation_region reference counts for field units (git-fixes).
• ALSA: ca0106: fix error code handling (git-fixes).
• ALSA: ctl: allow TLV read operation for callback type of element in locked case (git-fixes).
• ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always check pin power status in i915 pin fixup (git-fixes).
• ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 (git-fixes).
• ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table (git-fixes).
• ALSA: hda: Fix potential race in unsol event handler (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: info: Drop WARN_ON() from buffer NULL sanity check (git-fixes).
• ALSA: isa/wavefront: prevent out of bounds write in ioctl (git-fixes).
• ALSA: line6: Perform sanity check for each URB creation (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check (git-fixes).
• ALSA: timer: Limit max amount of slave instances (git-fixes).
• ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes).
• ALSA: usb-audio: Add delay quirk for H570e USB headsets (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for MODX (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for Qu-16 (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2 (git-fixes).
• ALSA: usb-audio: add quirk for Denon DCD-1500RE (git-fixes).
• ALSA: usb-audio: add quirk for Samsung USBC Headset (AKG) (git-fixes).
• ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Alpha S (git-fixes).
• ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Flight S (git-fixes).
• ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices (git-fixes).
• ALSA: usb-audio: Disable sample read check if firmware does not give back (git-fixes).
• ALSA: usb-audio: Fix control 'access overflow' errors from chmap (git-fixes).…

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-27830: Fixed a null pointer dereference in speakup (bsc#1179656).
• CVE-2020-29370: Fixed a race condition in kmem_cache_alloc_bulk (bnc#1179435).
• CVE-2020-29373: Fixed an unsafe handling of the root directory during path lookups in fs/io_uring.c (bnc#1179434).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).

The following non-security bugs were fixed:

• ACPI: APEI: Kick the memory_failure() queue for synchronous errors (jsc#SLE-16610).
• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G (git-fixes).
• ALSA: core: memalloc: add page alignment for iram (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always print pin NIDs as hexadecimal (git-fixes).
• ALSA: hda/hdmi: packet buffer index must be set before reading value (git-fixes).
• ALSA: hda/proc - print DP-MST connections (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 (git-fixes).
• ALSA: hda/realtek - Fixed Dell AIO wrong sound tone (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek: Add quirk for MSI-GP73 (git-fixes).
• ALSA: hda/realtek: Apply jack fixup for Quanta NL3 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC assignment on Asus Zephyrus G14 (git-fixes).
• ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: rawmidi: Access runtime->avail always in spinlock (git-fixes).
• ALSA: seq: remove useless function (git-fixes).
• ALSA: usb-audio: Add generic implicit fb parsing (bsc#1178203).
• ALSA: usb-audio: Add hw constraint for implicit fb sync (bsc#1178203).
• ALSA: usb-audio: Add implicit fb support for Steinberg UR22 (git-fixes).
• ALSA: usb-audio: Add implicit_fb module option (bsc#1178203).
• ALSA: usb-audio: Add quirk for Pioneer DJ DDJ-SR2 (git-fixes).
• ALSA: usb-audio: Add snd_usb_get_endpoint() helper (bsc#1178203).
• ALSA: usb-audio: Add snd_usb_get_host_interface() helper (bsc#1178203).
• ALSA: usb-audio: Add support for Pioneer DJ DDJ-RR controller (git-fixes).
• ALSA: usb-audio:…

The SUSE Linux Enterprise 15 SP1 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed, aka CID-16d51a590a8c (bsc#1179663).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-11668: Fixed an out of bounds write to the heap in drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) caused by mishandling invalid descriptors (bsc#1168952).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).

The following non-security bugs were fixed:

• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 (git-fixes).
• ACPICA: Do not increment operation_region reference counts for field units (git-fixes).
• ALSA: ca0106: fix error code handling (git-fixes).
• ALSA: ctl: allow TLV read operation for callback type of element in locked case (git-fixes).
• ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always check pin power status in i915 pin fixup (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table (git-fixes).
• ALSA: hda: Fix potential race in unsol event handler (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: info: Drop WARN_ON() from buffer NULL sanity check (git-fixes).
• ALSA: isa/wavefront: prevent out of bounds write in ioctl (git-fixes).
• ALSA: line6: Perform sanity check for each URB creation (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20669: Fixed an improper check i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c (bsc#1122971).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed, aka CID-16d51a590a8c (bsc#1179663).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).

The following non-security bugs were fixed:

• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: usb-audio: US16x08: fix value count for level meters (git-fixes).
• ASoC: arizona: Fix a wrong free in wm8997_probe (git-fixes).
• ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams (git-fixes).
• ASoC: jz4740-i2s: add missed checks for clk_get() (git-fixes).
• ASoC: pcm: DRAIN support reactivation (git-fixes).
• ASoC: wm8998: Fix PM disable depth imbalance on error (git-fixes).
• ASoC: wm_adsp: remove 'ctl' from list on error in wm_adsp_create_control() (git-fixes).
• ath10k: Fix an error handling path (git-fixes).
• ath10k: Release some resources in an error handling path (git-fixes).
• ath10k: Remove msdu from idr when management pkt send fails (git-fixes).
• ath6kl: fix enum-conversion warning (git-fixes).
• Avoid a GCC warning about '/*' within a comment.
• Bluetooth: btusb: Fix detection of some fake CSR controllers with a bcdDevice val of 0x0134 (git-fixes).
• Bluetooth: Fix null pointer dereference in hci_event_packet() (git-fixes).
• Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() (git-fixes).
• bnxt_en: Fix race when modifying pause settings (bsc#1050242 ).
• bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex (bsc#1050242).
• btmrvl: Fix firmware filename for sd8997 chipset (bsc#1172694).
• btrfs: fix use-after-free on readahead extent after failure to create it (bsc#1179963).
• btrfs: qgroup: do not commit transaction…

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-29373: Fixed an unsafe handling of the root directory during path lookups in fs/io_uring.c (bnc#1179434).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-27830: Fixed a null pointer dereference in speakup (bsc#1179656).
• CVE-2020-29370: Fixed a race condition in kmem_cache_alloc_bulk (bnc#1179435).

The following non-security bugs were fixed:

• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• add reference to CVE and its bsc
• ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G (git-fixes).
• ALSA: core: memalloc: add page alignment for iram (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/hdmi: always print pin NIDs as hexadecimal (git-fixes).
• ALSA: hda/hdmi: packet buffer index must be set before reading value (git-fixes).
• ALSA: hda/proc - print DP-MST connections (git-fixes).
• ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 (git-fixes).
• ALSA: hda/realtek: Add quirk for MSI-GP73 (git-fixes).
• ALSA: hda/realtek: Apply jack fixup for Quanta NL3 (git-fixes).
• ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: rawmidi: Access runtime->avail always in spinlock (git-fixes).
• ALSA: seq: remove useless function (git-fixes).
• ALSA: usb-audio: Add generic implicit fb parsing (bsc#1178203).
• ALSA: usb-audio: Add hw constraint for implicit fb sync (bsc#1178203).
• ALSA: usb-audio: Add implicit fb support for Steinberg UR22 (git-fixes).
• ALSA: usb-audio: Add implicit_fb module option (bsc#1178203).
• ALSA: usb-audio: Add quirk for Pioneer DJ DDJ-SR2 (git-fixes).
• ALSA: usb-audio: Add snd_usb_get_endpoint() helper (bsc#1178203).
• ALSA: usb-audio: Add snd_usb_get_host_interface() helper (bsc#1178203).
• ALSA: usb-audio: Add support for Pioneer DJ DDJ-RR controller (git-fixes).
• ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices (git-fixes).
• ALSA: usb-audio: Always set up the parameters after resume (bsc#1178203).
• ALSA: usb-audio: Avoid doubly initialization for implicit fb (bsc#1178203).
• ALSA: usb-audio: Check implicit feedback EP generically for UAC2 (bsc#1178203).
• ALSA: usb-audio: Check…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-29373: Fixed an unsafe handling of the root directory during path lookups in fs/io_uring.c (bnc#1179434).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-27830: Fixed a null pointer dereference in speakup (bsc#1179656).
• CVE-2020-29370: Fixed a race condition in kmem_cache_alloc_bulk (bnc#1179435).
• CVE-2020-27786: Fixed a use after free in kernel midi subsystem snd_rawmidi_kernel_read1() (bsc#1179601).

The following non-security bugs were fixed:

• ACPI: APEI: Kick the memory_failure() queue for synchronous errors (jsc#SLE-16610).
• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G (git-fixes).
• ALSA: core: memalloc: add page alignment for iram (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always print pin NIDs as hexadecimal (git-fixes).
• ALSA: hda/hdmi: packet buffer index must be set before reading value (git-fixes).
• ALSA: hda/proc - print DP-MST connections (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 (git-fixes).
• ALSA: hda/realtek - Fixed Dell AIO wrong sound tone (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek: Add quirk for MSI-GP73 (git-fixes).
• ALSA: hda/realtek: Apply jack fixup for Quanta NL3 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC assignment on Asus Zephyrus G14 (git-fixes).
• ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: rawmidi: Access runtime->avail always in spinlock (git-fixes).
• ALSA: seq: remove useless function (git-fixes).
• ALSA: usb-audio: Add generic implicit fb parsing (bsc#1178203).
• ALSA: usb-audio: Add hw constraint for implicit fb sync (bsc#1178203).
• ALSA: usb-audio: Add implicit fb support for Steinberg UR22 (git-fixes).
• ALSA:…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed, aka CID-16d51a590a8c (bsc#1179663).
• CVE-2020-27786: Fixed a use after free in kernel midi subsystem snd_rawmidi_kernel_read1() (bsc#1179601).

The following non-security bugs were fixed:

• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 (git-fixes).
• ACPICA: Do not increment operation_region reference counts for field units (git-fixes).
• ALSA: ca0106: fix error code handling (git-fixes).
• ALSA: ctl: allow TLV read operation for callback type of element in locked case (git-fixes).
• ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always check pin power status in i915 pin fixup (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table (git-fixes).
• ALSA: hda: Fix potential race in unsol event handler (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: info: Drop WARN_ON() from buffer NULL sanity check (git-fixes).
• ALSA: isa/wavefront: prevent out of bounds write in ioctl (git-fixes).
• ALSA: line6: Perform sanity check for each URB creation (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check (git-fixes).
• ALSA: timer: Limit max amount of slave instances (git-fixes).
• ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes).
• ALSA: usb-audio: Add delay quirk for H570e USB headsets (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for MODX (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for Qu-16 (git-fixes).…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-28374: Fixed a LIO security issue (bsc#1178372).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed, aka CID-16d51a590a8c (bsc#1179663).
• CVE-2020-27786: Fixed a use after free in kernel midi subsystem snd_rawmidi_kernel_read1() (bsc#1179601).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2018-20669: Fixed an improper check i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c (bsc#1122971).

The following non-security bugs were fixed:

• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 (git-fixes).
• ACPICA: Do not increment operation_region reference counts for field units (git-fixes).
• ALSA: ca0106: fix error code handling (git-fixes).
• ALSA: ctl: allow TLV read operation for callback type of element in locked case (git-fixes).
• ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always check pin power status in i915 pin fixup (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table (git-fixes).
• ALSA: hda: Fix potential race in unsol event handler (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: info: Drop WARN_ON() from buffer NULL sanity check (git-fixes).
• ALSA: isa/wavefront: prevent out of bounds write in ioctl (git-fixes).
• ALSA: line6: Perform sanity check for each URB creation (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check (git-fixes).
• ALSA: timer: Limit max…

This update for the Linux Kernel 5.3.18-24_24 fixes several issues.

The following security issues were fixed:

• CVE-2020-29373: Fixed an issue where kernel unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations (bsc#1179779).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180562).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180032.
• CVE-2020-29569: Fixed a use after free due to a logic error (bsc#1180008).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bsc#1179877).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179877).
• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could grant unintended write access because of a race condition in a THP mapcount check (bsc#1179664).

This update for the Linux Kernel 5.3.18-22 fixes several issues.

The following security issues were fixed:

• CVE-2020-29373: Fixed an issue where kernel unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations (bsc#1179779).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180562).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180030).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180032.
• CVE-2020-29569: Fixed a use after free due to a logic error (bsc#1180008).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bsc#1179877).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179877).
• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could grant unintended write access because of a race condition in a THP mapcount check (bsc#1179664).