CVE-2019-9213

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.

This kernel update is based on the upstream 4.14.106 and fixes at least the following security issue:

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (CVE-2019-9213).

It also adds a preparatory fix for Skylake systems that will receive a microcode update at a later date to address a TSX errata.

WireGuard has been updated to 0.0.20190227.

For other uptstream fixes in this update, see the referenced changelogs.

This kernel update provides the upstream 4.14.119 that adds the kernel side mitigations for the Microarchitectural Data Sampling (MDS, also called ZombieLoad attack) vulnerabilities in Intel processors that can allow attackers to retrieve data being processed inside a CPU. To complete the mitigations new microcode is also needed, either by installing the microcode-0.20190514-1.mga6 package, or get an updated bios / uefi firmware from the motherboard vendor.

The fixed / mitigated issues are:

Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

Microprocessors use a ‘load port’ subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPU’s pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. (CVE-2018-12127)

A flaw was found in the implementation of the "fill buffer", a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer. (CVE-2018-12130)

Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091)

It also fixes at least the following security issues:

Cross-hyperthread Spectre v2 mitigation is now provided by the Single Thread Indirect Branch Predictors (STIBP) support. Note that STIBP also requires the functionality be supported by the Intel microcode in use.

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service (CVE-2018-1128).

A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol (CVE-2018-1129).

A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients (CVE-2018-14625).

A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one (CVE-2018-16862).

A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization…

This kernel update provides the upstream 4.14.119 that adds the kernel side mitigations for the Microarchitectural Data Sampling (MDS, also called ZombieLoad attack) vulnerabilities in Intel processors that can allow attackers to retrieve data being processed inside a CPU. To complete the mitigations new microcode is also needed, either by installing the microcode-0.20190514-1.mga6 package, or get an updated bios / uefi firmware from the motherboard vendor.

The fixed / mitigated issues are:

Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

Microprocessors use a ‘load port’ subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPU’s pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. (CVE-2018-12127)

A flaw was found in the implementation of the "fill buffer", a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer. (CVE-2018-12130)

Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091)

It also fixes at least the following security issues:

Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM (CVE-2018-1000026)

A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS) (CVE-2019-3882).

kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (CVE-2019-7308).

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (CVE-2019-9213).

The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions (CVE-2019-11486).

The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags…

The openSUSE Leap 15.0 was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).
• CVE-2019-3819: A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable (bnc#1123161).
• CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).
• CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).
• CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).
• CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

The following non-security bugs were fixed:

• 9p/net: fix memory leak in p9_client_create (bsc#1051510).
• 9p: use inode->i_lock to protect i_size_write() under 32-bit (bsc#1051510).
• acpi: acpi_pad: Do not launch acpi_pad threads on idle cpus (bsc#1113399).
• acpi/APEI: Clear GHES block_status before panic() (bsc#1051510).
• acpi/device_sysfs: Avoid OF modalias creation for removed device (bsc#1051510).
• acpi/nfit: Fix bus command validation (bsc#1051510).
• acpi: NUMA: Use correct type for printing addresses on i386-PAE (bsc#1051510).
• acpi / video: Extend chassis-type detection with a 'Lunch Box' check (bsc#1051510).
• acpi / video: Refactor and fix dmi_is_desktop() (bsc#1051510).
• alsa: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56 (bsc#1051510).
• alsa: compress: prevent potential divide by zero bugs (bsc#1051510).
• alsa: echoaudio: add a check for ioremap_nocache (bsc#1051510).
• alsa: firewire: add const qualifier to identifiers for read-only symbols (bsc#1051510).
• alsa: firewire-motu: add a flag for AES/EBU on XLR interface (bsc#1051510).
• alsa: firewire-motu: add specification flag for position of flag for MIDI messages (bsc#1051510).
• alsa: firewire-motu: add support for MOTU Audio Express (bsc#1051510).
• alsa: firewire-motu: add support for Motu Traveler (bsc#1051510).
• alsa: firewire-motu: fix construction of PCM frame for capture direction (bsc#1051510).
• alsa: firewire-motu: use 'version' field of unit directory to identify model (bsc#1051510).
• alsa: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist (bsc#1051510).
• alsa: hda - Add quirk for HP EliteBook 840 G5 (bsc#1051510).
• alsa: hda - Enforces runtime_resume after S3 and S4 for each codec (bsc#1051510).
• alsa: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic (bsc#1051510).
• alsa: hda/realtek: Disable PC beep in passthrough on alc285 (bsc#1051510).
• alsa: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256 (bsc#1051510).
• alsa: hda/realtek: Enable audio jacks of ASUS UX362FA with ALC294 (bsc#1051510).
• alsa: hda/realtek: Enable headset MIC of Acer AIO with ALC286 (bsc#1051510).
• alsa: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with ALC286 (bsc#1051510).
• alsa: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256 (bsc#1051510).
• alsa: hda/realtek - Headset microphone and internal speaker support for System76 oryp5 (bsc#1051510).
• alsa: hda/realtek - Headset microphone support…

This update for the Linux Kernel 3.12.61-52_128 fixes several issues.

The following security issues were fixed:

• CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
• CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124734).
• CVE-2018-5391: The Linux kernel was vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker might have caused a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size (bsc#1103098).

This update for the Linux Kernel 3.12.74-60_64_107 fixes several issues.

The following security issues were fixed:

• CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
• CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124734).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bsc#1124729).
• CVE-2018-5391: The Linux kernel was vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker might have caused a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size (bsc#1103098).

This update for the Linux Kernel 4.4.121-92_80 fixes several issues.

The following security issues were fixed:

• CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
• CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124734).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bsc#1124729).

This update for the Linux Kernel 4.4.121-92_92 fixes several issues.

The following security issues were fixed:

• CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
• CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124734).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bsc#1124729).

This update for the Linux Kernel 4.4.121-92_95 fixes several issues.

The following security issues were fixed:

• CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
• CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124734).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bsc#1124729).

This update for the Linux Kernel 4.12.14-95_6 fixes several issues.

The following security issues were fixed:

• CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
• CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which could have led to a use-after-free in sockfs_setattr (bsc#1126284).
• CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124734).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bsc#1124729).

This update for the Linux Kernel 4.12.14-25_3 fixes several issues.

The following security issues were fixed:

• CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
• CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which could have led to a use-after-free in sockfs_setattr (bsc#1126284).
• CVE-2018-12232: In net/socket.c there was a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat did not increment the file descriptor reference count, which allowed close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash (bsc#1127757).
• CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124734).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bsc#1124729).

This update for the Linux Kernel 4.12.14-25_6 fixes several issues.

The following security issues were fixed:

• CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
• CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which could have led to a use-after-free in sockfs_setattr (bsc#1126284).
• CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124734).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bsc#1124729).

This update for the Linux Kernel 4.4.156-94_61 fixes several issues.

The following security issues were fixed:

• CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
• CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124734).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bsc#1124729).

This update for the Linux Kernel 4.4.175-94_79 fixes one issue.

The following security issue was fixed:

• CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks. (bnc#1122971).
• CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).
• CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728 ).
• CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).
• CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).
• CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).
• CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).
• CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).
• CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).
• CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

The following non-security bugs were fixed:

• 6lowpan: iphc: reset mac_header after decompress to fix panic (bsc#1051510).
• 9p: clear dangling pointers in p9stat_free (bsc#1051510).
• 9p locks: fix glock.client_id leak in do_lock (bsc#1051510).
• 9p/net: fix memory leak in p9_client_create (bsc#1051510).
• 9p/net: put a lower bound on msize (bsc#1051510).
• 9p: use inode->i_lock to protect i_size_write() under 32-bit (bsc#1051510).
• acpi/APEI: Clear GHES block_status before panic() (bsc#1051510).
• acpi/device_sysfs: Avoid OF modalias creation for removed device (bsc#1051510).
• acpi/nfit: Block function zero DSMs (bsc#1051510).
• acpi, nfit: Fix Address Range Scrub completion tracking (bsc#1124969).
• acpi/nfit: Fix bus command validation (bsc#1051510).
• acpi/nfit: Fix command-supported detection (bsc#1051510).
• acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() (bsc#1122662).
• acpi/nfit: Fix user-initiated ARS to be 'ARS-long' rather than 'ARS-short' (bsc#1124969).
• acpi: NUMA: Use correct type for printing addresses on i386-PAE (bsc#1051510).
• acpi: power: Skip duplicate power resource references in _PRx (bsc#1051510).
• acpi / video: Extend chassis-type detection with a 'Lunch Box' check (bsc#1051510).
• acpi / video: Refactor and fix dmi_is_desktop() (bsc#1051510).
• add 1 entry 2bcbd406715dca256912b9c5ae449c7968f15705
• Add delay-init quirk for Corsair K70 RGB keyboards (bsc#1087092).
• af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers (bsc#1051510).
• alsa: bebob: fix model-id of unit for Apogee Ensemble (bsc#1051510).
• alsa: bebob:…

The SUSE Linux Enterprise Server 12 SP4 Azure kernel was updated to fix various issues.

The following security bugs were fixed:

• CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).
• CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166 1128378 1129016).
• CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).
• CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).
• CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which led to a use-after-free in sockfs_setattr (bnc#1125907 1126284).
• CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).
• CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).
• CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).
• CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).
• CVE-2018-20669: An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c where a local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation (bnc#1122971).

The following non-security bugs were fixed:

• 6lowpan: iphc: reset mac_header after decompress to fix panic (bsc#1051510).
• 9p: clear dangling pointers in p9stat_free (bsc#1051510).
• 9p locks: fix glock.client_id leak in do_lock (bsc#1051510).
• 9p/net: fix memory leak in p9_client_create (bsc#1051510).
• 9p/net: put a lower bound on msize (bsc#1051510).
• 9p: use inode->i_lock to protect i_size_write() under 32-bit (bsc#1051510).
• acpi/APEI: Clear GHES block_status before panic() (bsc#1051510).
• acpi / device_sysfs: Avoid OF modalias creation for removed device (bsc#1051510).
• acpi/nfit: Block function zero DSMs (bsc#1051510).
• acpi, nfit: Fix Address Range Scrub completion tracking (bsc#1124969).
• acpi/nfit: Fix bus command validation (bsc#1051510).
• acpi/nfit: Fix command-supported detection (bsc#1051510).
• acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() (bsc#1122662).
• acpi/nfit: Fix user-initiated ARS to be 'ARS-long' rather than 'ARS-short' (bsc#1124969).
• acpi: NUMA: Use correct type for printing addresses on i386-PAE (bsc#1051510).
• acpi: power: Skip duplicate power resource references in _PRx (bsc#1051510).
• acpi / video: Extend chassis-type detection with a 'Lunch Box' check (bsc#1051510).
• acpi / video: Refactor and fix dmi_is_desktop() (bsc#1051510).
• add 1 entry 2bcbd406715dca256912b9c5ae449c7968f15705
• Add delay-init quirk for Corsair K70 RGB keyboards…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).
• CVE-2019-9213: expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).
• CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).
• CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable (bnc#1123161).
• CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).
• CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).
• CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).
• CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).
• CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).
• CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks. (bnc#1122971).

The following non-security bugs were fixed:

• 6lowpan: iphc: reset mac_header after decompress to fix panic (bsc#1051510).
• 9p: clear dangling pointers in p9stat_free (bsc#1051510).
• 9p locks: fix glock.client_id leak in do_lock (bsc#1051510).
• 9p/net: fix memory leak in p9_client_create (bsc#1051510).
• 9p/net: put a lower bound on msize (bsc#1051510).
• 9p: use inode->i_lock to protect i_size_write() under 32-bit (bsc#1051510).
• ACPI/APEI: Clear GHES block_status before panic() (bsc#1051510).
• acpi / device_sysfs: Avoid OF modalias creation for removed device (bsc#1051510).
• acpi/nfit: Block function zero DSMs (bsc#1051510).
• acpi, nfit: Fix Address Range Scrub completion tracking (bsc#1124969).
• acpi/nfit: Fix bus command validation (bsc#1051510).
• acpi/nfit: Fix command-supported detection (bsc#1051510).
• acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() (bsc#1122662).
• acpi/nfit: Fix user-initiated ARS to be 'ARS-long' rather than 'ARS-short' (bsc#1124969).
• acpi: NUMA: Use correct type for printing addresses on i386-PAE (bsc#1051510).
• acpi: power: Skip duplicate power resource references in _PRx (bsc#1051510).
• acpi / video: Extend chassis-type detection with a 'Lunch Box' check (bsc#1051510).
• acpi / video: Refactor and fix dmi_is_desktop() (bsc#1051510).
• add 1 entry 2bcbd406715dca256912b9c5ae449c7968f15705
• Add delay-init quirk for Corsair K70 RGB keyboards (bsc#1087092).
• add mainline tags for two hyperv iommu patches
• Adjust a commit id in a nvme patch to make our scripts happy
• af_iucv: Move sockaddr length checks to…

The SUSE Linux Enterprise 15 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).
• CVE-2019-9213: expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).
• CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).
• CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).
• CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).
• CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).
• CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).
• CVE-2019-7221: The KVM implementation had a Use-after-Free problem (bnc#1124732).
• CVE-2019-7222: The KVM implementation had an Information Leak (bnc#1124735).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).
• CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks. (bnc#1122971).

The following non-security bugs were fixed:

• 6lowpan: iphc: reset mac_header after decompress to fix panic (bsc#1051510).
• 9p: clear dangling pointers in p9stat_free (bsc#1051510).
• 9p locks: fix glock.client_id leak in do_lock (bsc#1051510).
• 9p/net: fix memory leak in p9_client_create (bsc#1051510).
• 9p/net: put a lower bound on msize (bsc#1051510).
• 9p: use inode->i_lock to protect i_size_write() under 32-bit (bsc#1051510).
• acpi/APEI: Clear GHES block_status before panic() (bsc#1051510).
• acpi/device_sysfs: Avoid OF modalias creation for removed device (bsc#1051510).
• acpi/nfit: Block function zero DSMs (bsc#1051510).
• acpi/nfit: Fix Address Range Scrub completion tracking (bsc#1124969).
• acpi/nfit: Fix bus command validation (bsc#1051510).
• acpi/nfit: Fix command-supported detection (bsc#1051510).
• acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() (bsc#1122662).
• acpi/nfit: Fix user-initiated ARS to be 'ARS-long' rather than 'ARS-short' (bsc#1124969).
• acpi/numa: Use correct type for printing addresses on i386-PAE (bsc#1051510).
• acpi/power: Skip duplicate power resource references in _PRx (bsc#1051510).
• acpi/video: Extend chassis-type detection with a 'Lunch Box' check (bsc#1051510).
• acpi/video: Refactor and fix dmi_is_desktop() (bsc#1051510).
• add 1 entry 2bcbd406715dca256912b9c5ae449c7968f15705
• Add delay-init quirk for Corsair K70 RGB keyboards (bsc#1087092).
• af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers (bsc#1051510).
• alsa: bebob: fix model-id of unit for Apogee Ensemble (bsc#1051510).
• alsa: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56 (bsc#1051510).
• alsa: compress: Fix stop handling on compressed capture streams (bsc#1051510).
• alsa: compress: prevent potential divide by zero bugs (bsc#1051510).
• alsa: firewire-motu: fix…

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.176 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).
• CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

The following non-security bugs were fixed:

• ax25: fix possible use-after-free (bnc#1012382).
• block_dev: fix crash on chained bios with O_DIRECT (bsc#1090435).
• block: do not use bio->bi_vcnt to figure out segment number (bsc#1128893).
• bnxt_re: Fix couple of memory leaks that could lead to IOMMU call traces (bsc#1020413).
• bpf: fix replace_map_fd_with_map_ptr's ldimm64 second imm field (bsc#1012382).
• btrfs: ensure that a DUP or RAID1 block group has exactly two stripes (bsc#1128452).
• ceph: avoid repeatedly adding inode to mdsc->snap_flush_list (bsc#1126773).
• ch: add missing mutex_lock()/mutex_unlock() in ch_release() (bsc#1124235).
• ch: fixup refcounting imbalance for SCSI devices (bsc#1124235).
• copy_mount_string: Limit string length to PATH_MAX (bsc#1082943).
• device property: Fix the length used in PROPERTY_ENTRY_STRING() (bsc#1129770).
• drivers: hv: vmbus: Check for ring when getting debug info (bsc#1126389).
• drm: Fix error handling in drm_legacy_addctx (bsc#1106929)
• drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON (bsc#1106929)
• drm/nouveau/pmu: do not print reply values if exec is false (bsc#1106929)
• drm/radeon/evergreen_cs: fix missing break in switch statement (bsc#1106929)
• drm/vmwgfx: Do not double-free the mode stored in par->set_mode (bsc#1103429)
• enic: add wq clean up budget (bsc#1075697, bsc#1120691. bsc#1102959).
• enic: do not overwrite error code (bnc#1012382).
• fbdev: chipsfb: remove set but not used variable 'size' (bsc#1106929)
• ibmvnic: Report actual backing device speed and duplex values (bsc#1129923).
• ibmvscsi: Fix empty event pool access during host removal (bsc#1119019).
• input: mms114 - fix license module information (bsc#1087092).
• iommu/dmar: Fix buffer overflow during PCI bus notification (bsc#1129237).
• iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables (bsc#1129238).
• iommu/vt-d: Check identity map for hot-added devices (bsc#1129239).
• iommu/vt-d: Fix NULL pointer reference in intel_svm_bind_mm() (bsc#1129240).
• ixgbe: fix crash in build_skb Rx code path (git-fixes).
• kabi: protect struct inet_peer (kabi).
• kallsyms: Handle too long symbols in kallsyms.c (bsc#1126805).
• KMPs: obsolete older KMPs of the same flavour (bsc#1127155, bsc#1109137).
• kvm: arm/arm64: vgic-its: Check CBASER/BASER validity before enabling the ITS (bsc#1109248).
• kvm: arm/arm64: vgic-its: Check GITS_BASER Valid bit before saving tables (bsc#1109248).
• kvm: arm/arm64: vgic-its: Fix return value for device table restore (bsc#1109248).
• kvm: arm/arm64: vgic-its: Fix vgic_its_restore_collection_table returned value (bsc#1109248).
• kvm: nVMX: Do not halt vcpu when L1 is injecting events to L2 (bsc#1129413).
• kvm: nVMX: Free the VMREAD/VMWRITE bitmaps if alloc_kvm_area() fails (bsc#1129414).
• kvm: nVMX: NMI-window and interrupt-window exiting should wake L2 from HLT (bsc#1129415).
• kvm: nVMX: Set VM instruction error for VMPTRLD of unbacked page (bsc#1129416).
• kvm: VMX: Do not allow reexecute_instruction() when skipping MMIO instr (bsc#1129417).
• kvm: vmx: Set IA32_TSC_AUX for legacy mode guests (bsc#1129418).
• kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs (bsc#1127082).
• kvm: x86: IA32_ARCH_CAPABILITIES is always supported (bsc#1129419).
• libceph: handle an empty authorize reply (bsc#1126772).
• mdio_bus: Fix use-after-free on device_register fails (git-fixes).
• mfd: as3722: Handle interrupts on suspend…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).
• CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).
• CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. (bnc#1107829).
• CVE-2019-7221: The KVM implementation in the Linux kernel had a Use-after-Free (bnc#1124732).
• CVE-2019-7222: The KVM implementation in the Linux kernel had an Information Leak (bnc#1124735).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, which led to a use-after-free (bnc#1124728).

The following non-security bugs were fixed:

• copy_mount_string: Limit string length to PATH_MAX (bsc#1082943).
• enic: add wq clean up budget (bsc#1075697, bsc#1120691. bsc#1102959).
• ibmvscsi: Fix empty event pool access during host removal (bsc#1119019).
• ipv4: ipv6: Adjust the frag mem limit after truesize has been changed (bsc#1110286).
• kmps: obsolete older KMPs of the same flavour (bsc#1127155, bsc#1109137).
• netfilter: ipv6: Adjust the frag mem limit after truesize has been changed (bsc#1110286).
• perf/x86: Add sysfs entry to freeze counters on SMI (bsc#1121805).
• perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu() (bsc#1121805).
• perf/x86/intel: Do not enable freeze-on-smi for PerfMon V1 (bsc#1121805).
• perf/x86/intel: Fix memory corruption (bsc#1121805).
• perf/x86/intel: Generalize dynamic constraint creation (bsc#1121805).
• perf/x86/intel: Implement support for TSX Force Abort (bsc#1121805).
• perf/x86/intel: Make cpuc allocations consistent (bsc#1121805).
• pseries/energy: Use OF accessor function to read ibm,drc-indexes (bsc#1129080).
• restore cond_resched() in shrink_dcache_parent() (bsc#1098599, bsc#1105402, bsc#1127758).
• rps: flow_dissector: Fix uninitialized flow_keys used in __skb_get_hash possibly (bsc#1108145).
• scsi: megaraid_sas: Send SYNCHRONIZE_CACHE for VD to firmware (bsc#1121698).
• scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir() (bsc#1125315).
• x86: Add TSX Force Abort CPUID/MSR (bsc#1121805).
• x86: respect memory size limiting via mem= parameter (bsc#1117645).
• x86/spectre_v2: Do not check microcode versions when running under hypervisors (bsc#1122821).
• x86/xen: dont add memory above max allowed allocation (bsc#1117645).
• xen-netfront: Fix hang on device removal (bnc#1012382).
• xfrm: use complete IPv6 addresses for hash (bsc#1109330).
• xfs: remove filestream item xfs_inode reference (bsc#1127961).

This update for the Linux Kernel 4.12.14-25_28 fixes several issues.

The following security issues were fixed:

• CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
• CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which could have led to a use-after-free in sockfs_setattr (bsc#1126284).
• CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124734).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bsc#1124729).

The SUSE Linux Enterprise 12 SP3 Azure kernel was updated to 4.4.176 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).
• CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free. (bnc#1124728)
• CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).
• CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).
• CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).
• CVE-2017-18249: The add_free_nid function in fs/f2fs/node.c did not properly track an allocated nid, which allowed local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads (bnc#1087036).

The following non-security bugs were fixed:

• acpi/nfit: Block function zero DSMs (bsc#1123321).
• acpi, nfit: Fix ARS overflow continuation (bsc#1125000).
• acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value (bsc#1124775).
• acpi/nfit: Fix command-supported detection (bsc#1123323).
• acpi: power: Skip duplicate power resource references in _PRx (bnc#1012382).
• acpi / processor: Fix the return value of acpi_processor_ids_walk() (git fixes (acpi)).
• alpha: Fix Eiger NR_IRQS to 128 (bnc#1012382).
• alpha: fix page fault handling for r16-r18 targets (bnc#1012382).
• alsa: bebob: fix model-id of unit for Apogee Ensemble (bnc#1012382).
• alsa: compress: Fix stop handling on compressed capture streams (bnc#1012382).
• alsa: hda - Add quirk for HP EliteBook 840 G5 (bnc#1012382).
• alsa: hda/realtek - Disable headset Mic VREF for headset mode of ALC225 (bnc#1012382).
• alsa: hda - Serialize codec registrations (bnc#1012382).
• alsa: usb-audio: Fix implicit fb endpoint setup by quirk (bnc#1012382).
• ARC: perf: map generic branches to correct hardware condition (bnc#1012382).
• arm64: Do not trap host pointer auth use to EL2 (bnc#1012382).
• arm64: ftrace: do not adjust the LR value (bnc#1012382).
• arm64: hyp-stub: Forbid kprobing of the hyp-stub (bnc#1012382).
• arm64/kvm: consistently handle host HCR_EL2 flags (bnc#1012382).
• arm64: KVM: Skip MMIO insn after emulation (bnc#1012382).
• arm64: perf: set suppress_bind_attrs flag to true (bnc#1012382).
• ARM: 8808/1: kexec:offline panic_smp_self_stop CPU (bnc#1012382).
• ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment (bnc#1012382).
• ARM: dts: da850-evm: Correct the sound card name (bnc#1012382).
• ARM: dts: Fix OMAP4430 SDP Ethernet startup (bnc#1012382).
• ARM: dts: kirkwood: Fix polarity of GPIO fan lines (bnc#1012382).
• ARM: dts: mmp2: fix TWSI2 (bnc#1012382).
• ARM: iop32x/n2100: fix PCI IRQ mapping (bnc#1012382).
• ARM: OMAP2+: hwmod: Fix some section annotations (bnc#1012382).
• ARM: pxa: avoid section mismatch warning (bnc#1012382).
• ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages (bnc#1012382).
• ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M (bnc#1012382).
• ASoC: Intel: mrfld: fix uninitialized variable access (bnc#1012382).
• ata: Fix racy link clearance (bsc#1107866).
• ax25: fix possible use-after-free (bnc#1012382).
• batman-adv: Avoid WARN on net_device without…

The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes.

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

• CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)
• CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)
• CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)
• CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

This kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel.

For more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736

The following security bugs were fixed:

• CVE-2016-10741: fs/xfs/xfs_aops.c allowed local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure (bnc#1114920 bnc#1124010).
• CVE-2017-1000407: By flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic (bnc#1071021).
• CVE-2017-16533: The usbhid_parse function in drivers/hid/usbhid/hid-core.c allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066674).
• CVE-2017-7273: The cp_report_fixup function in drivers/hid/hid-cypress.c allowed physically proximate attackers to cause a denial of service (integer underflow) or possibly have unspecified other impact via a crafted HID report (bnc#1031240).
• CVE-2017-7472: The KEYS subsystem allowed local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls (bnc#1034862).
• CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. (bnc#1107829).
• CVE-2018-15572: The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c did not always fill RSB upon a context switch, which made it easier for attackers to conduct userspace-userspace spectreRSB attacks (bnc#1102517 bnc#1105296).
• CVE-2018-16884: NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (bnc#1119946).
• CVE-2018-18281: The mremap() syscall performed TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. (bnc#1113769).
• CVE-2018-18386: drivers/tty/n_tty.c allowed local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ (bnc#1094825).
• CVE-2018-18690: A local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

• CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)
• CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)
• CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)
• CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

This kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel.

For more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736

The following security bugs were fixed:

• CVE-2019-9213: The expand_downwards function in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).
• CVE-2013-0216: The Xen netback functionality allowed guest OS users to cause a denial of service (loop) by triggering ring pointer corruption (bnc#800280).
• CVE-2013-0231: The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen allowed guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. (bnc#801178).
• CVE-2012-3430: The rds_recvmsg function in net/rds/recv.c did not initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a recvfrom or recvmsg system call on an RDS socket (bnc#773383).
• CVE-2012-3412: The sfc (aka Solarflare Solarstorm) driver allowed remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value (bnc#774523).
• CVE-2013-0160: The kernel allowed local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device (bnc#797175).
• CVE-2013-1979: The scm_set_cred function in include/net/scm.h uses incorrect uid and gid values during credentials passing, which allowed local users to gain privileges via a crafted application (bnc#816708).

The following non-security bugs were fixed:

• Add opcodes from net: filter: BPF 'JIT' compiler for PPC64 (bsc#1131107).
• EHCI: improved logic for isochronous scheduling (bsc#1117515).
• KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup (bsc#1129439).
• USB: Add new USB LPM helpers (bsc#1129770).
• USB: Consolidate LPM checks to avoid enabling LPM twice (bsc#1129770).
• USB: EHCI: add new root-hub state: STOPPING (bsc#1117515).
• USB: EHCI: add pointer to end of async-unlink list (bsc#1117515).
• USB: EHCI: add symbolic constants for QHs (bsc#1117515).
• USB: EHCI: always scan each interrupt QH (bsc#1117515).
• USB: EHCI: do not lose events during a scan (bsc#1117515).
• USB: EHCI: do not refcount QHs (bsc#1117515).
• USB: EHCI: do not refcount iso_stream structures (bsc#1117515).
• USB: EHCI: fix initialization bug in iso_stream_schedule() (bsc#1117515).
• USB: EHCI: fix up locking (bsc#1117515).
• USB: EHCI: initialize data before resetting hardware (bsc#1117515).
• USB: EHCI: introduce high-res timer (bsc#1117515).
• USB: EHCI: remove PS3 status polling (bsc#1117515).
• USB: EHCI: remove unneeded suspend/resume code (bsc#1117515).
• USB: EHCI: rename 'reclaim' (bsc#1117515).
• USB: EHCI: resolve some unlikely races (bsc#1117515).
• USB: EHCI: return void instead of 0 (bsc#1117515).
• USB: EHCI: simplify isochronous scanning (bsc#1117515).
• USB: EHCI: unlink multiple async QHs together (bsc#1117515).
• USB: EHCI: use hrtimer for (s)iTD deallocation (bsc#1117515).
• USB: EHCI: use hrtimer for async schedule (bsc#1117515).
• USB: EHCI: use hrtimer for controller death (bsc#1117515).
• USB:…

USN-3930-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04 LTS.

Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19824)

Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)

Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM). (CVE-2019-7222)

Jann Horn discovered that the eBPF implementation in the Linux kernel was insufficiently hardened against Spectre V1 attacks. A local attacker could use this to expose sensitive information. (CVE-2019-7308)

It was discovered that a use-after-free vulnerability existed in the user- space API for crypto (af_alg) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-8912)

Jakub Jirasek discovered a use-after-free vulnerability in the SCTP implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-8956)

It was discovered that the Linux kernel did not properly deallocate memory when handling certain errors while reading files. A local attacker could use this to cause a denial of service (excessive memory consumption). (CVE-2019-8980)

It was discovered that a use-after-free vulnerability existed in the IPMI implementation in the Linux kernel. A local attacker with access to the IPMI character device files could use this to cause a denial of service (system crash). (CVE-2019-9003)

Jann Horn discovered that the SNMP NAT implementation in the Linux kernel performed insufficient ASN.1 length checks. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-9162)

Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213)

M. Vefa Bicakci and Andy Lutomirski discovered that the kernel did not properly set up all arguments to an error handler callback used when running as a paravirtualized guest. An unprivileged attacker in a paravirtualized guest VM could use this to cause a denial of service (guest VM crash). (CVE-2018-14678)

It was discovered that the KVM implementation in the Linux kernel on ARM 64bit processors did not properly handle some ioctls. An attacker with the privilege to create KVM-based virtual machines could use this to cause a denial of service (host system crash) or execute arbitrary code in the host. (CVE-2018-18021)

Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19824)

Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)

Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM). (CVE-2019-7222)

Jann Horn discovered that the eBPF implementation in the Linux kernel was insufficiently hardened against Spectre V1 attacks. A local attacker could use this to expose sensitive information. (CVE-2019-7308)

It was discovered that a use-after-free vulnerability existed in the user- space API for crypto (af_alg) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-8912)

It was discovered that the Linux kernel did not properly deallocate memory when handling certain errors while reading files. A local attacker could use this to cause a denial of service (excessive memory consumption). (CVE-2019-8980)

Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213)

USN-3931-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS and for the Linux Azure kernel for Ubuntu 14.04 LTS.

M. Vefa Bicakci and Andy Lutomirski discovered that the kernel did not properly set up all arguments to an error handler callback used when running as a paravirtualized guest. An unprivileged attacker in a paravirtualized guest VM could use this to cause a denial of service (guest VM crash). (CVE-2018-14678)

It was discovered that the KVM implementation in the Linux kernel on ARM 64bit processors did not properly handle some ioctls. An attacker with the privilege to create KVM-based virtual machines could use this to cause a denial of service (host system crash) or execute arbitrary code in the host. (CVE-2018-18021)

Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19824)

Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)

Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM). (CVE-2019-7222)

Jann Horn discovered that the eBPF implementation in the Linux kernel was insufficiently hardened against Spectre V1 attacks. A local attacker could use this to expose sensitive information. (CVE-2019-7308)

It was discovered that a use-after-free vulnerability existed in the user- space API for crypto (af_alg) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-8912)

It was discovered that the Linux kernel did not properly deallocate memory when handling certain errors while reading files. A local attacker could use this to cause a denial of service (excessive memory consumption). (CVE-2019-8980)

Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213)

It was discovered that a race condition existed in the f2fs file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2017-18249)

Wen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100, CVE-2018-14614, CVE-2018-14616)

Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613)

Vasily Averin and Evgenii Shatokhin discovered that a use-after-free vulnerability existed in the NFS41+ subsystem when multiple network namespaces are in use. A local attacker in a container could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-16884)

It was discovered that a use-after-free vulnerability existed in the PPP over L2TP implementation in the Linux kernel. A privileged local attacker could use this to possibly execute arbitrary code. (CVE-2018-9517)

Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)

Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM). (CVE-2019-7222)

Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213)

Muyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code. (CVE-2019-3701)

Vladis Dronov discovered that the debug interface for the Linux kernel's HID subsystem did not properly validate passed parameters in some situations. A local privileged attacker could use this to cause a denial of service (infinite loop). (CVE-2019-3819)

USN-3932-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.

It was discovered that a race condition existed in the f2fs file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2017-18249)

Wen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100, CVE-2018-14614, CVE-2018-14616)

Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613)

Vasily Averin and Evgenii Shatokhin discovered that a use-after-free vulnerability existed in the NFS41+ subsystem when multiple network namespaces are in use. A local attacker in a container could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-16884)

It was discovered that a use-after-free vulnerability existed in the PPP over L2TP implementation in the Linux kernel. A privileged local attacker could use this to possibly execute arbitrary code. (CVE-2018-9517)

Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)

Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM). (CVE-2019-7222)

Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213)

Muyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code. (CVE-2019-3701)

Vladis Dronov discovered that the debug interface for the Linux kernel's HID subsystem did not properly validate passed parameters in some situations. A local privileged attacker could use this to cause a denial of service (infinite loop). (CVE-2019-3819)

It was discovered that an information leak vulnerability existed in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could possibly expose sensitive information (kernel memory). (CVE-2017-1000410)

It was discovered that the USB serial device driver in the Linux kernel did not properly validate baud rate settings when debugging is enabled. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18360)

Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19824)

Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)

Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM). (CVE-2019-7222)

Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213)