CVE-2019-10220

Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.

• openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() {CVE-2020-36386}
• btrfs: only search for left_info if there is no right_info in try_merge_free_space {CVE-2019-19448}
• filldir[64]: remove WARN_ON_ONCE() for bad directory entries {CVE-2019-10220}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• ath9k: release allocated buffer if timed out {CVE-2019-19074}
• net: sched: sch_qfq: prevent slab-out-of-bounds in {CVE-2023-31436}
• memstick: r592: Fix UAF bug in r592_remove due to race {CVE-2023-3141}
• wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid {CVE-2023-23559}
• ext4: fix kernel infoleak via ext4_extent_header {CVE-2022-0850}

• openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() {CVE-2020-36386}
• btrfs: only search for left_info if there is no right_info in try_merge_free_space {CVE-2019-19448}
• filldir[64]: remove WARN_ON_ONCE() for bad directory entries {CVE-2019-10220}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• ath9k: release allocated buffer if timed out {CVE-2019-19074}
• net: sched: sch_qfq: prevent slab-out-of-bounds in {CVE-2023-31436}
• memstick: r592: Fix UAF bug in r592_remove due to race {CVE-2023-3141}
• wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid {CVE-2023-23559}
• ext4: fix kernel infoleak via ext4_extent_header {CVE-2022-0850}

• openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() {CVE-2020-36386}
• btrfs: only search for left_info if there is no right_info in try_merge_free_space {CVE-2019-19448}
• filldir[64]: remove WARN_ON_ONCE() for bad directory entries {CVE-2019-10220}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• ath9k: release allocated buffer if timed out {CVE-2019-19074}
• net: sched: sch_qfq: prevent slab-out-of-bounds in {CVE-2023-31436}
• memstick: r592: Fix UAF bug in r592_remove due to race {CVE-2023-3141}
• wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid {CVE-2023-23559}
• ext4: fix kernel infoleak via ext4_extent_header {CVE-2022-0850}

• openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() {CVE-2020-36386}
• btrfs: only search for left_info if there is no right_info in try_merge_free_space {CVE-2019-19448}
• filldir[64]: remove WARN_ON_ONCE() for bad directory entries {CVE-2019-10220}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• ath9k: release allocated buffer if timed out {CVE-2019-19074}
• net: sched: sch_qfq: prevent slab-out-of-bounds in {CVE-2023-31436}
• memstick: r592: Fix UAF bug in r592_remove due to race {CVE-2023-3141}
• wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid {CVE-2023-23559}
• ext4: fix kernel infoleak via ext4_extent_header {CVE-2022-0850}

• libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
• drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
• drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
• ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
• tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
• wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
• ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}
• cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
• bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• kyber: fix out of bounds access when preempted {CVE-2021-46984}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• tls: separate no-async decryption request handling from async {CVE-2024-58240}
• ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
• nfsd: fix use-after-free due to delegation race {CVE-2021-47506}
• drm: bridge/panel: Cleanup connector on bridge detach {CVE-2021-47063}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2023-39189}
• crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer {CVE-2021-47226}
• kvm: LAPIC: Restore guard to prevent illegal APIC register access {CVE-2021-47255}
• tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
• macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• RDMA/cxgb4: Do not dma memory off of the stack {CVE-2019-17075}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) {CVE-2019-7221}
• RDMA/umad: Reject negative data_len in…

• libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
• svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
• drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
• drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
• ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
• tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
• wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
• drm/i915/gem: Really move i915_gem_context.link under ref protection {CVE-2022-48662}
• drm/i915: Release i915_gem_context from a worker {CVE-2022-48662}
• KVM: x86/mmu: Don't advance iterator after restart due to yielding {CVE-2021-47094}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
• skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
• nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
• icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
• RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device {CVE-2023-53393}
• scsi: target: iscsi: Fix a race condition between login_work and the login thread {CVE-2022-50350}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
• cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
• bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• ice: Fix memory corruption in VF driver {CVE-2022-49722}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• netfilter: nf_conntrack_helper: pass helper to…

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-0154: An unprotected read access to i915 registers has been fixed that could have been abused to facilitate a local denial-of-service attack. (bsc#1135966)

• CVE-2019-0155: A privilege escalation vulnerability has been fixed in the i915 module that allowed batch buffers from user mode to gain super user privileges. (bsc#1135967)

• CVE-2019-16231: drivers/net/fjes/fjes_main.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference (bnc#1150466).

• CVE-2019-18805: There was a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6 (bnc#1156187).

• CVE-2019-17055: base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module did not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21 (bnc#1152782).

• CVE-2019-16995: A memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c, if hsr_add_port fails to add a port, which may cause denial of service, aka CID-6caabe7f197d (bnc#1152685).

• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

  The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

  The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference (bnc#1150457).

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

  The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed.

  More information can be found on https://www.suse.com/support/kb/doc/?id=7023735

• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

The following non-security bugs were fixed:

• ALSA: bebob: Fix prototype of helper function to return negative value (bsc#1051510).
• ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series (git-fixes).
• ALSA: hda: Add Elkhart Lake PCI ID (bsc#1051510).
• ALSA: hda: Add Tigerlake/Jasperlake PCI ID (bsc#1051510).
• ALSA: hda/ca0132 - Fix possible workqueue stall (bsc#1155836).
• ALSA: hda/realtek - Add support for ALC623 (bsc#1051510).
• ALSA: hda/realtek - Add support for ALC711 (bsc#1051510).
• ALSA: hda/realtek - Fix 2 front mics of codec 0x623 (bsc#1051510).
• ALSA: timer: Fix incorrectly assigned timer instance (git-fixes).
• ALSA: timer: Fix mutex deadlock at releasing card (bsc#1051510).
• arcnet: provide a buffer big enough to actually receive packets (networking-stable-19_09_30).
• ASoc: rockchip: i2s: Fix RPM imbalance (bsc#1051510).
• ASoC: rsnd: Reinitialize bit clock inversion flag for every format setting (bsc#1051510).
• bpf: fix use after free in prog symbol exposure (bsc#1083647).
• btrfs: block-group: Fix a memory leak due to missing btrfs_put_block_group() (bsc#1155178).
• btrfs: qgroup: Always free PREALLOC META reserve in btrfs_delalloc_release_extents() (bsc#1155179).
• btrfs: tracepoints: Fix bad entry members of qgroup events (bsc#1155186).
• btrfs: tracepoints: Fix wrong parameter…

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-0154: An unprotected read access to i915 registers has been fixed that could have been abused to facilitate a local denial-of-service attack. (bsc#1135966)

• CVE-2019-0155: A privilege escalation vulnerability has been fixed in the i915 module that allowed batch buffers from user mode to gain super user privileges. (bsc#1135967)

• CVE-2019-16231: drivers/net/fjes/fjes_main.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference (bnc#1150466).

• CVE-2019-18805: There was a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6 (bnc#1156187).

• CVE-2019-17055: base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module did not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21 (bnc#1152782).

• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

  The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

  The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

  The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed.

  More information can be found on https://www.suse.com/support/kb/doc/?id=7023735

• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

The following non-security bugs were fixed:

• ALSA: bebob: Fix prototype of helper function to return negative value (bsc#1051510).
• ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series (git-fixes).
• ALSA: firewire-motu: add support for MOTU 4pre (bsc#1111666).
• ALSA: hda/ca0132 - Fix possible workqueue stall (bsc#1155836).
• ALSA: hda/realtek - Add support for ALC623 (bsc#1051510).
• ALSA: hda/realtek - Fix 2 front mics of codec 0x623 (bsc#1051510).
• ALSA: timer: Fix incorrectly assigned timer instance (git-fixes).
• ALSA: timer: Fix mutex deadlock at releasing card (bsc#1051510).
• ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB Interface (bsc#1051510).
• ALSA: usb-audio: Disable quirks for BOSS Katana amplifiers (bsc#1111666).
• ALSA: usb-audio: Fix copy&paste error in the validator (bsc#1111666).
• arm64: Add decoding macros for CP15_32 and CP15_64 traps (jsc#ECO-561).
• arm64: Add part number for Neoverse N1 (jsc#ECO-561).
• arm64: Add silicon-errata.txt entry for ARM erratum 1188873 (jsc#ECO-561).
• arm64: Add support for new control bits CTR_EL0.DIC and CTR_EL0.IDC (jsc#ECO-561,jsc#SLE-10671).
• arm64: Apply ARM64_ERRATUM_1188873 to Neoverse-N1 (jsc#ECO-561).
• arm64: arch_timer: Add workaround for ARM erratum 1188873 (jsc#ECO-561).
• arm64: arch_timer: avoid unused function warning (jsc#ECO-561).
• arm64: compat: Add CNTFRQ trap handler (jsc#ECO-561).
• arm64: compat: Add CNTVCT trap handler (jsc#ECO-561).
• arm64: compat: Add condition code checks and IT advance (jsc#ECO-561).
• arm64: compat: Add cp15_32 and cp15_64 handler arrays (jsc#ECO-561).
• arm64: compat: Add separate CP15 trapping hook (jsc#ECO-561).
• arm64:…

The SUSE Linux Enterprise 11-SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

  The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

  The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7023735

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

  The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7024251

• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

• CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

• CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

• CVE-2019-17052: ax25_create in the AF_AX25 network module in the Linux kernel did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket, aka CID-0614e2b73768. (bnc#1152779)

• CVE-2019-17055: base_sock_create in the AF_ISDN network module in the Linux kernel did not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21. (bnc#1152782)

• CVE-2019-17054: atalk_create in the AF_APPLETALK network module in the Linux kernel did not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-6cc03e8aa36c. (bnc#1152786)

• CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

• CVE-2019-17053: ieee802154_create in the AF_IEEE802154 network module in the Linux kernel did not enforce CAP_NET_RAW, which means that unprivileged users could create a raw socket, aka CID-e69dbd4619e7. (bnc#1152789)

• CVE-2019-16413: The 9p filesystem did not protect i_size_write() properly, which caused an i_size_read() infinite loop and denial of service on SMP systems. (bnc#1151347)

• CVE-2019-15291: There was a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function. (bnc#1146540)

• CVE-2019-15807: There was a memory leak in the SAS expander driver when SAS expander discovery fails. This could cause a denial of service. (bnc#1148938)

• CVE-2019-14821: An out-of-bounds access issue was found in the way Linux the kernel's KVM hypervisor implemented the Coalesced MMIO write operation. It operated on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system. (bnc#1151350)

• CVE-2019-15505: The Linux kernel had an out-of-bounds read via crafted USB device traffic (which may have been remote via usbip or usbredir). (bnc#1147122)

• CVE-2019-14835: A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to…

This update for the Linux Kernel 3.12.74-60_64_110 fixes several issues.

The following security issues were fixed:

• CVE-2019-10220: Fixed a relative path escape in the Samba client module (bsc#1144903, bsc#1153108).
• CVE-2019-17133: Fixed a buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c caused by long SSID IEs (bsc#1153158).

This update for the Linux Kernel 4.4.180-94_103 fixes several issues.

The following security issues were fixed:

• CVE-2019-10220: Fixed a relative path escape in the Samba client module (bsc#1144903, bsc#1153108).
• CVE-2019-17133: Fixed a buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c caused by long SSID IEs (bsc#1153158).

This update for the Linux Kernel 4.12.14-197_18 fixes several issues.

The following security issues were fixed:

• CVE-2019-10220: Fixed a relative path escape in the Samba client module (bsc#1144903, bsc#1153108).
• CVE-2019-17133: Fixed a buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c caused by long SSID IEs (bsc#1153158).

This update for the Linux Kernel 4.12.14-197_15 fixes several issues.

The following security issues were fixed:

• CVE-2019-10220: Fixed a relative path escape in the Samba client module (bsc#1144903, bsc#1153108).
• CVE-2019-17133: Fixed a buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c caused by long SSID IEs (bsc#1153158).

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735

• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

• CVE-2019-0154: Fix a local denial of service via read of unprotected i915 registers. (bsc#1135966)
• CVE-2019-0155: Fix privilege escalation in the i915 driver. Batch buffers from usermode could have escalated privileges via blitter command stream. (bsc#1135967)
• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).
• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).
• CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).
• CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).
• CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465)
• CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).
• CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).
• CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

The following non-security bugs were fixed:

• 9p: avoid attaching writeback_fid on mmap with type PRIVATE (bsc#1051510).
• acpi / CPPC: do not require the _PSD method (bsc#1051510).
• acpi / processor: do not print errors for processorIDs == 0xff (bsc#1051510).
• acpi: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit() (bsc#1051510).
• act_mirred: Fix mirred_init_module error handling (bsc#1051510).
• alsa: bebob: Fix prototype of helper function to return negative value (bsc#1051510).
• alsa: hda - Add laptop imic fixup for ASUS M9V laptop (bsc#1051510).
• alsa: hda - Apply AMD controller workaround for Raven platform (bsc#1051510).
• alsa: hda - Define a fallback_pin_fixup_tbl for alc269 family (bsc#1051510).
• alsa: hda - Drop unsol event handler for Intel HDMI codecs (bsc#1051510).
• alsa: hda - Expand pin_match function to match upcoming new tbls (bsc#1051510).
• alsa: hda - Inform too slow responses (bsc#1051510).
• alsa: hda - Show the fatal CORB/RIRB error more clearly (bsc#1051510).
• alsa: hda/hdmi: remove redundant assignment to variable pcm_idx (bsc#1051510).
• alsa: hda/realtek - Add support for ALC623 (bsc#1051510).
• alsa: hda/realtek - Add support for ALC711 (bsc#1051510).
• alsa: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93 (bsc#1051510).
• alsa: hda/realtek - Check beep whitelist before assigning in all codecs (bsc#1051510).
• alsa: hda/realtek - Fix 2 front mics of codec 0x623 (bsc#1051510).
• alsa: hda/realtek - Fix alienware headset mic (bsc#1051510).
• alsa: hda/realtek: Reduce…

The SUSE Linux Enterprise 15-SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

  The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735

• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

  The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

  The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

• CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

• CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

• CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

• CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

• CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

• CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

The following non-security bugs were fixed:

• 9p: avoid attaching writeback_fid on mmap with type PRIVATE (bsc#1051510).
• acpi: cppc: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit() (bsc#1051510).
• acpi: cppc: do not require the _PSD method (bsc#1051510).
• acpi: processor: do not print errors for processorIDs == 0xff (bsc#1051510).
• act_mirred: Fix mirred_init_module error handling (bsc#1051510).
• alsa: bebob: Fix prototype of helper function to return negative value (bsc#1051510).
• alsa: firewire-motu: add support for MOTU 4pre (bsc#1111666).
• alsa: hda/hdmi: Do not report spurious jack state changes (bsc#1051510).
• alsa: hda/hdmi: remove redundant assignment to variable pcm_idx (bsc#1051510).
• alsa: hda/realtek: Add support for ALC623 (bsc#1051510).
• alsa: hda/realtek: Add support for ALC711 (bsc#1051510).
• alsa: hda/realtek: Check beep whitelist before assigning in all codecs (bsc#1051510).
• alsa: hda/realtek: Enable headset mic on Asus MJ401TA (bsc#1051510).
• alsa: hda/realtek: Fix 2 front mics of codec 0x623 (bsc#1051510).
• alsa: hda/realtek: Fix alienware headset mic (bsc#1051510).
• alsa: hda/realtek: PCI quirk for Medion E4254 (bsc#1051510).
• alsa: hda/realtek: Reduce the Headphone static noise on XPS 9350/9360 (bsc#1051510).
• alsa: hda/sigmatel: remove unused variable 'stac9200_core_init' (bsc#1051510).
• alsa: hda: Add Elkhart Lake PCI ID (bsc#1051510).
• alsa: hda: Add Tigerlake/Jasperlake PCI ID (bsc#1051510).
• alsa: hda: Add a quirk model for fixing Huawei Matebook X right speaker (bsc#1051510).
• alsa: hda: Add laptop imic fixup for ASUS M9V laptop (bsc#1051510).
• alsa: hda: Add support of Zhaoxin controller (bsc#1051510).
• alsa: hda: Apply AMD controller workaround for Raven platform…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel KVM hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

Other security fixes:

• CVE-2019-0154: Fixed a local denial of service via read of unprotected i915 registers. (bsc#1135966)
• CVE-2019-0155: Fixed privilege escalation in the i915 driver. Batch buffers from usermode could have escalated privileges via blitter command stream. (bsc#1135967)
• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).
• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

The following non-security bugs were fixed:

• alsa: bebob: Fix prototype of helper function to return negative value (bsc#1051510).
• alsa: hda/realtek - Add support for ALC623 (bsc#1051510).
• alsa: hda/realtek - Add support for ALC711 (bsc#1051510).
• alsa: hda/realtek - Fix 2 front mics of codec 0x623 (bsc#1051510).
• alsa: hda: Add Elkhart Lake PCI ID (bsc#1051510).
• alsa: hda: Add Tigerlake/Jasperlake PCI ID (bsc#1051510).
• alsa: timer: Fix mutex deadlock at releasing card (bsc#1051510).
• arcnet: provide a buffer big enough to actually receive packets (networking-stable-19_09_30).
• asoc: rockchip: i2s: Fix RPM imbalance (bsc#1051510).
• asoc: rsnd: Reinitialize bit clock inversion flag for every format setting (bsc#1051510).
• bpf: fix use after free in prog symbol exposure (bsc#1083647).
• btrfs: block-group: Fix a memory leak due to missing btrfs_put_block_group() (bsc#1155178).
• btrfs: qgroup: Always free PREALLOC META reserve in btrfs_delalloc_release_extents() (bsc#1155179).
• btrfs: tracepoints: Fix bad entry members of qgroup events (bsc#1155186).
• btrfs: tracepoints: Fix wrong parameter order for qgroup events (bsc#1155184).
• crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t (bsc#1154737).
• crypto: af_alg - Initialize sg_num_bytes in error code path (bsc#1051510).
• crypto: af_alg - consolidation of duplicate code (bsc#1154737).
• crypto: af_alg - fix race accessing cipher request (bsc#1154737).
• crypto: af_alg - remove locking in async callback (bsc#1154737).
• crypto: af_alg - update correct dst SGL entry (bsc#1051510).
• crypto: af_alg - wait for data at beginning of recvmsg (bsc#1154737).
• crypto: algif - return error code when no data was processed (bsc#1154737).
• crypto: algif_aead - copy AAD from src to dst (bsc#1154737).
• crypto: algif_aead - fix reference counting of null skcipher (bsc#1154737).
• crypto: algif_aead - overhaul memory management (bsc#1154737).
• crypto: algif_aead - skip SGL entries with NULL page (bsc#1154737).
• crypto: algif_skcipher - overhaul memory management (bsc#1154737).
• cxgb4:Fix out-of-bounds MSI-X info array access (networking-stable-19_10_05).
• drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50 (bsc#1051510).
• drm/i915/cmdparser: Add support for…

The SUSE Linux Enterprise 12-SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

  The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735

• CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

  The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

  The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

• CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

• CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

• CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

• CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

• CVE-2019-17055: The AF_ISDN network module in the Linux kernel did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bnc#1152782).

• CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

• CVE-2019-16413: The 9p filesystem did not protect i_size_write() properly, which caused an i_size_read() infinite loop and denial of service on SMP systems (bnc#1151347).

• CVE-2019-15902: A backporting issue was discovered that re-introduced the Spectre vulnerability it had aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped (bnc#1149376).

• CVE-2019-15291: Fixed a NULL pointer dereference issue that could be caused by a malicious USB device (bnc#1146519).

• CVE-2019-15807: Fixed a memory leak in the SCSI module that could be abused to cause denial of service (bnc#1148938).

• CVE-2019-13272: Fixed a mishandled the recording of the credentials of a process that wants to create a ptrace relationship, which allowed local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). (bnc#1140671).

• CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's KVM hypervisor. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).

• CVE-2019-15505: An out-of-bounds issue had been fixed that could be caused by crafted USB device traffic (bnc#1147122).

• CVE-2017-18595: A double free in allocate_trace_buffer was fixed …

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel KVM hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735

• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

• CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

• CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

• CVE-2019-17055: The AF_ISDN network module in the Linux kernel did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bnc#1152782).

• CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

• CVE-2019-16413: The 9p filesystem did not protect i_size_write() properly, which caused an i_size_read() infinite loop and denial of service on SMP systems (bnc#1151347).

• CVE-2019-15902: A backporting issue was discovered that re-introduced the Spectre vulnerability it had aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped (bnc#1149376).

• CVE-2019-15291: Fixed a NULL pointer dereference issue that could be caused by a malicious USB device (bnc#11465).

• CVE-2019-15807: Fixed a memory leak in the SCSI module that could be abused to cause denial of service (bnc#1148938).

• CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's KVM hypervisor. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).

• CVE-2019-15505: An out-of-bounds issue had been fixed that could be caused by crafted USB device traffic (bnc#1147122).

• CVE-2017-18595: A double free in allocate_trace_buffer was fixed (bnc#1149555).

• CVE-2019-14835: A buffer overflow flaw was found in the kernel's vhost functionality that translates virtqueue buffers to IOVs. A privileged guest user able to pass descriptors with invalid length to the host could use this flaw to increase their privileges on the host (bnc#1150112).

• CVE-2019-15216: A NULL pointer dereference was fixed that could be malicious USB device (bnc#1146361).

• CVE-2019-9456: An out-of-bounds write in the USB monitor driver has been fixed. This issue could lead to local escalation of privilege with System execution privileges needed. (bnc#1150025).

• CVE-2019-15926: An out-of-bounds access was fixed in the drivers/net/wireless/ath/ath6kl module. (bnc#1149527).

• CVE-2019-15927: An…

The SUSE Linux Enterprise 15 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

  The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735

• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

  The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

  The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

• CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

• CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

• CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

• CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

• CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

• CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

• CVE-2019-18805: Fix signed integer overflow in tcp_ack_update_rtt() that could have lead to a denial of service or possibly unspecified other impact (bsc#1156187)

• CVE-2019-17055: The AF_ISDN network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bnc#1152782)

The following non-security bugs were fixed:

• 9p: avoid attaching writeback_fid on mmap with type PRIVATE (bsc#1051510).
• Add kernel module compression support (bsc#1135854) For enabling the kernel module compress, add the item COMPRESS_MODULES='xz' in config.sh, then mkspec will pass it to the spec file.
• acpi / CPPC: do not require the _PSD method (bsc#1051510).
• acpi / processor: do not print errors for processorIDs == 0xff (bsc#1051510).
• acpi: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit() (bsc#1051510).
• act_mirred: Fix mirred_init_module error handling (bsc#1051510).
• alsa: bebob: Fix prototype of helper function to return negative value (bsc#1051510).
• alsa: hda - Add laptop imic fixup for ASUS M9V laptop (bsc#1051510).
• alsa: hda - Apply AMD controller workaround for Raven platform (bsc#1051510).
• alsa: hda - Define a fallback_pin_fixup_tbl for alc269 family (bsc#1051510).
• alsa: hda - Drop unsol event handler for Intel HDMI codecs (bsc#1051510).
• alsa: hda - Expand pin_match function to match upcoming new tbls (bsc#1051510).
• alsa: hda - Inform too slow responses (bsc#1051510).
• alsa: hda - Show the fatal CORB/RIRB error more clearly (bsc#1051510).
• alsa: hda/ca0132 - Fix possible workqueue stall (bsc#1155836).
• alsa: hda/hdmi: remove redundant assignment to variable pcm_idx (bsc#1051510).
• alsa: hda/realtek - Add support for ALC623 (bsc#1051510).
• alsa: hda/realtek - Add…

The SUSE Linux Enterprise 15-SP1 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

  The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as More information can be found on https://www.suse.com/support/kb/doc/?id=7023735

• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

  The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

  The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

• CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

• CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

• CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

• CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

• CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

• CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

The following non-security bugs were fixed:

• 9p: avoid attaching writeback_fid on mmap with type PRIVATE (bsc#1051510).
• Add kernel module compression support (bsc#1135854)
• acpi / CPPC: do not require the _PSD method (bsc#1051510).
• acpi / processor: do not print errors for processorIDs == 0xff (bsc#1051510).
• acpi: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit() (bsc#1051510).
• act_mirred: Fix mirred_init_module error handling (bsc#1051510).
• alsa: bebob: Fix prototype of helper function to return negative value (bsc#1051510).
• alsa: firewire-motu: add support for MOTU 4pre (bsc#1111666).
• alsa: hda - Add a quirk model for fixing Huawei Matebook X right speaker (bsc#1051510).
• alsa: hda - Add laptop imic fixup for ASUS M9V laptop (bsc#1051510).
• alsa: hda - Apply AMD controller workaround for Raven platform (bsc#1051510).
• alsa: hda - Define a fallback_pin_fixup_tbl for alc269 family (bsc#1051510).
• alsa: hda - Drop unsol event handler for Intel HDMI codecs (bsc#1051510).
• alsa: hda - Expand pin_match function to match upcoming new tbls (bsc#1051510).
• alsa: hda - Force runtime PM on Nvidia HDMI codecs (bsc#1051510).
• alsa: hda - Inform too slow responses (bsc#1051510).
• alsa: hda - Show the fatal CORB/RIRB error more clearly (bsc#1051510).
• alsa: hda/hdmi - Do not report spurious jack state changes (bsc#1051510).
• alsa: hda/hdmi: remove redundant assignment to variable pcm_idx (bsc#1051510).
• alsa: hda/realtek - Add support for ALC623 (bsc#1051510).
• alsa: hda/realtek - Add support for ALC711 (bsc#1051510).
• alsa: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93 (bsc#1051510).
• alsa: hda/realtek - Check beep whitelist before assigning in all codecs (bsc#1051510).
• alsa: hda/realtek -…

The SUSE Linux Enterprise 15-SP1 Azure Kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

  The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as More information can be found on https://www.suse.com/support/kb/doc/?id=7023735 (bnc#1117665 1152505 1155812 1155817 1155945)

• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

  The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

  The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251 (bnc#1139073 1152497 1152505 1152506).

• CVE-2019-18805: There was a signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6 (bnc#1156187).

• CVE-2019-17055: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bnc#1152782).

• CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

• CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

• CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

• CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

• CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

• CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

The following non-security bugs were fixed:

• /dev/mem: Bail out upon SIGKILL (git-fixes).
• 9p: avoid attaching writeback_fid on mmap with type PRIVATE (bsc#1051510).
• ACPI / CPPC: do not require the _PSD method (bsc#1051510).
• ACPI / processor: do not print errors for processorIDs == 0xff (bsc#1051510).
• ACPI: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit() (bsc#1051510).
• act_mirred: Fix mirred_init_module error handling (bsc#1051510).
• Add kernel module compression support (bsc#1135854) For enabling the kernel module compress, add the item COMPRESS_MODULES='xz' in config.sh, then mkspec will pass it to the spec file.
• alarmtimer: Use EOPNOTSUPP instead of ENOTSUPP (bsc#1151680).
• ALSA: bebob: Fix prototype of helper function to return negative value (bsc#1051510).
• ALSA: hda - Add laptop imic fixup for ASUS M9V laptop (bsc#1051510).
• ALSA: hda - Apply AMD controller workaround for Raven platform (bsc#1051510).
• ALSA: hda - Define a fallback_pin_fixup_tbl for alc269 family (bsc#1051510).
• ALSA: hda - Drop unsol event handler for Intel HDMI codecs (bsc#1051510).
• ALSA: hda - Expand pin_match function to match upcoming new tbls (bsc#1051510).
• ALSA: hda - Inform too slow responses (bsc#1051510).
• ALSA:…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

  The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735

• CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

  The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

  The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

• CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

• CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

• CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

• CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

• CVE-2019-17055: The AF_ISDN network module in the Linux kernel did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bnc#1152782).

• CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

• CVE-2019-16413: The 9p filesystem did not protect i_size_write() properly, which caused an i_size_read() infinite loop and denial of service on SMP systems (bnc#1151347).

• CVE-2019-15902: A backporting issue was discovered that re-introduced the Spectre vulnerability it had aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped (bnc#1149376).

• CVE-2019-15291: Fixed a NULL pointer dereference issue that could be caused by a malicious USB device (bnc#1146519).

• CVE-2019-15807: Fixed a memory leak in the SCSI module that could be abused to cause denial of service (bnc#1148938).

• CVE-2019-13272: Fixed a mishandled the recording of the credentials of a process that wants to create a ptrace relationship, which allowed local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). (bnc#1140671).

• CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's kvm hypervisor. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).

• CVE-2019-15505: An out-of-bounds issue had been fixed that could be caused by crafted USB device traffic (bnc#1147122).

• CVE-2017-18595: A double free in allocate_trace_buffer was fixed …

This update for the Linux Kernel 4.12.14-95_37 fixes one issue.

The following security issue was fixed:

• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space (bsc#1153108).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-19081: Fixed a memory leak in the nfp_flower_spawn_vnic_reprs() could have allowed attackers to cause a denial of service (bsc#1157045).
• CVE-2019-19080: Fixed four memory leaks in the nfp_flower_spawn_phy_reprs() could have allowed attackers to cause a denial of service (bsc#1157044).
• CVE-2019-19052: Fixed a memory leak in the gs_can_open() which could have led to denial of service (bsc#1157324).
• CVE-2019-19067: Fixed multiple memory leaks in acp_hw_init (bsc#1157180).
• CVE-2019-19060: Fixed a memory leak in the adis_update_scan_mode() which could have led to denial of service (bsc#1157178).
• CVE-2019-19049: Fixed a memory leak in unittest_data_add (bsc#1157173).
• CVE-2019-19075: Fixed a memory leak in the ca8210_probe() which could have led to denial of service by triggering ca8210_get_platform_data() failures (bsc#1157162).
• CVE-2019-19058: Fixed a memory leak in the alloc_sgtable() which could have led to denial of service by triggering alloc_page() failures (bsc#1157145).
• CVE-2019-19074: Fixed a memory leak in the ath9k_wmi_cmd() function which could have led to denial of service (bsc#1157143).
• CVE-2019-19073: Fixed multiple memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c which could have led to denial of service by triggering wait_for_completion_timeout() failures (bsc#1157070).
• CVE-2019-19083: Fixed multiple memory leaks in *clock_source_create() functions which could have led to denial of service (bsc#1157049).
• CVE-2019-19082: Fixed multiple memory leaks in *create_resource_pool() which could have led to denial of service (bsc#1157046).
• CVE-2019-15916: Fixed a memory leak in register_queue_kobjects() which might have led denial of service (bsc#1149448).
• CVE-2019-0154: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable denial of service via local access (bsc#1135966).
• CVE-2019-0155: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1135967).
• CVE-2019-16231: Fixed a NULL pointer dereference due to lack of checking the alloc_workqueue return value (bsc#1150466).
• CVE-2019-18805: Fixed an integer overflow in tcp_ack_update_rtt() leading to a denial of service or possibly unspecified other impact (bsc#1156187).
• CVE-2019-17055: Enforced CAP_NET_RAW in the AF_ISDN network module to restrict unprivileged users to create a raw socket (bsc#1152782).
• CVE-2019-16995: Fixed a memory leak in hsr_dev_finalize() which may have caused denial of service (bsc#1152685).
• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).
• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903)
• CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).
• CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).
• CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's kvm hypervisor. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).
• CVE-2017-18595: A double free in allocate_trace_buffer was fixed (bnc#1149555).
• CVE-2019-9506: The Bluetooth BR/EDR specification used to permit sufficiently low encryption key length and did not prevent an attacker from influencing the key length negotiation. This allowed practical brute-force attacks (aka 'KNOB') that…

This update for the Linux Kernel 4.12.14-197_15 fixes several issues.

The following security issues were fixed:

• CVE-2019-15239: Fixed a vulnerability where a local attacker could have triggered multiple use-after-free conditions resulted in privilege escalation (bsc#1156317).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

The following bugs were fixed:

• Fixed boot up hang revealed by int3 self test (bsc#1157770).

This update for the Linux Kernel 4.12.14-197_21 fixes several issues.

The following security issue was fixed:

• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

The following bugs were fixed:

• Fixed boot up hang revealed by int3 self test (bsc#1157770).

This update for the Linux Kernel 4.12.14-95_6 fixes several issues.

The following security issues were fixed:

• CVE-2019-15917: Fixed a use-after-free when hci_uart_register_dev() fails in hci_uart_set_proto() (bsc#1156334).
• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2018-16871: Fixed an issue where an attacker, who could mount an exported NFS filesystem, was able to trigger a null pointer dereference by using an invalid NFS sequence leading to kernel panic and deny of access to the NFS server (bsc#1156320).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

This update for the Linux Kernel 4.12.14-95_13 fixes several issues.

The following security issues were fixed:

• CVE-2019-15917: Fixed a use-after-free when hci_uart_register_dev() fails in hci_uart_set_proto() (bsc#1156334).
• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

This update for the Linux Kernel 4.12.14-95_16 fixes several issues.

The following security issues were fixed:

• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

This update for the Linux Kernel 4.4.180-94_100 fixes several issues.

The following security issues were fixed:

• CVE-2018-20856: Fixed a use-after-free in __blk_drain_queue() due to an improper error handling (bsc#1156331).
• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2019-15239: Fixed a vulnerability where a local attacker could have triggered multiple use-after-free conditions resulted in privilege escalation (bsc#1156317).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

The following bugs were fixed:

• Fixed boot up hang revealed by int3 self test (bsc#1157770).

This update for the Linux Kernel 4.4.180-94_103 fixes several issues.

The following security issues were fixed:

• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2019-15239: Fixed a vulnerability where a local attacker could have triggered multiple use-after-free conditions resulted in privilege escalation (bsc#1156317).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

The following bugs were fixed:

• Fixed boot up hang revealed by int3 self test (bsc#1157770).

This update for the Linux Kernel 4.4.121-92_101 fixes several issues.

The following security issues were fixed:

• CVE-2018-20856: Fixed a use-after-free in __blk_drain_queue() due to an improper error handling (bsc#1156331).
• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

This update for the Linux Kernel 3.12.74-60_64_121 fixes several issues.

The following security issues were fixed:

• CVE-2019-15917: Fixed a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c (bsc#1156334).
• CVE-2019-10220: Fixed Samba servers that can inject relative paths in directory entry lists (bsc#1153108).

This update for the Linux Kernel 4.12.14-25_28 fixes several issues.

The following security issues were fixed:

• CVE-2019-15917: Fixed a use-after-free when hci_uart_register_dev() fails in hci_uart_set_proto() (bsc#1156334).
• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2018-16871: Fixed an issue where an attacker, who could mount an exported NFS filesystem, was able to trigger a null pointer dereference by using an invalid NFS sequence leading to kernel panic and deny of access to the NFS server (bsc#1156320).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

This update for the Linux Kernel 4.12.14-150_14 fixes several issues.

The following security issues were fixed:

• CVE-2019-15917: Fixed a use-after-free when hci_uart_register_dev() fails in hci_uart_set_proto() (bsc#1156334).
• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

This update for the Linux Kernel 4.12.14-195 fixes several issues.

The following security issues were fixed:

• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

This update for the Linux Kernel 4.12.14-197_4 fixes several issues.

The following security issues were fixed:

• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2019-15239: Fixed a vulnerability where a local attacker could have triggered multiple use-after-free conditions resulted in privilege escalation (bsc#1156317).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

The following bugs were fixed:

• Fixed boot up hang revealed by int3 self test (bsc#1157770).

This update for the Linux Kernel 4.12.14-95_3 fixes several issues.

The following security issues were fixed:

• CVE-2019-15917: Fixed a use-after-free when hci_uart_register_dev() fails in hci_uart_set_proto() (bsc#1156334).
• CVE-2018-20856: Fixed a use-after-free in block/blk-core.c due to improper error handling (bsc#1156331).
• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2018-16871: Fixed an issue where an attacker, who could mount an exported NFS filesystem, was able to trigger a null pointer dereference by using an invalid NFS sequence leading to kernel panic and deny of access to the NFS server (bsc#1156320).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

This update for the Linux Kernel 4.12.14-95_32 fixes several issues.

The following security issue was fixed:

• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

The following bugs were fixed:

• Fixed boot up hang revealed by int3 self test (bsc#1157770).

This update for the Linux Kernel 4.4.178-94_91 fixes several issues.

The following security issues were fixed:

• CVE-2018-20856: Fixed a use-after-free in block/blk-core.c due to improper error handling (bsc#1156331).
• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2019-15239: Fixed a vulnerability where a local attacker could have triggered multiple use-after-free conditions resulted in privilege escalation (bsc#1156317).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

This update for the Linux Kernel 4.4.121-92_109 fixes several issues.

The following security issues were fixed:

• CVE-2018-20856: Fixed a use-after-free in __blk_drain_queue() due to an improper error handling (bsc#1156331).
• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

This update for the Linux Kernel 4.4.121-92_117 fixes several issues.

The following security issues were fixed:

• CVE-2018-20856: Fixed a use-after-free in __blk_drain_queue() due to an improper error handling (bsc#1156331).
• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

The following bugs were fixed:

• Fixed boot up hang revealed by int3 self test (bsc#1157770).

This update for the Linux Kernel 4.4.121-92_120 fixes several issues.

The following security issues were fixed:

• CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
• CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).

The following bugs were fixed:

• Fixed boot up hang revealed by int3 self test (bsc#1157770).

The SUSE Linux Enterprise 12 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-15916: Fixed a memory leak in register_queue_kobjects() which might have led denial of service (bsc#1149448).
• CVE-2019-0154: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable denial of service via local access (bsc#1135966).
• CVE-2019-0155: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1135967).
• CVE-2019-16231: Fixed a NULL pointer dereference due to lack of checking the alloc_workqueue return value (bsc#1150466).
• CVE-2019-18805: Fixed an integer overflow in tcp_ack_update_rtt() leading to a denial of service or possibly unspecified other impact (bsc#1156187).
• CVE-2019-17055: Enforced CAP_NET_RAW in the AF_ISDN network module to restrict unprivileged users to create a raw socket (bsc#1152782).
• CVE-2019-16995: Fixed a memory leak in hsr_dev_finalize() which may have caused denial of service (bsc#1152685).
• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.(bsc#1139073). The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW). The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251
• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).
• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.
• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903)
• CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).
• CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).
• CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).
• CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).
• CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

The following non-security bugs were fixed:

• 9p: avoid attaching writeback_fid on mmap with type PRIVATE (bsc#1051510).
• ACPI / CPPC: do not require the _PSD method (bsc#1051510).
• ACPI: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit() (bsc#1051510).
• ACPI / processor: do not print errors for processorIDs == 0xff (bsc#1051510).
• act_mirred: Fix mirred_init_module error handling (bsc#1051510).
• Add kernel module compression support (bsc#1135854) For enabling the kernel module compress, add the item COMPRESS_MODULES='xz' in config.sh, then mkspec will pass it to the spec file.
• alarmtimer: Use EOPNOTSUPP instead of ENOTSUPP (bsc#1151680).
• ALSA: bebob: Fix prototype of helper function to return negative value (bsc#1051510).
• ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series (git-fixes).
• ALSA: hda: Add Cometlake-S PCI ID (git-fixes).
• ALSA: hda: Add Elkhart Lake PCI ID (bsc#1051510).
• ALSA: hda - Add laptop imic fixup for ASUS M9V laptop (bsc#1051510).
• ALSA: hda: Add…

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-15916: Fixed a memory leak in register_queue_kobjects() which might have led denial of service (bsc#1149448).
• CVE-2019-0154: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable denial of service via local access (bsc#1135966).
• CVE-2019-0155: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1135967).
• CVE-2019-16231: Fixed a NULL pointer dereference due to lack of checking the alloc_workqueue return value (bsc#1150466).
• CVE-2019-18805: Fixed an integer overflow in tcp_ack_update_rtt() leading to a denial of service or possibly unspecified other impact (bsc#1156187).
• CVE-2019-17055: Enforced CAP_NET_RAW in the AF_ISDN network module to restrict unprivileged users to create a raw socket (bsc#1152782).
• CVE-2019-16995: Fixed a memory leak in hsr_dev_finalize() which may have caused denial of service (bsc#1152685).
• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.(bsc#1139073). The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW). The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251
• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).
• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.
• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903)
• CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).
• CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).
• CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).
• CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).
• CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).
• CVE-2019-15291: Fixed a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function (bsc#1146519).
• CVE-2019-14821: Fixed an out-of-bounds access resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).
• CVE-2017-18595: Fixed a double free which caused by the function allocate_trace_buffer (bsc#1149555).
• CVE-2019-9506: Fixed an issue with Bluetooth which permited low encryption key length and did not prevent an attacker from influencing the key length negotiation allowing brute-force attacks (bsc#1137865).

The following non-security bugs were fixed:

• 9p: avoid attaching writeback_fid on mmap with type PRIVATE (bsc#1051510).
• ACPI / CPPC: do not require the _PSD method (bsc#1051510).
• ACPI: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit() (bsc#1051510).
• ACPI: custom_method: fix memory leaks (bsc#1051510).
• ACPI / PCI: fix acpi_pci_irq_enable() memory leak (bsc#1051510).
• ACPI / processor: do not print errors for…