CVE-2019-19768

In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer).

• blktrace: fix dereference after null check {CVE-2019-19768}
• blktrace: Protect q->blk_trace with RCU {CVE-2019-19768}
• blktrace: fix unlocked access to init/start-stop/teardown
• blktrace: Fix potential deadlock between delete & sysfs ops
• net: fix out-of-bounds access in ops_init {CVE-2024-36883}
• net/sched: sch_qfq: account for stab overhead in qfq_enqueue {CVE-2023-3611}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• net: fix use-after-free in tw_timer_handler {CVE-2021-46936}
• ALSA: rawmidi: Fix racy buffer resize under concurrent accesses {CVE-2020-27786}
• ALSA: rawmidi: Fix race at copying & updating the position {CVE-2020-27786}
• tty: make FONTX ioctl use the tty pointer they were actually passed {CVE-2020-25668}
• vt: keyboard: avoid signed integer overflow in k_ascii {CVE-2020-13974}

• blktrace: fix dereference after null check {CVE-2019-19768}
• blktrace: Protect q->blk_trace with RCU {CVE-2019-19768}
• blktrace: fix unlocked access to init/start-stop/teardown
• blktrace: Fix potential deadlock between delete & sysfs ops
• net: fix out-of-bounds access in ops_init {CVE-2024-36883}
• net/sched: sch_qfq: account for stab overhead in qfq_enqueue {CVE-2023-3611}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• net: fix use-after-free in tw_timer_handler {CVE-2021-46936}
• ALSA: rawmidi: Fix racy buffer resize under concurrent accesses {CVE-2020-27786}
• ALSA: rawmidi: Fix race at copying & updating the position {CVE-2020-27786}
• tty: make FONTX ioctl use the tty pointer they were actually passed {CVE-2020-25668}
• vt: keyboard: avoid signed integer overflow in k_ascii {CVE-2020-13974}
• spec: make single build including noarch packages

This update is based on upstream 5.5.9 and fixes at least the following security vulnerabilities:

In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer) (CVE-2019-19768).

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c (CVE-2020-8647).

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (CVE-2020-8648).

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c. (CVE-2020-8649).

An issue was discovered in the Linux kernel through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2 (CVE-2020-9383).

An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID- dcde237319e6. This has been observed to cause heap corruption with the GNU C Library malloc implementation (CVE-2020-9391).

Other notable changes in this update:

• kernel is built with the updated gcc-8.4.0, thus fixing the issue with nvidia drivers complaining about gcc mismatch and failing the dkms-nvidia* builds.
• ahci: Add Intel Comet Lake H RAID PCI ID
• update Amd Sensor Fusion Hub driver to v4
• replace staging exfat driver with new upstream exfat driver
• update rtl8812au driver for more hw support (mga#26178)
• fscrypt: don't evict dirty inodes after removing key

This update is based on upstream 5.5.15 and fixes at least the following security vulnerabilities:

In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer) (CVE-2019-19768).

In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h) (CVE-2019-19769).

A flaw was found in the way KVM hypervisor handled instruction emulation for the L2 guest when nested(=1) virtualization is enabled. In the instruction emulation, the L2 guest could trick the L0 hypervisor into accessing sensitive bits of the L1 hypervisor. An L2 guest could use this flaw to potentially access information of the L1 hypervisor (CVE-2020-2732).

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c (CVE-2020-8647).

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (CVE-2020-8648).

Manfred Paul discovered that the bpf verifier in the Linux kernel did not properly calculate register bounds for certain operations. A local attacker could use this to expose sensitive information (kernel memory) or gain administrative privileges (CVE-2020-8835).

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c. (CVE-2020-8649).

An issue was discovered in the Linux kernel through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2 (CVE-2020-9383).

An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID- dcde237319e6. This has been observed to cause heap corruption with the GNU C Library malloc implementation (CVE-2020-9391).

Security fixes and hardenings to the mac00211 layer to prevent leaking keys and frames.

For other upstream fixes in this update, see the referenced changelogs.

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-8647: There was a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929 1164078).
• CVE-2020-8649: There was a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162929 1162931).
• CVE-2020-9383: An issue was discovered in the set_fdc in drivers/block/floppy.c that lead to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2 (bnc#1165111).
• CVE-2019-19768: There was a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer) (bnc#1159285).

The following non-security bugs were fixed:

• ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1 (bsc#1111666).
• ALSA: hda/realtek - Add Headset Mic supported (bsc#1111666).
• ALSA: hda/realtek - Add more codec supported Headset Button (bsc#1111666).
• ALSA: hda/realtek - Apply quirk for MSI GP63, too (bsc#1111666).
• ALSA: hda/realtek - Apply quirk for yet another MSI laptop (bsc#1111666).
• ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294 (bsc#1111666).
• ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1 (bsc#1111666).
• ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master (bsc#1111666).
• ALSA: usb-audio: Add boot quirk for MOTU M Series (bsc#1111666).
• ALSA: usb-audio: Add clock validity quirk for Denon MC7000/MCX8000 (bsc#1111666).
• ALSA: usb-audio: Apply 48kHz fixed rate playback for Jabra Evolve 65 headset (bsc#1111666).
• ALSA: usb-audio: Fix UAC2/3 effect unit parsing (bsc#1111666).
• ALSA: usb-audio: Use lower hex numbers for IDs (bsc#1111666).
• ALSA: usb-audio: add implicit fb quirk for MOTU M Series (bsc#1111666).
• ALSA: usb-audio: add quirks for Line6 Helix devices fw>=2.82 (bsc#1111666).
• ALSA: usb-audio: fix Corsair Virtuoso mixer label collision (bsc#1111666).
• ALSA: usb-audio: unlock on error in probe (bsc#1111666).
• ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status (bsc#1051510).
• ASoC: dapm: Correct DAPM handling of active widgets during shutdown (bsc#1051510).
• ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path (bsc#1051510).
• ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output (bsc#1051510).
• ASoC: pcm: update FE/BE trigger order based on the command (bsc#1051510).
• ASoC: topology: Fix memleak in soc_tplg_link_elems_load() (bsc#1051510).
• Add CONFIG_RAID6_PQ_BENCHMARK=y in following config files for the above change,
• EDAC, ghes: Make platform-based whitelisting x86-only (bsc#1158187).
• EDAC/mc: Fix use-after-free and memleaks during device removal (bsc#1114279).
• Enable the following two patches in series.conf, and refresh the KABI patch due to previous md commit (bsc#1119680),
• HID: core: fix off-by-one memset in hid_report_raw_event() (bsc#1051510).
• Input: edt-ft5x06 - work around first register access error (bsc#1051510).
• Input: synaptics - enable SMBus on ThinkPad L470 (bsc#1051510).
• Input: synaptics - remove the LEN0049 dmi id from topbuttonpad list (bsc#1051510).
• Input: synaptics - switch T470s to RMI4 by default (bsc#1051510).
• KVM: VMX: check descriptor table exits on instruction emulation (bsc#1166104).
• NFC: pn544: Fix a typo in a debug message (bsc#1051510).
• NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use le16_add_cpu() (bsc#1051510).
• PCI/AER: Clear device status bits during ERR_COR handling (bsc#1161561).
• PCI/AER: Clear device status bits during ERR_FATAL and ERR_NONFATAL (bsc#1161561).
• PCI/AER: Clear only ERR_FATAL status bits during fatal recovery (bsc#1161561).
• PCI/AER: Clear only ERR_NONFATAL bits during non-fatal recovery (bsc#1161561).
• PCI/AER: Do not clear AER bits if…

The SUSE Linux Enterprise 15-SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-8647: Fixed a use-after-free in the vc_do_resize function in drivers/tty/vt/vt.c (bsc#1162929).
• CVE-2020-8649: Fixed a use-after-free in the vgacon_invert_region function in drivers/video/console/vgacon.c (bsc#1162931).
• CVE-2020-8648: Fixed a use-after-free in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (bsc#1162928).
• CVE-2020-9383: Fixed an out-of-bounds read due to improper error condition check of FDC index (bsc#1165111).
• CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).

The following non-security bugs were fixed:

• ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1 (bsc#1111666).
• ALSA: hda/realtek - Add Headset Mic supported (bsc#1111666).
• ALSA: hda/realtek - Add more codec supported Headset Button (bsc#1111666).
• ALSA: hda/realtek - Apply quirk for MSI GP63, too (bsc#1111666).
• ALSA: hda/realtek - Apply quirk for yet another MSI laptop (bsc#1111666).
• ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294 (bsc#1111666).
• ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1 (bsc#1111666).
• ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master (bsc#1111666).
• ALSA: usb-audio: Add boot quirk for MOTU M Series (bsc#1111666).
• ALSA: usb-audio: Add clock validity quirk for Denon MC7000/MCX8000 (bsc#1111666).
• ALSA: usb-audio: add implicit fb quirk for MOTU M Series (bsc#1111666).
• ALSA: usb-audio: add quirks for Line6 Helix devices fw>=2.82 (bsc#1111666).
• ALSA: usb-audio: Apply 48kHz fixed rate playback for Jabra Evolve 65 headset (bsc#1111666).
• ALSA: usb-audio: fix Corsair Virtuoso mixer label collision (bsc#1111666).
• ALSA: usb-audio: Fix UAC2/3 effect unit parsing (bsc#1111666).
• ALSA: usb-audio: unlock on error in probe (bsc#1111666).
• ALSA: usb-audio: Use lower hex numbers for IDs (bsc#1111666).
• ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status (bsc#1051510).
• amdgpu/gmc_v9: save/restore sdpif regs during S3 (bsc#1113956)
• ASoC: dapm: Correct DAPM handling of active widgets during shutdown (bsc#1051510).
• ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path (bsc#1051510).
• ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output (bsc#1051510).
• ASoC: pcm: update FE/BE trigger order based on the command (bsc#1051510).
• ASoC: topology: Fix memleak in soc_tplg_link_elems_load() (bsc#1051510).
• atm: zatm: Fix empty body Clang warnings (bsc#1051510).
• b43legacy: Fix -Wcast-function-type (bsc#1051510).
• blk: Fix kabi due to blk_trace_mutex addition (bsc#1159285).
• blktrace: fix dereference after null check (bsc#1159285).
• blktrace: fix trace mutex deadlock (bsc#1159285).
• bnxt_en: Fix NTUPLE firmware command failures (bsc#1104745 ).
• bnxt_en: Fix TC queue mapping (networking-stable-20_02_05).
• bnxt_en: Improve device shutdown method (bsc#1104745 ).
• bnxt_en: Issue PCIe FLR in kdump kernel to cleanup pending DMAs (bsc#1134090 jsc#SLE-5954).
• bonding/alb: properly access headers in bond_alb_xmit() (networking-stable-20_02_09).
• bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill (bsc#1109837).
• CIFS: add a debug macro that prints \server\share for errors (bsc#1144333).
• CIFS: add missing mount option to /proc/mounts (bsc#1144333).
• CIFS: add new debugging macro cifs_server_dbg (bsc#1144333).
• CIFS: add passthrough for smb2 setinfo (bsc#1144333).
• CIFS: add SMB2_open() arg to return POSIX data (bsc#1144333).
• CIFS: add smb2 POSIX info level (bsc#1144333).
• CIFS: add SMB3 change notification support (bsc#1144333).
• CIFS: add support for fallocate mode 0 for non-sparse files (bsc#1144333).
• CIFS: Add support for setting owner info, dos attributes, and create time (bsc#1144333).
• CIFS: Add tracepoints for errors on flush or fsync…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).
• CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).
• CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).
• CVE-2020-8647: Fixed a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).
• CVE-2020-8649: Fixed a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).
• CVE-2020-9383: Fixed an issue in set_fdc in drivers/block/floppy.c, which leads to a wait_til_ready out-of-bounds read (bnc#1165111).
• CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).
• CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).
• CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).
• CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).
• CVE-2018-20836: Fixed a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, which potentially cloud have led to a use-after-free (bnc#1134395).

The following non-security bugs were fixed:

• ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro (bsc#1051510).
• ACPI: watchdog: Fix gas->access_width usage (bsc#1051510).
• ALSA: ali5451: remove redundant variable capture_flag (bsc#1051510).
• ALSA: core: Add snd_device_get_state() helper (bsc#1051510).
• ALSA: core: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: emu10k1: Fix endianness annotations (bsc#1051510).
• ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard (bsc#1051510).
• ALSA: hda/ca0132 - Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda_codec: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda: default enable CA0132 DSP support (bsc#1051510).
• ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1 (bsc#1111666).
• ALSA: hda/realtek - Add Headset Mic supported (bsc#1111666).
• ALSA: hda/realtek - Add more codec supported Headset Button (bsc#1111666).
• ALSA: hda/realtek - a fake key event is triggered by running shutup (bsc#1051510).
• ALSA: hda/realtek - Apply quirk for MSI GP63, too (bsc#1111666).
• ALSA: hda/realtek - Apply quirk for yet another MSI laptop (bsc#1111666).
• ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662 (git-fixes).
• ALSA: hda/realtek: Enable mute LED on an HP system (bsc#1051510).
• ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662 (git-fixes).
• ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294 (bsc#1111666).
• ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1 (bsc#1111666).
• ALSA: hda/realtek: Fix pop noise on ALC225 (git-fixes).
• ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master (bsc#1111666).
• ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups (bsc#1051510).
• ALSA: hda/realtek - Set principled PC Beep configuration for ALC256…

The SUSE Linux Enterprise 12 SP4 RT kernel was updated to 3.12.31 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).
• CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).
• CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).
• CVE-2020-8647: Fixed a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).
• CVE-2020-8649: Fixed a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).
• CVE-2020-9383: Fixed an issue in set_fdc in drivers/block/floppy.c, which leads to a wait_til_ready out-of-bounds read (bnc#1165111).
• CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).
• CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).
• CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).
• CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).

The following non-security bugs were fixed:

• ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro (bsc#1051510).
• ACPI: watchdog: Fix gas->access_width usage (bsc#1051510).
• ALSA: ali5451: remove redundant variable capture_flag (bsc#1051510).
• ALSA: core: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: emu10k1: Fix endianness annotations (bsc#1051510).
• ALSA: hda/ca0132 - Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda_codec: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda: Fix potential access overflow in beep helper (bsc#1051510).
• ALSA: hda/realtek: Fix pop noise on ALC225 (git-fixes).
• ALSA: hda/realtek - Set principled PC Beep configuration for ALC256 (bsc#1051510).
• ALSA: hda: remove redundant assignment to variable timeout (bsc#1051510).
• ALSA: hda: Use scnprintf() for string truncation (bsc#1051510).
• ALSA: hdsp: remove redundant assignment to variable err (bsc#1051510).
• ALSA: ice1724: Fix invalid access for enumerated ctl items (bsc#1051510).
• ALSA: info: remove redundant assignment to variable c (bsc#1051510).
• ALSA: korg1212: fix if-statement empty body warnings (bsc#1051510).
• ALSA: line6: Fix endless MIDI read loop (git-fixes).
• ALSA: pcm: oss: Avoid plugin buffer overflow (git-fixes).
• ALSA: pcm: oss: Fix regression by buffer overflow fix (bsc#1051510).
• ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks (git-fixes).
• ALSA: seq: oss: Fix running status after receiving sysex (git-fixes).
• ALSA: seq: virmidi: Fix running status after receiving sysex (git-fixes).
• ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status (bsc#1051510).
• ALSA: via82xx: Fix endianness annotations (bsc#1051510).
• ASoC: dapm: Correct DAPM handling of active widgets during shutdown (bsc#1051510).
• ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map() (bsc#1051510).
• ASoC: Intel: mrfld: fix incorrect check on p->sink (bsc#1051510).
• ASoC: Intel: mrfld: return error codes when an error occurs (bsc#1051510).
• ASoC: jz4740-i2s: Fix divider written at incorrect offset in…

The SUSE Linux Enterprise 15 SP1 azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).
• CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).
• CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).
• CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).
• CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).
• CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).
• CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).
• CVE-2020-8647: There was a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).
• CVE-2020-8649: There was a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).
• CVE-2020-9383: An issue was discovered set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it (bnc#1165111).
• CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).
• CVE-2020-2732: Fixed a flaw in the KVM hypervisor instruction emulation for L2 guests. Under some circumstances, an L2 guest may have tricked the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest (bnc#1163971).

The following non-security bugs were fixed:

• ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro (bsc#1051510).
• ACPI: watchdog: Fix gas->access_width usage (bsc#1051510).
• ahci: Add support for Amazon's Annapurna Labs SATA controller (bsc#1169013).
• ALSA: ali5451: remove redundant variable capture_flag (bsc#1051510).
• ALSA: core: Add snd_device_get_state() helper (bsc#1051510).
• ALSA: core: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: emu10k1: Fix endianness annotations (bsc#1051510).
• ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard (bsc#1051510).
• ALSA: hda/ca0132 - Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda_codec: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda: default enable CA0132 DSP support (bsc#1051510).
• ALSA: hda: Fix potential access overflow in beep helper (bsc#1051510).
• ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1 (bsc#1111666).
• ALSA: hda/realtek - Add Headset Mic supported (bsc#1111666).
• ALSA: hda/realtek - Add more codec supported Headset Button (bsc#1111666).
• ALSA: hda/realtek - a fake key event is triggered by running shutup (bsc#1051510).
• ALSA: hda/realtek - Apply quirk for MSI GP63, too (bsc#1111666).
• ALSA: hda/realtek - Apply quirk for yet another MSI laptop (bsc#1111666).
• ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662 (git-fixes).
• ALSA: hda/realtek: Enable mute LED on an HP system (bsc#1051510).
• ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662…

The SUSE Linux Enterprise 12 SP5 azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).
• CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).
• CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).
• CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).
• CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).
• CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).
• CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).
• CVE-2020-8647: There was a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).
• CVE-2020-8649: There was a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).
• CVE-2020-9383: An issue was discovered set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it (bnc#1165111).
• CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).
• CVE-2018-20836: Fixed an issue where a race condition in smp_task_timedout() and smp_task_done() could lead to a use-after-free (bnc#1134395).

The following non-security bugs were fixed:

• ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro (bsc#1051510).
• ACPI: watchdog: Fix gas->access_width usage (bsc#1051510).
• ahci: Add support for Amazon's Annapurna Labs SATA controller (bsc#1169013).
• ALSA: ali5451: remove redundant variable capture_flag (bsc#1051510).
• ALSA: core: Add snd_device_get_state() helper (bsc#1051510).
• ALSA: core: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: emu10k1: Fix endianness annotations (bsc#1051510).
• ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard (bsc#1051510).
• ALSA: hda/ca0132 - Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda_codec: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda: default enable CA0132 DSP support (bsc#1051510).
• ALSA: hda: Fix potential access overflow in beep helper (bsc#1051510).
• ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1 (bsc#1111666).
• ALSA: hda/realtek - Add Headset Mic supported (bsc#1111666).
• ALSA: hda/realtek - Add more codec supported Headset Button (bsc#1111666).
• ALSA: hda/realtek - a fake key event is triggered by running shutup (bsc#1051510).
• ALSA: hda/realtek - Apply quirk for MSI GP63, too (bsc#1111666).
• ALSA: hda/realtek - Apply quirk for yet another MSI laptop (bsc#1111666).
• ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662 (git-fixes).
• ALSA: hda/realtek: Enable mute LED on an HP system (bsc#1051510).
• ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662 (git-fixes).
• ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294 (bsc#1111666).
• ALSA: hda/realtek…

The SUSE Linux Enterprise 12 SP4 azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).
• CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).
• CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).
• CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).
• CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).
• CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).
• CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).
• CVE-2020-8647: There was a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).
• CVE-2020-8649: There was a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).
• CVE-2020-9383: An issue was discovered set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it (bnc#1165111).
• CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).

The following non-security bugs were fixed:

• ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro (bsc#1051510).
• ACPI: watchdog: Fix gas->access_width usage (bsc#1051510).
• ALSA: ali5451: remove redundant variable capture_flag (bsc#1051510).
• ALSA: core: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: dummy: Fix PCM format loop in proc output (bsc#1111666).
• ALSA: emu10k1: Fix endianness annotations (bsc#1051510).
• ALSA: hda/ca0132 - Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda_codec: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda: Fix potential access overflow in beep helper (bsc#1051510).
• ALSA: hda/realtek: Fix pop noise on ALC225 (git-fixes).
• ALSA: hda/realtek - Set principled PC Beep configuration for ALC256 (bsc#1051510).
• ALSA: hda: remove redundant assignment to variable timeout (bsc#1051510).
• ALSA: hda: Use scnprintf() for string truncation (bsc#1051510).
• ALSA: hdsp: remove redundant assignment to variable err (bsc#1051510).
• ALSA: ice1724: Fix invalid access for enumerated ctl items (bsc#1051510).
• ALSA: info: remove redundant assignment to variable c (bsc#1051510).
• ALSA: korg1212: fix if-statement empty body warnings (bsc#1051510).
• ALSA: line6: Fix endless MIDI read loop (git-fixes).
• ALSA: pcm: oss: Avoid plugin buffer overflow (git-fixes).
• ALSA: pcm: oss: Fix regression by buffer overflow fix (bsc#1051510).
• ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks (git-fixes).
• ALSA: seq: oss: Fix running status after receiving sysex (git-fixes).
• ALSA: seq: virmidi: Fix running status after receiving sysex (git-fixes).
• ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status (bsc#1051510).
• ALSA: via82xx: Fix endianness annotations (bsc#1051510).
• ASoC: dapm: Correct DAPM handling of active widgets…

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).
• CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).
• CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).
• CVE-2020-8647: Fixed a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).
• CVE-2020-8649: Fixed a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).
• CVE-2020-9383: Fixed an issue in set_fdc in drivers/block/floppy.c, which leads to a wait_til_ready out-of-bounds read (bnc#1165111).
• CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).
• CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).
• CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).
• CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).

The following non-security bugs were fixed:

• ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro (bsc#1051510).
• ACPI: watchdog: Fix gas->access_width usage (bsc#1051510).
• ahci: Add support for Amazon's Annapurna Labs SATA controller (bsc#1169013).
• ALSA: ali5451: remove redundant variable capture_flag (bsc#1051510).
• ALSA: core: Add snd_device_get_state() helper (bsc#1051510).
• ALSA: core: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: emu10k1: Fix endianness annotations (bsc#1051510).
• ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard (bsc#1051510).
• ALSA: hda/ca0132 - Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda_codec: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda: default enable CA0132 DSP support (bsc#1051510).
• ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1 (bsc#1111666).
• ALSA: hda/realtek - Add Headset Mic supported (bsc#1111666).
• ALSA: hda/realtek - Add more codec supported Headset Button (bsc#1111666).
• ALSA: hda/realtek - a fake key event is triggered by running shutup (bsc#1051510).
• ALSA: hda/realtek - Apply quirk for MSI GP63, too (bsc#1111666).
• ALSA: hda/realtek - Apply quirk for yet another MSI laptop (bsc#1111666).
• ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662 (git-fixes).
• ALSA: hda/realtek: Enable mute LED on an HP system (bsc#1051510).
• ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662 (git-fixes).
• ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294 (bsc#1111666).
• ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1 (bsc#1111666).
• ALSA: hda/realtek: Fix pop noise on ALC225 (git-fixes).
• ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master (bsc#1111666).
• ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups (bsc#1051510).
• ALSA: hda/realtek - Set principled PC Beep configuration for ALC256 (bsc#1051510).
• ALSA: hda: remove redundant assignment to variable timeout (bsc#1051510).
• ALSA: hda: Use scnprintf()…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).
• CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).
• CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).
• CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).
• CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).
• CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).
• CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).
• CVE-2020-8647: There was a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).
• CVE-2020-8649: There was a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).
• CVE-2020-9383: An issue was discovered set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it (bnc#1165111).
• CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).

The following non-security bugs were fixed:

• ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro (bsc#1051510).
• ACPI: watchdog: Fix gas->access_width usage (bsc#1051510).
• ALSA: ali5451: remove redundant variable capture_flag (bsc#1051510).
• ALSA: core: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: emu10k1: Fix endianness annotations (bsc#1051510).
• ALSA: hda/ca0132 - Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda_codec: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda: Fix potential access overflow in beep helper (bsc#1051510).
• ALSA: hda/realtek: Fix pop noise on ALC225 (git-fixes).
• ALSA: hda/realtek - Set principled PC Beep configuration for ALC256 (bsc#1051510).
• ALSA: hda: remove redundant assignment to variable timeout (bsc#1051510).
• ALSA: hda: Use scnprintf() for string truncation (bsc#1051510).
• ALSA: hdsp: remove redundant assignment to variable err (bsc#1051510).
• ALSA: ice1724: Fix invalid access for enumerated ctl items (bsc#1051510).
• ALSA: info: remove redundant assignment to variable c (bsc#1051510).
• ALSA: korg1212: fix if-statement empty body warnings (bsc#1051510).
• ALSA: line6: Fix endless MIDI read loop (git-fixes).
• ALSA: pcm: oss: Avoid plugin buffer overflow (git-fixes).
• ALSA: pcm: oss: Fix regression by buffer overflow fix (bsc#1051510).
• ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks (git-fixes).
• ALSA: seq: oss: Fix running status after receiving sysex (git-fixes).
• ALSA: seq: virmidi: Fix running status after receiving sysex (git-fixes).
• ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status (bsc#1051510).
• ALSA: via82xx: Fix endianness annotations (bsc#1051510).
• ASoC: dapm: Correct DAPM handling of active widgets during shutdown (bsc#1051510).
• ASoC: Intel: atom: Take the drv->lock mutex…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).
• CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).
• CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).
• CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).
• CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).
• CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).
• CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).
• CVE-2020-2732: Fixed an issue where under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest (bnc#1163971).
• CVE-2020-8647: There was a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929 1164078).
• CVE-2020-8649: There was a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162929 1162931).
• CVE-2020-9383: An issue was discovered set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it (bnc#1165111).
• CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).
• CVE-2018-20836: Fixed an issue where a race condition in smp_task_timedout() and smp_task_done() cloud lead to a use-after-free (bnc#1134395).

The following non-security bugs were fixed:

• ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro (bsc#1051510).
• ACPI: watchdog: Fix gas->access_width usage (bsc#1051510).
• ahci: Add support for Amazon's Annapurna Labs SATA controller (bsc#1169013).
• ALSA: ali5451: remove redundant variable capture_flag (bsc#1051510).
• ALSA: core: Add snd_device_get_state() helper (bsc#1051510).
• ALSA: core: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: emu10k1: Fix endianness annotations (bsc#1051510).
• ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard (bsc#1051510).
• ALSA: hda/ca0132 - Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda_codec: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda: default enable CA0132 DSP support (bsc#1051510).
• ALSA: hda: Fix potential access overflow in beep helper (bsc#1051510).
• ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1 (bsc#1111666).
• ALSA: hda/realtek - Add Headset Mic supported (bsc#1111666).
• ALSA: hda/realtek - Add more codec supported Headset Button (bsc#1111666).
• ALSA: hda/realtek - a fake key event is triggered by running shutup (bsc#1051510).
• ALSA: hda/realtek - Apply quirk for MSI GP63, too (bsc#1111666).
• ALSA: hda/realtek - Apply quirk for yet another MSI laptop (bsc#1111666).
• ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662 (git-fixes).
• ALSA: hda/realtek: Enable mute LED on an HP…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).
• CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).
• CVE-2020-8647: Fixed a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).
• CVE-2020-8649: Fixed a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).
• CVE-2020-9383: Fixed an issue in set_fdc in drivers/block/floppy.c, which leads to a wait_til_ready out-of-bounds read (bnc#1165111).
• CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).
• CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).
• CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).
• CVE-2020-11609: Fixed a NULL pointer dereference in the stv06xx subsystem caused by mishandling invalid descriptors (bnc#1168854).
• CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).
• CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).
• CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bnc#1170345).
• CVE-2020-11608: Fixed an issue in drivers/media/usb/gspca/ov519.c caused by a NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints (bnc#1168829).
• CVE-2017-18255: The perf_cpu_time_max_percent_handler function in kernel/events/core.c allowed local users to cause a denial of service (integer overflow) or possibly have unspecified other impact via a large value, as demonstrated by an incorrect sample-rate calculation (bnc#1087813).
• CVE-2020-8648: There was a use-after-free vulnerability in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (bnc#1162928).
• CVE-2020-2732: A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest (bnc#1163971).
• CVE-2019-5108: Fixed a denial-of-service vulnerability caused by triggering AP to send IAPP location updates for stations before the required authentication process has completed (bnc#1159912).
• CVE-2020-8992: ext4_protect_reserved_inode in fs/ext4/block_validity.c allowed attackers to cause a denial of service (soft lockup) via a crafted journal size (bnc#1164069).
• CVE-2018-21008: Fixed a use-after-free which could be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c (bnc#1149591).
• CVE-2019-14896: A heap-based buffer overflow vulnerability was found in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP (bnc#1157157).
• CVE-2019-14897: A stack-based buffer overflow was found in Marvell WiFi chip driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary code, when a STA works in IBSS mode (allows connecting stations together without the use of an AP) and connects to…

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).
• CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).
• CVE-2020-8647: Fixed a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).
• CVE-2020-8649: Fixed a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).
• CVE-2020-9383: Fixed an issue in set_fdc in drivers/block/floppy.c, which leads to a wait_til_ready out-of-bounds read (bnc#1165111).
• CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).
• CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).
• CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).
• CVE-2020-11609: Fixed a NULL pointer dereference in the stv06xx subsystem caused by mishandling invalid descriptors (bnc#1168854).
• CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).
• CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).
• CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bnc#1170345).
• CVE-2020-11608: Fixed an issue in drivers/media/usb/gspca/ov519.c caused by a NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints (bnc#1168829).
• CVE-2017-18255: The perf_cpu_time_max_percent_handler function in kernel/events/core.c allowed local users to cause a denial of service (integer overflow) or possibly have unspecified other impact via a large value, as demonstrated by an incorrect sample-rate calculation (bnc#1087813).
• CVE-2020-8648: There was a use-after-free vulnerability in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (bnc#1162928).
• CVE-2020-2732: A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest (bnc#1163971).
• CVE-2019-5108: Fixed a denial-of-service vulnerability caused by triggering AP to send IAPP location updates for stations before the required authentication process has completed (bnc#1159912).
• CVE-2020-8992: ext4_protect_reserved_inode in fs/ext4/block_validity.c allowed attackers to cause a denial of service (soft lockup) via a crafted journal size (bnc#1164069).
• CVE-2018-21008: Fixed a use-after-free which could be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c (bnc#1149591).
• CVE-2019-14896: A heap-based buffer overflow vulnerability was found in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP (bnc#1157157).
• CVE-2019-14897: A stack-based buffer overflow was found in Marvell WiFi chip driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary code, when a STA works in IBSS mode (allows connecting stations together without the use of an AP) and connects to…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bsc#1167629).
• CVE-2020-8647: There was a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bsc#1162929).
• CVE-2020-8649: There was a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bsc#1162931).
• CVE-2020-9383: An issue was discovered set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it (bsc#1165111).
• CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bsc#1159285).
• CVE-2020-11608: Fixed a NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints (bsc#1168829).
• CVE-2020-8648: There was a use-after-free vulnerability in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (bsc#1162928).
• CVE-2019-14896: A heap-based buffer overflow vulnerability was found in Marvell WiFi chip driver. A remote attacker could cause a denial of service or possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP (bsc#1157157).
• CVE-2019-14897: A stack-based buffer overflow was found in the Marvell WiFi chip driver. An attacker is able to cause a denial of service or possibly execute arbitrary code, when a STA works in IBSS mode and connects to another STA (bsc#1157155).
• CVE-2019-18675: Fixed an Integer Overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its own mmap implementation. This allowed local users to obtain read and write permissions on kernel physical pages, which can possibly result in a privilege escalation (bsc#1157804).
• CVE-2019-19965: Fixed a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition (bsc#1159911).
• CVE-2019-19066: A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c allowed attackers to cause a denial of service by triggering bfa_port_get_stats() failures (bsc#1157303).
• CVE-2019-20096: Fixed a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service (bsc#1159908).
• CVE-2019-19966: Fixed a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that will cause denial of service (bsc#1159841).
• CVE-2019-19532: Fixed multiple out-of-bounds write bugs that can be caused by a malicious USB device (bsc#1158824).
• CVE-2019-19523: Fixed a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver (bsc#115882).
• CVE-2019-19537: Fixed a race condition that can be caused by a malicious USB device in the USB character device driver layer (bsc#1158904).
• CVE-2019-19527, CVE-2019-19530, CVE-2019-19524: Fixed multiple use-after-free bug that could be caused by a malicious USB device (bsc#1158381, bsc#1158834, bsc#1158900).
• CVE-2019-15213: Fixed a use-after-free caused by a malicious USB device in the drivers/media/usb/dvb-usb/dvb-usb-init.c driver (bsc#1146544).
• CVE-2019-19531: Fixed a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/yurex.c driver (bsc#1158445).
• CVE-2019-18660: The Linux kernel on powerpc allowed Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs (bsc#1157038).
• CVE-2019-19227: Fixed a potential NULL pointer dereference in the AppleTalk subsystem (bsc#1157678).
• CVE-2019-19074: Fixed a memory leak in the ath9k_wmi_cmd(), which allowed attackers to cause a denial of service (bsc#1157143). -…

The SUSE Linux Enterprise 15 kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).
• CVE-2020-9383: Fixed an out-of-bounds read due to improper error condition check of FDC index (bsc#1165111).
• CVE-2020-8992: Fixed an issue which could have allowed attackers to cause a soft lockup via a crafted journal size (bsc#1164069).
• CVE-2020-8834: Fixed a stack corruption which could have lead to kernel panic (bsc#1168276).
• CVE-2020-8649: Fixed a use-after-free in the vgacon_invert_region function in drivers/video/console/vgacon.c (bsc#1162931).
• CVE-2020-8648: Fixed a use-after-free in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (bsc#1162928).
• CVE-2020-8647: Fixed a use-after-free in the vc_do_resize function in drivers/tty/vt/vt.c (bsc#1162929).
• CVE-2020-8428: Fixed a use-after-free which could have allowed local users to cause a denial of service (bsc#1162109).
• CVE-2020-7053: Fixed a use-after-free in the i915_ppgtt_close function in drivers/gpu/drm/i915/i915_gem_gtt.c (bsc#1160966).
• CVE-2020-2732: Fixed an issue affecting Intel CPUs where an L2 guest may trick the L0 hypervisor into accessing sensitive L1 resources (bsc#1163971).
• CVE-2020-13143: Fixed an out-of-bounds read in gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c (bsc#1171982).
• CVE-2020-12769: Fixed an issue which could have allowed attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one (bsc#1171983).
• CVE-2020-12657: An a use-after-free in block/bfq-iosched.c (bsc#1171205).
• CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).
• CVE-2020-12655: Fixed an issue which could have allowed attackers to trigger a sync of excessive duration via an XFS v5 image with crafted metadata (bsc#1171217).
• CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).
• CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).
• CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).
• CVE-2020-12464: Fixed a use-after-free due to a transfer without a reference (bsc#1170901).
• CVE-2020-12114: Fixed a pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).
• CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).
• CVE-2020-11609: Fixed a null pointer dereference due to improper handling of descriptors (bsc#1168854).
• CVE-2020-11608: Fixed a null pointer dereferences via a crafted USB (bsc#1168829).
• CVE-2020-11494: Fixed an issue which could have allowed attackers to read uninitialized can_frame data (bsc#1168424).
• CVE-2020-10942: Fixed a kernel stack corruption via crafted system calls (bsc#1167629).
• CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).
• CVE-2020-10751: Fixed an improper implementation in SELinux LSM hook where it was assumed that an skb would only contain a single netlink message (bsc#1171189).
• CVE-2020-10732: Fixed kernel data leak in userspace coredumps due to uninitialized data (bsc#1171220).
• CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).
• CVE-2020-10711: Fixed a null pointer…

Al Viro discovered that the Linux kernel for s390x systems did not properly perform page table upgrades for kernel sections that use secondary address mode. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2020-11884)

It was discovered that the Intel Wi-Fi driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-16234)

Tristan Madani discovered that the block I/O tracing implementation in the Linux kernel contained a race condition. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2019-19768)

It was discovered that the vhost net driver in the Linux kernel contained a stack buffer overflow. A local attacker with the ability to perform ioctl() calls on /dev/vhost-net could use this to cause a denial of service (system crash). (CVE-2020-10942)

It was discovered that the virtual terminal implementation in the Linux kernel contained a race condition. A local attacker could possibly use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2020-8648)

Shijie Luo discovered that the ext4 file system implementation in the Linux kernel did not properly check for a too-large journal size. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (soft lockup). (CVE-2020-8992)

Jordy Zomer discovered that the floppy driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2020-9383)

It was discovered that the Intel Wi-Fi driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-16234)

It was discovered that the Intel WiMAX 2400 driver in the Linux kernel did not properly deallocate memory in certain situations. A local attacker could use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19051)

Tristan Madani discovered that the block I/O tracing implementation in the Linux kernel contained a race condition. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2019-19768)

It was discovered that the vhost net driver in the Linux kernel contained a stack buffer overflow. A local attacker with the ability to perform ioctl() calls on /dev/vhost-net could use this to cause a denial of service (system crash). (CVE-2020-10942)

It was discovered that the virtual terminal implementation in the Linux kernel contained a race condition. A local attacker could possibly use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2020-8648)

Shijie Luo discovered that the ext4 file system implementation in the Linux kernel did not properly check for a too-large journal size. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (soft lockup). (CVE-2020-8992)

Jordy Zomer discovered that the floppy driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2020-9383)

Al Viro discovered that the Linux kernel for s390x systems did not properly perform page table upgrades for kernel sections that use secondary address mode. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2020-11884)

It was discovered that the Intel Wi-Fi driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-16234)

Tristan Madani discovered that the block I/O tracing implementation in the Linux kernel contained a race condition. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2019-19768)

It was discovered that the vhost net driver in the Linux kernel contained a stack buffer overflow. A local attacker with the ability to perform ioctl() calls on /dev/vhost-net could use this to cause a denial of service (system crash). (CVE-2020-10942)

It was discovered that the OV51x USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11608)

It was discovered that the STV06XX USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11609)

It was discovered that the Xirlink C-It USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11668)

It was discovered that the virtual terminal implementation in the Linux kernel contained a race condition. A local attacker could possibly use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2020-8648)

Jordy Zomer discovered that the floppy driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2020-9383)

It was discovered that the QLogic Fibre Channel driver in the Linux kernel did not properly check for error, leading to a NULL pointer dereference. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-16233)

It was discovered that the Intel Wi-Fi driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-16234)

Tristan Madani discovered that the block I/O tracing implementation in the Linux kernel contained a race condition. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2019-19768)

It was discovered that the virtual terminal implementation in the Linux kernel contained a race condition. A local attacker could possibly use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2020-8648)

Jordy Zomer discovered that the floppy driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2020-9383)