CVE-2019-1125

An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who successfully exploited the vulnerability could read privileged data across trust boundaries. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to elevate user rights directly, but it could be used to obtain information that could be used to try to compromise the affected system further. On January 3, 2018, Microsoft released an advisory and security updates related to a newly-discovered class of hardware vulnerabilities (known as Spectre) involving speculative execution side channels that affect AMD, ARM, and Intel CPUs to varying degrees. This vulnerability, released on August 6, 2019, is a variant of the Spectre Variant 1 speculative execution side channel vulnerability and has been assigned CVE-2019-1125. Microsoft released a security update on July 9, 2019 that addresses the vulnerability through a software change that mitigates how the CPU speculatively accesses memory. Note that this vulnerability does not require a microcode update from your device OEM.

This kernel update provides an update to the kernel 5.2 series, currently based on 5.2.7 adding support for newer hardware and other new features. It also fixes at least the following security issues:

A Spectre SWAPGS gadget was found in the Linux kernel's implementation of system interrupts. An attacker with local access could use this information to reveal private data through a Spectre like side channel (CVE-2019-1125).

A flaw was found in the Linux kernel’s Bluetooth implementation of UART. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash (CVE-2019-10207).

It also fixes an issue with newer Intel Wireless cards having firmware crashes with newer iwlwifi firmwares (mga#25143)

For other uptstream features, changes and fixes in this update, see the referenced changelogs.

This kernel update is based on the upstream 4.14.137 and fixes at least the following security issues:

A Spectre SWAPGS gadget was found in the Linux kernel's implementation of system interrupts. An attacker with local access could use this information to reveal private data through a Spectre like side channel (CVE-2019-1125).

A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network (CVE-2019-3846).

An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario (CVE-2019-3900).

A flaw was found in the Linux kernel’s Bluetooth implementation of UART. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash (CVE-2019-10207).

WireGuard has been updated to 0.0.20190702.

For other uptstream fixes in this update, see the referenced changelogs.

This kernel-linus update is based on the upstream 5.3.11 and fixes at least the following security issues:

Insufficient access control in a subsystem for Intel (R) processor graphics may allow an authenticated user to potentially enable escalation of privilege via local access (CVE-2019-0155).

A Spectre SWAPGS gadget was found in the Linux kernel's implementation of system interrupts. An attacker with local access could use this information to reveal private data through a Spectre like side channel (CVE-2019-1125).

A flaw was found in the Linux kernel’s Bluetooth implementation of UART. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash (CVE-2019-10207).

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access (CVE-2019-11135).

Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access (CVE-2018-12207).

For proper mitigations and fixes for theese issues, a microcode update is also needed, either with a bios/uefi update from your hardware vendor or by installing the microcode-0.20191112-1.mga7.nonfree update (mga#25688).

There is heap-based buffer overflow in the marvell wifi chip driver that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code (CVE-2019-14814, CVE-2019-14815, CVE-2019-14816).

An out-of-bounds access issue was found in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (CVE-2019-14821).

A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host (CVE-2019-14835).

In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are not initialized (CVE-2019-16714)

rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow (CVE-2019-17666)

For other upstream fixes in this update, see the referenced changelogs.

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-1125: Fix Spectre V1 variant memory disclosure by speculation over the SWAPGS instruction (bsc#1139358).
• CVE-2019-10207: A NULL pointer dereference was possible in the bluetooth stack, which could lead to crashes. (bnc#1123959 bnc#1142857).
• CVE-2018-20855: In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bnc#1143045).
• CVE-2019-14284: drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. (bnc#1143189).
• CVE-2019-14283: set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. (bnc#1143191).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bnc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c (bnc#1142254 bnc#1142265).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bnc#1142023).

The following non-security bugs were fixed:

• 9p: acl: fix uninitialized iattr access (bsc#1051510).
• 9p: p9dirent_read: check network-provided name length (bsc#1051510).
• 9p: pass the correct prototype to read_cache_page (bsc#1051510).
• 9p/rdma: do not disconnect on down_interruptible EAGAIN (bsc#1051510).
• 9p/rdma: remove useless check in cm_event_handler (bsc#1051510).
• 9p/virtio: Add cleanup path in p9_virtio_init (bsc#1051510).
• 9p/xen: Add cleanup path in p9_trans_xen_init (bsc#1051510).
• 9p/xen: fix check for xenbus_read error in front_probe (bsc#1051510).
• acpi/arm64: ignore 5.1 FADTs that are reported as 5.0 (bsc#1051510).
• ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id() (bsc#1051510).
• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• ACPI: PM: Fix regression in acpi_device_set_power() (bsc#1051510).
• Add back sibling paca poiter to paca (bsc#1055117).
• Add support for crct10dif-vpmsum ().
• af_key: fix leaks in key_pol_get_resp and dump_sp (bsc#1051510).
• af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET (networking-stable-19_07_02).
• af_unix: remove redundant lockdep class (git-fixes).
• ALSA: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• ALSA: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• ALSA: compress: Fix regression on compressed capture streams (bsc#1051510).
• ALSA: compress: Prevent bypasses of set_params (bsc#1051510).
• ALSA: hda - Add a conexant codec entry to let mute led work (bsc#1051510).
• ALSA: hda - Do not resume forcibly i915 HDMI/DP codec (bsc#1111666).
• ALSA: hda: Fix 1-minute detection delay when i915 module is not available (bsc#1111666).
• ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips (bsc#1111666).
• ALSA: hda/hdmi - Fix i915 reverse port/pin mapping (bsc#1111666).
• ALSA:…

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-1125: Fix Spectre V1 variant memory disclosure by speculation over the SWAPGS instruction (bsc#1139358).
• CVE-2019-10207: A NULL pointer dereference was possible in the bluetooth stack, which could lead to crashes. (bnc#1123959 bnc#1142857).
• CVE-2018-20855: In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bnc#1143045).
• CVE-2019-14284: drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bnc#1143189).
• CVE-2019-14283: set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bnc#1143191).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bnc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c (bnc#1142254 bnc#1142265).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bnc#1142023).

The following non-security bugs were fixed:

• 9p: acl: fix uninitialized iattr access (bsc#1051510).
• 9p: p9dirent_read: check network-provided name length (bsc#1051510).
• 9p: pass the correct prototype to read_cache_page (bsc#1051510).
• 9p/rdma: do not disconnect on down_interruptible EAGAIN (bsc#1051510).
• 9p/rdma: remove useless check in cm_event_handler (bsc#1051510).
• 9p/virtio: Add cleanup path in p9_virtio_init (bsc#1051510).
• 9p/xen: Add cleanup path in p9_trans_xen_init (bsc#1051510).
• 9p/xen: fix check for xenbus_read error in front_probe (bsc#1051510).
• Abort file_remove_privs() for non-reg. files (bsc#1140888).
• acpi/arm64: ignore 5.1 FADTs that are reported as 5.0 (bsc#1051510).
• acpi/IORT: Fix off-by-one check in iort_dev_find_its_id() (bsc#1051510).
• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• acpi: PM: Allow transitions to D0 to occur in special cases (bsc#1051510).
• acpi: PM: Avoid evaluating _PS3 on transitions from D3hot to D3cold (bsc#1051510).
• acpi: PM: Fix regression in acpi_device_set_power() (bsc#1051510).
• Add back sibling paca poiter to paca (bsc#1055117).
• Add support for crct10dif-vpmsum ().
• af_key: fix leaks in key_pol_get_resp and dump_sp (bsc#1051510).
• af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET (networking-stable-19_07_02).
• af_unix: remove redundant lockdep class (git-fixes).
• ALSA: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• ALSA: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• ALSA: compress: Fix regression on compressed capture streams (bsc#1051510).
• ALSA: compress: Prevent bypasses of set_params (bsc#1051510).
• ALSA: hda - Add a conexant codec entry to let mute led work…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143189).
• CVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143191).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399).
• CVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358).
• CVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045).
• CVE-2015-9289: A buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allowed larger values such as 23 (bsc#1143179).

The following non-security bugs were fixed:

• fix detection of race between fcntl-setlk and close (bsc#1140965).
• ocfs2: add first lock wait time in locking_state (bsc#1134390).
• ocfs2: add last unlock times in locking_state (bsc#1134390).
• ocfs2: add locking filter debugfs file (bsc#1134390).
• powerpc/watchpoint: Restore NV GPRs while returning from exception (bsc#1140945,bsc#1141401,bsc#1141402,bsc#1141452,bsc#1141453,bsc#1141454).
• xen-netfront: use napi_complete() correctly to prevent Rx stalling (bsc#1138744).

The SUSE Linux Enterprise 15 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20855: An issue was discovered in create_qp_common, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace. (bnc#bsc#1103991)
• CVE-2019-1125: Fix Spectre V1 variant via swapgs: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).
• CVE-2019-14284: In the Linux kernel, drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. (bnc#bsc#1143189)
• CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default. (bsc#1143191)
• CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free. (bsc#1134399)
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user can cause a denial of service via a sigreturn() system call that sends a crafted signal frame. (bnc#1142265)
• CVE-2019-13631: In parse_hid_report_descriptor, a malicious usb device could send an hid: report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)

The following non-security bugs were fixed:

• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• acpi: PM: Allow transitions to D0 to occur in special cases (bsc#1051510).
• acpi: PM: Avoid evaluating _PS3 on transitions from D3hot to D3cold (bsc#1051510).
• af_unix: remove redundant lockdep class (git-fixes).
• alsa: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• alsa: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• alsa: compress: Fix regression on compressed capture streams (bsc#1051510).
• alsa: compress: Prevent bypasses of set_params (bsc#1051510).
• alsa: hda - Add a conexant codec entry to let mute led work (bsc#1051510).
• alsa: hda/realtek - Fixed Headphone Mic can't record on Dell platform (bsc#1051510).
• alsa: hda/realtek - Headphone Mic can't record after S3 (bsc#1051510).
• alsa: hda/realtek: apply ALC891 headset fixup to one Dell machine (bsc#1051510).
• alsa: line6: Fix a typo (bsc#1051510).
• alsa: line6: Fix wrong altsetting for LINE6_PODHD500_1 (bsc#1051510).
• alsa: seq: Break too long mutex context in the write loop (bsc#1051510).
• alsa: usb-audio: Add quirk for Focusrite Scarlett Solo (bsc#1051510).
• alsa: usb-audio: Add quirk for MOTU MicroBook II (bsc#1051510).
• alsa: usb-audio: Cleanup DSD whitelist (bsc#1051510).
• alsa: usb-audio: Enable .product_name override for Emagic, Unitor 8 (bsc#1051510).
• alsa: usb-audio: Sanity checks for each pipe and EP types (bsc#1051510).
• asoc : cs4265 : readable register too low (bsc#1051510).
• asoc: cx2072x: fix integer overflow on unsigned int multiply (bsc#1111666).
• asoc: max98090: remove 24-bit format support if RJ is 0 (bsc#1051510).
• asoc: soc-pcm: BE dai needs prepare when pause release after resume (bsc#1051510).
• ath6kl: add some bounds checking (bsc#1051510).
• batman-adv: fix for leaked TVLV handler (bsc#1051510).
• bcache: Add comments for blkdev_put() in registration code path (bsc#1140652).
• bcache: Clean up bch_get_congested() (bsc#1140652).
• bcache: Revert 'bcache: fix high CPU occupancy during journal' (bsc#1140652).
• bcache: Revert 'bcache: free heap cache_set->flush_btree in bch_journal_free' (bsc#1140652).
• bcache: acquire bch_register_lock later in cached_dev_detach_finish() (bsc#1140652).
• bcache: acquire bch_register_lock later in cached_dev_free()…

The SUSE Linux Enterprise 15 SP1 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20855: An issue was discovered in create_qp_common, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace. (bnc#bsc#1103991)
• CVE-2019-1125: Fix Spectre V1 variant via swapgs: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).
• CVE-2019-14284: In the Linux kernel, drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. (bnc#bsc#1143189)
• CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default. (bsc#1143191)
• CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free. (bsc#1134399)
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user can cause a denial of service via a sigreturn() system call that sends a crafted signal frame. (bnc#1142265)
• CVE-2019-13631: In parse_hid_report_descriptor, a malicious usb device could send an hid: report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)
• CVE-2019-10638: In the Linux kernel, a device could be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may have been conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. (bnc#1140575)
• CVE-2019-10639: The Linux kernel allowed Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. (bsc#1140577)
• CVE-2019-13233: In arch/x86/lib/insn-eval.c, there was a use-after-free for access to an LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds violation. (bnc#1140454)
• CVE-2018-20836: In the Linux kernel there was a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free. (bnc#1134395)
• CVE-2019-11599: The coredump implementation in the Linux kernel did not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allowed local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c. (bnc#1133738)
• CVE-2019-12817: Linux kernel for powerpc had a bug where unrelated processes could be able to read/write to one another's virtual memory under certain conditions via an mmap above 512 TB. Only a subset of powerpc systems are affected. (bsc#1138263, bsc#1139619)
• CVE-2019-12614: In dlpar_parse_cc_property there was an unchecked kstrdup of prop->name, which might have allowed an attacker to cause a denial of service (NULL pointer dereference and system crash). (bsc#1137194)
• CVE-2018-16871: An attacker, who was able to mount an exported NFS filesystem, was able to trigger a null pointer dereference by using an invalid NFS sequence. This could panic the machine and deny access to the NFS server. (bsc#1137103)
• CVE-2019-12819: An issue was discovered in the Linux kernel The function…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20855: An issue was discovered in the Linux kernel In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace(bsc#1143045).
• CVE-2019-1125: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).
• CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It could be triggered by an unprivileged local user when a floppy disk was inserted. NOTE: QEMU creates the floppy device by default. (bnc#1143191)
• CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference could occur when megasas_create_frame_pool() failed in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This caused a Denial of Service, related to a use-after-free (bnc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user could cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sent a crafted signal frame. (bnc#1142254)
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel, a malicious USB device could send an HID report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)

The following non-security bugs were fixed:

• Correct the CVE and bug reference for a floppy security fix (CVE-2019-14284,bsc#1143189) A dedicated CVE was already assigned
• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• Add back sibling paca poiter to paca (bsc#1055117).
• Add support for crct10dif-vpmsum ().
• af_unix: remove redundant lockdep class (git-fixes).
• alsa: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• alsa: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• alsa: compress: Fix regression on compressed capture streams (bsc#1051510).
• alsa: compress: Prevent bypasses of set_params (bsc#1051510).
• alsa: hda - Add a conexant codec entry to let mute led work (bsc#1051510).
• alsa: hda - Do not resume forcibly i915 HDMI/DP codec (bsc#1111666).
• alsa: hda - Fix intermittent CORB/RIRB stall on Intel chips (bsc#1111666).
• alsa: hda/hdmi - Fix i915 reverse port/pin mapping (bsc#1111666).
• alsa: hda/hdmi - Remove duplicated define (bsc#1111666).
• alsa: hda - Optimize resume for codecs without jack detection (bsc#1111666).
• alsa: hda/realtek: apply ALC891 headset fixup to one Dell machine (bsc#1051510).
• alsa: hda/realtek - Fixed Headphone Mic can't record on Dell platform (bsc#1051510).
• alsa: hda/realtek - Headphone Mic can't record after S3 (bsc#1051510).
• alsa: line6: Fix a typo (bsc#1051510).
• alsa: line6: Fix wrong altsetting for LINE6_PODHD500_1 (bsc#1051510).
• alsa: seq: Break too long mutex context in the write loop (bsc#1051510).
• alsa: usb-audio: Add quirk for Focusrite Scarlett Solo (bsc#1051510).
• alsa: usb-audio: Add quirk for MOTU MicroBook II (bsc#1051510).
• alsa: usb-audio: Cleanup DSD whitelist (bsc#1051510).
• alsa: usb-audio: Enable .product_name override for Emagic, Unitor 8 (bsc#1051510).
• alsa: usb-audio: fix Line6 Helix audio format rates (bsc#1111666).
• alsa: usb-audio: Sanity checks for each pipe and EP types (bsc#1051510).
• arm64: do not override dma_max_pfn (jsc#SLE-6197 bsc#1140559 LTC#173150).
• asoc : cs4265 : readable register too low (bsc#1051510).
• asoc: max98090: remove 24-bit format support if RJ is 0 (bsc#1051510).
• asoc: soc-pcm: BE dai needs prepare when pause release after resume (bsc#1051510).
• ath10k: add missing error handling (bsc#1111666).
• ath10k: add peer id check in ath10k_peer_find_by_id (bsc#1111666).
• ath10k: destroy…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20855: An issue was discovered in the Linux kernel In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace(bsc#1143045).
• CVE-2019-1125: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).
• CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It could be triggered by an unprivileged local user when a floppy disk was inserted. NOTE: QEMU creates the floppy device by default. (bnc#1143191)
• CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference could occur when megasas_create_frame_pool() failed in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This caused a Denial of Service, related to a use-after-free (bnc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user could cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sent a crafted signal frame. (bnc#1142254)
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel, a malicious USB device could send an HID report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)

The following non-security bugs were fixed:

• Correct the CVE and bug reference for a floppy security fix (CVE-2019-14284,bsc#1143189) A dedicated CVE was already assigned
• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• Add back sibling paca poiter to paca (bsc#1055117).
• Add support for crct10dif-vpmsum ().
• af_unix: remove redundant lockdep class (git-fixes). alsa: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• alsa: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• alsa: compress: Fix regression on compressed capture streams (bsc#1051510).
• alsa: compress: Prevent bypasses of set_params (bsc#1051510).
• alsa: hda - Add a conexant codec entry to let mute led work (bsc#1051510).
• alsa: hda/realtek: apply ALC891 headset fixup to one Dell machine (bsc#1051510).
• alsa: hda/realtek - Fixed Headphone Mic can't record on Dell platform (bsc#1051510).
• alsa: hda/realtek - Headphone Mic can't record after S3 (bsc#1051510).
• alsa: line6: Fix a typo (bsc#1051510).
• alsa: line6: Fix wrong altsetting for LINE6_PODHD500_1 (bsc#1051510).
• alsa: seq: Break too long mutex context in the write loop (bsc#1051510).
• alsa: usb-audio: Add quirk for Focusrite Scarlett Solo (bsc#1051510).
• alsa: usb-audio: Add quirk for MOTU MicroBook II (bsc#1051510).
• alsa: usb-audio: Cleanup DSD whitelist (bsc#1051510).
• alsa: usb-audio: Enable .product_name override for Emagic, Unitor 8 (bsc#1051510).
• alsa: usb-audio: Sanity checks for each pipe and EP types (bsc#1051510).
• asoc : cs4265 : readable register too low (bsc#1051510).
• asoc: max98090: remove 24-bit format support if RJ is 0 (bsc#1051510).
• asoc: soc-pcm: BE dai needs prepare when pause release after resume (bsc#1051510).
• ath6kl: add some bounds checking (bsc#1051510).
• batman-adv: fix for leaked TVLV handler (bsc#1051510).
• bcache: acquire bch_register_lock later in cached_dev_detach_finish() (bsc#1140652).
• bcache: acquire bch_register_lock later in cached_dev_free() (bsc#1140652).
• bcache: add code comments for journal_read_bucket() (bsc#1140652).
• bcache: Add comments for blkdev_put() in registration code path (bsc#1140652).
• bcache: add comments for closure_fn to be called in closure_queue() (bsc#1140652).
• bcache: add comments for kobj release callback routine (bsc#1140652).
• bcache: add comments for mutex_lock(&b->write_lock)…

The SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20855: An issue was discovered in the Linux kernel In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace(bsc#1143045).
• CVE-2019-1125: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).
• CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It could be triggered by an unprivileged local user when a floppy disk was inserted. NOTE: QEMU creates the floppy device by default. (bnc#1143191)
• CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference could occur when megasas_create_frame_pool() failed in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This caused a Denial of Service, related to a use-after-free (bnc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user could cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sent a crafted signal frame. (bnc#1142254)
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel, a malicious USB device could send an HID report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)

The following non-security bugs were fixed:

• Correct the CVE and bug reference for a floppy security fix (CVE-2019-14284,bsc#1143189) A dedicated CVE was already assigned
• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• Add back sibling paca poiter to paca (bsc#1055117).
• Add support for crct10dif-vpmsum ().
• af_unix: remove redundant lockdep class (git-fixes).
• alsa: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• alsa: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• alsa: compress: Fix regression on compressed capture streams (bsc#1051510).
• alsa: compress: Prevent bypasses of set_params (bsc#1051510).
• alsa: hda - Add a conexant codec entry to let mute led work (bsc#1051510).
• alsa: hda/realtek: apply ALC891 headset fixup to one Dell machine (bsc#1051510).
• alsa: hda/realtek - Fixed Headphone Mic can't record on Dell platform (bsc#1051510).
• alsa: hda/realtek - Headphone Mic can't record after S3 (bsc#1051510).
• alsa: line6: Fix a typo (bsc#1051510).
• alsa: line6: Fix wrong altsetting for LINE6_PODHD500_1 (bsc#1051510).
• alsa: seq: Break too long mutex context in the write loop (bsc#1051510).
• alsa: usb-audio: Add quirk for Focusrite Scarlett Solo (bsc#1051510).
• alsa: usb-audio: Add quirk for MOTU MicroBook II (bsc#1051510).
• alsa: usb-audio: Cleanup DSD whitelist (bsc#1051510).
• alsa: usb-audio: Enable .product_name override for Emagic, Unitor 8 (bsc#1051510).
• alsa: usb-audio: Sanity checks for each pipe and EP types (bsc#1051510).
• asoc : cs4265 : readable register too low (bsc#1051510).
• asoc: max98090: remove 24-bit format support if RJ is 0 (bsc#1051510).
• asoc: soc-pcm: BE dai needs prepare when pause release after resume (bsc#1051510).
• ath6kl: add some bounds checking (bsc#1051510).
• batman-adv: fix for leaked TVLV handler (bsc#1051510).
• bcache: acquire bch_register_lock later in cached_dev_detach_finish() (bsc#1140652).
• bcache: acquire bch_register_lock later in cached_dev_free() (bsc#1140652).
• bcache: add code comments for journal_read_bucket() (bsc#1140652).
• bcache: Add comments for blkdev_put() in registration code path (bsc#1140652).
• bcache: add comments for closure_fn to be called in closure_queue() (bsc#1140652).
• bcache: add comments for kobj release callback routine (bsc#1140652).
• bcache: add comments for mutex_lock(&b->write_lock)…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20855: An issue was discovered in the Linux kernel In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace(bsc#1143045).
• CVE-2019-1125: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).
• CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It could be triggered by an unprivileged local user when a floppy disk was inserted. NOTE: QEMU creates the floppy device by default. (bnc#1143191)
• CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference could occur when megasas_create_frame_pool() failed in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This caused a Denial of Service, related to a use-after-free (bnc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user could cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sent a crafted signal frame. (bnc#1142254)
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel, a malicious USB device could send an HID report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)

The following non-security bugs were fixed:

• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• Add back sibling paca poiter to paca (bsc#1055117).
• Add support for crct10dif-vpmsum ().
• af_unix: remove redundant lockdep class (git-fixes).
• alsa: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• alsa: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• alsa: compress: Fix regression on compressed capture streams (bsc#1051510).
• alsa: compress: Prevent bypasses of set_params (bsc#1051510).
• alsa: hda - Add a conexant codec entry to let mute led work (bsc#1051510).
• alsa: hda - Do not resume forcibly i915 HDMI/DP codec (bsc#1111666).
• alsa: hda - Fix intermittent CORB/RIRB stall on Intel chips (bsc#1111666).
• alsa: hda/hdmi - Fix i915 reverse port/pin mapping (bsc#1111666).
• alsa: hda/hdmi - Remove duplicated define (bsc#1111666).
• alsa: hda - Optimize resume for codecs without jack detection (bsc#1111666).
• alsa: hda/realtek: apply ALC891 headset fixup to one Dell machine (bsc#1051510).
• alsa: hda/realtek - Fixed Headphone Mic can't record on Dell platform (bsc#1051510).
• alsa: hda/realtek - Headphone Mic can't record after S3 (bsc#1051510).
• alsa: line6: Fix a typo (bsc#1051510).
• alsa: line6: Fix wrong altsetting for LINE6_PODHD500_1 (bsc#1051510).
• alsa: seq: Break too long mutex context in the write loop (bsc#1051510).
• alsa: usb-audio: Add quirk for Focusrite Scarlett Solo (bsc#1051510).
• alsa: usb-audio: Add quirk for MOTU MicroBook II (bsc#1051510).
• alsa: usb-audio: Cleanup DSD whitelist (bsc#1051510).
• alsa: usb-audio: Enable .product_name override for Emagic, Unitor 8 (bsc#1051510).
• alsa: usb-audio: fix Line6 Helix audio format rates (bsc#1111666).
• alsa: usb-audio: Sanity checks for each pipe and EP types (bsc#1051510).
• arm64: do not override dma_max_pfn (jsc#SLE-6197 bsc#1140559 LTC#173150).
• asoc : cs4265 : readable register too low (bsc#1051510).
• asoc: max98090: remove 24-bit format support if RJ is 0 (bsc#1051510).
• asoc: soc-pcm: BE dai needs prepare when pause release after resume (bsc#1051510).
• ath10k: add missing error handling (bsc#1111666).
• ath10k: add peer id check in ath10k_peer_find_by_id (bsc#1111666).
• ath10k: destroy sdio workqueue while remove sdio module (bsc#1111666).
• ath10k: Do not send probe response template for mesh (bsc#1111666). -…

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358).
• CVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045).
• CVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143189).
• CVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143191).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c (bnc#1142254).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023).

The following non-security bugs were fixed:

• bcache: Revert 'bcache: fix high CPU occupancy during journal' (bsc#1140652, bsc#1144288).
• bcache: Revert 'bcache: free heap cache_set->flush_btree in bch_journal_free' (bsc#1140652, bsc#1144288).
• bcache: add reclaimed_journal_buckets to struct cache_set (bsc#1140652, bsc#1144288).
• bcache: fix race in btree_flush_write() (bsc#1140652, bsc#1144288).
• bcache: fix stack corruption by PRECEDING_KEY() (bsc#1130972, bsc#1144257).
• bcache: only set BCACHE_DEV_WB_RUNNING when cached device attached (bsc#1130972, bsc#1144273).
• bcache: performance improvement for btree_flush_write() (bsc#1140652, bsc#1144288).
• bcache: remove retry_flush_write from struct cache_set (bsc#1140652, bsc#1144288).
• mm: check VMA flags to avoid invalid PROT_NONE NUMA balancing (bsc#1142098).
• powerpc/watchpoint: Restore NV GPRs while returning from exception (bsc#1140945, bsc#1141401, bsc#1141402, bsc#1141452, bsc#1141453, bsc#1141454).
• xen-netfront: use napi_complete() correctly to prevent Rx stalling (bsc#1138744).

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358).
• CVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045).
• CVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143189).
• CVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143191).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c (bnc#1142254).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023).
• CVE-2019-15118: Fixed kernel stack exhaustion in check_input_term in sound/usb/mixer.c via mishandled recursion (bnc#1145922).
• CVE-2019-15117: Fixed out-of-bounds memory access in parse_audio_mixer_unit in sound/usb/mixer.c via mishandled short descriptor (bnc#1145920).
• CVE-2019-3819: A flaw was fixed in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may have enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') could have caused a system lock up and a denial of service (bnc#1123161).
• CVE-2019-10207: Check for missing tty operations in bluetooth/hci_uart (bsc#1142857).
• CVE-2018-20856: Fixed a use-after-free issue in block/blk-core.c, where certain error case are mishandled (bnc#1143048).

The following non-security bugs were fixed:

• cifs: do not log STATUS_NOT_FOUND errors for DFS (bsc#1125674).
• dlm: Fix saving of NULL callbacks (bsc#1135365).
• bcache: Revert 'bcache: fix high CPU occupancy during journal' (bsc#1140652, bsc#1144288).
• bcache: Revert 'bcache: free heap cache_set->flush_btree in bch_journal_free' (bsc#1140652, bsc#1144288).
• bcache: add reclaimed_journal_buckets to struct cache_set (bsc#1140652, bsc#1144288).
• bcache: fix race in btree_flush_write() (bsc#1140652, bsc#1144288).
• bcache: fix stack corruption by PRECEDING_KEY() (bsc#1130972, bsc#1144257).
• bcache: only set BCACHE_DEV_WB_RUNNING when cached device attached (bsc#1130972, bsc#1144273).
• bcache: performance improvement for btree_flush_write() (bsc#1140652, bsc#1144288).
• bcache: remove retry_flush_write from struct cache_set (bsc#1140652, bsc#1144288).
• bonding: Force slave speed check after link state recovery for 802.3ad (bsc#1137584).
• clocksource: Defer override invalidation unless clock is unstable (bsc#1139826).
• kvm: mmu: Fix overflow on kvm mmu page limit calculation (bsc#1135335).
• kvmclock: fix TSC calibration for nested guests (bsc#1133860,…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-3819: A flaw was fixed in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may have enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') could have caused a system lock up and a denial of service (bnc#1123161).
• CVE-2019-15118: Fixed kernel stack exhaustion in check_input_term in sound/usb/mixer.c via mishandled recursion (bnc#1145922).
• CVE-2019-15117: Fixed out-of-bounds memory access in parse_audio_mixer_unit in sound/usb/mixer.c via mishandled short descriptor (bnc#1145920).
• CVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143189).
• CVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143191).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399).
• CVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358).
• CVE-2019-10207: Check for missing tty operations in bluetooth/hci_uart (bsc#1142857).
• CVE-2018-20856: Fixed a use-after-free issue in block/blk-core.c, where certain error case are mishandled (bnc#1143048).
• CVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045).
• CVE-2017-18551: An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel There was an out of bounds write in the function i2c_smbus_xfer_emulated (bnc#1146163).

The following non-security bugs were fixed:

• bcache: add reclaimed_journal_buckets to struct cache_set (bsc#1140652, bsc#1144288).
• bcache: fix race in btree_flush_write() (bsc#1140652, bsc#1144288).
• bcache: fix stack corruption by PRECEDING_KEY() (bsc#1130972, bsc#1144257).
• bcache: only set BCACHE_DEV_WB_RUNNING when cached device attached (bsc#1130972, bsc#1144273).
• bcache: performance improvement for btree_flush_write() (bsc#1140652, bsc#1144288).
• bcache: remove retry_flush_write from struct cache_set (bsc#1140652, bsc#1144288).
• btrfs: improve delayed refs iterations (bsc#1076033, bsc#1107256).
• i40e: add functions to control default VSI (bsc#1141628).
• i40e: set default VSI without a reset (bsc#1141628).
• mm: check VMA flags to avoid invalid PROT_NONE NUMA balancing (bsc#1142098).
• nfs: Fix the inode request accounting when pages have subrequests (bsc#1140012).
• powerpc/watchpoint: Restore NV GPRs while returning from exception (bsc#1140945,bsc#1141401,bsc#1141402,bsc#1141452,bsc#1141453,bsc#1141454).
• qib/hfi1: Fix MR reference count leak on write with immediate (bsc#1045640).
• sched/fair: Do not free p->numa_faults with concurrent readers (bsc#1144920).
• sched/fair: Use RCU accessors consistently for ->numa_group (bsc#1144920).
• x86, mm: fix fast GUP with hyper-based TLB flushing (VM Functionality,…

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-12126 CVE-2018-12127 CVE-2018-12130: Microarchitectural Store Buffer Data Sampling (MSBDS): Stored buffers on some microprocessors utilizing speculative execution which may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019. (bsc#1103186)
• CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019. (bsc#1111331)
• CVE-2019-12382: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel There was an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). (bsc#1136586)
• CVE-2019-10124: An issue was discovered in the hwpoison implementation in mm/memory-failure.c in the Linux kernel. When soft_offline_in_use_page() runs on a thp tail page after pmd is split, an attacker could cause a denial of service (bsc#1130699).
• CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel has multiple race conditions. (bsc#1133188)
• CVE-2019-11811: An issue was discovered in the Linux kernel There was a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module was removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c. (bsc#1134397)
• CVE-2019-11487: The Linux kernel allowed page reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It could occur with FUSE requests. (bsc#1133190)
• CVE-2019-12818: The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This used to affect nfc_llcp_build_gb in net/nfc/llcp_core.c. (bsc#1138293)
• CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. (bsc#1135281)
• CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux kernel allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. (bsc#1120843)
• CVE-2018-7191: In the tun subsystem in the Linux kernel, dev_get_valid_name was not called before register_netdevice. This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. (bsc#1135603)
• CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel allowed a local user to obtain potentially sensitive information from kernel stack memory via a hidPCONNADD command, because a name field may not end with a '\0' character. (bsc#1134848) -…

The SUSE Linux Enterprise Server 12 SP4 Realtime Kernel was updated to fix bugs and security issues.

Security issues fixed:

• CVE-2019-12614: An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c. There was an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash) (bnc#1137194).
• CVE-2018-16871: A NULL pointer dereference due to an anomalized NFS message sequence was fixed. (bnc#1137103).
• CVE-2018-20836: There was a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free (bnc#1134395).
• CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network (bnc#1136424).
• CVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399).
• CVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143191).
• CVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143189).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023).
• CVE-2019-1125: Enable Spectre v1 mitigations for SWAPGS (bsc#1139358).
• CVE-2019-10126: A flaw was found in the Linux kernel that might lead to memory corruption in the marvell mwifiex driver. (bnc#1136935)
• CVE-2019-10638: In the Linux kernel, a device could be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. (bnc#1140575)
• CVE-2019-10639: The Linux kernel allowed Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it was possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key was extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server.…

It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-10126)

Andrei Vlad Lutas and Dan Lutas discovered that some x86 processors incorrectly handle SWAPGS instructions during speculative execution. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2019-1125)

It was discovered that the PowerPC dlpar implementation in the Linux kernel did not properly check for allocation errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-12614)

It was discovered that a NULL pointer dereference vulnerability existed in the Near-field communication (NFC) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-12984)

Jann Horn discovered a use-after-free vulnerability in the Linux kernel when accessing LDT entries in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-13233)

Jann Horn discovered that the ptrace implementation in the Linux kernel did not properly record credentials in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly gain administrative privileges. (CVE-2019-13272)

It was discovered that the Marvell Wireless LAN device driver in the Linux kernel did not properly validate the BSS descriptor. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-3846)

It was discovered that the alarmtimer implementation in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service. (CVE-2018-13053)

Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly track inode validations. An attacker could use this to construct a malicious XFS image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13093)

Wen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100, CVE-2018-14614, CVE-2018-14616, CVE-2018-13096, CVE-2018-13098, CVE-2018-14615)

Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613, CVE-2018-14609)

Wen Xu discovered that the HFS+ filesystem implementation in the Linux kernel did not properly handle malformed catalog data in some situations. An attacker could use this to construct a malicious HFS+ image that, when mounted, could cause a denial of service (system crash). (CVE-2018-14617)

Vasily Averin and Pavel Tikhomirov discovered that the cleancache subsystem of the Linux kernel did not properly initialize new files in some situations. A local attacker could use this to expose sensitive information. (CVE-2018-16862)

Hui Peng and Mathias Payer discovered that the USB subsystem in the Linux kernel did not properly handle size checks when handling an extra USB descriptor. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-20169)

It was discovered that a use-after-free error existed in the block layer subsystem of the Linux kernel when certain failure conditions occurred. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-20856)

Eli Biham and Lior Neumann discovered that the Bluetooth implementation in the Linux kernel did not properly validate elliptic curve parameters during Diffie-Hellman key exchange in some situations. An attacker could use this to expose sensitive information. (CVE-2018-5383)

It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-10126)

Andrei Vlad Lutas and Dan Lutas discovered that some x86 processors incorrectly handle SWAPGS instructions during speculative execution. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2019-1125)

It was discovered that the PowerPC dlpar implementation in the Linux kernel did not properly check for allocation errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-12614)

It was discovered that a NULL pointer dereference vulnerabilty existed in the Near-field communication (NFC) implementation in the Linux kernel. An attacker could use this to cause a denial of service (system crash). (CVE-2019-12818)

It was discovered that the MDIO bus devices subsystem in the Linux kernel improperly dropped a device reference in an error condition, leading to a use-after-free. An attacker could use this to cause a denial of service (system crash). (CVE-2019-12819)

It was discovered that a NULL pointer dereference vulnerability existed in the Near-field communication (NFC) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-12984)

Jann…

Eli Biham and Lior Neumann discovered that the Bluetooth implementation in the Linux kernel did not properly validate elliptic curve parameters during Diffie-Hellman key exchange in some situations. An attacker could use this to expose sensitive information. (CVE-2018-5383)

It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-10126)

Andrei Vlad Lutas and Dan Lutas discovered that some x86 processors incorrectly handle SWAPGS instructions during speculative execution. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2019-1125)

Jann Horn discovered that a race condition existed in the Linux kernel when performing core dumps. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2019-11599)

It was discovered that the PowerPC dlpar implementation in the Linux kernel did not properly check for allocation errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-12614)

Jann Horn discovered that the ptrace implementation in the Linux kernel did not properly record credentials in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly gain administrative privileges. (CVE-2019-13272)

It was discovered that the Marvell Wireless LAN device driver in the Linux kernel did not properly validate the BSS descriptor. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-3846)

USN-4095-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 ESM.

Eli Biham and Lior Neumann discovered that the Bluetooth implementation in the Linux kernel did not properly validate elliptic curve parameters during Diffie-Hellman key exchange in some situations. An attacker could use this to expose sensitive information. (CVE-2018-5383)

It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-10126)

Andrei Vlad Lutas and Dan Lutas discovered that some x86 processors incorrectly handle SWAPGS instructions during speculative execution. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2019-1125)

It was discovered that the ext4 file system implementation in the Linux kernel did not properly zero out memory in some situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2019-11833)

It was discovered that the PowerPC dlpar implementation in the Linux kernel did not properly check for allocation errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-12614)

It was discovered that the Linux kernel on ARM processors allowed a tracing process to modify a syscall after a seccomp decision had been made on that syscall. A local attacker could possibly use this to bypass seccomp restrictions. (CVE-2019-2054)

It was discovered that the Marvell Wireless LAN device driver in the Linux kernel did not properly validate the BSS descriptor. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-3846)

Andrei Vlad Lutas and Dan Lutas discovered that some x86 processors incorrectly handle SWAPGS instructions during speculative execution. A local attacker could use this to expose sensitive information (kernel memory).