CVE-2017-18249

The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid, which allows local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.136 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356).
• CVE-2017-18249: The add_free_nid function did not properly track an allocated nid, which allowed local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads (bnc#1087036).
• CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086).
• CVE-2017-18241: Prevent a NULL pointer dereference by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure (bnc#1086400).
• CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read (bnc#1073311).
• CVE-2018-12233: In the ea_get function in fs/jfs/xattr.c, a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr (bnc#1097234).

The following non-security bugs were fixed:

• 8139too: Use disable_irq_nosync() in rtl8139_poll_controller() (bnc#1012382).
• ACPI: acpi_pad: Fix memory leak in power saving threads (bnc#1012382).
• ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c (bnc#1012382).
• ACPICA: Events: add a return on failure from acpi_hw_register_read (bnc#1012382).
• ACPI: processor_perflib: Do not send _PPC change notification if not ready (bnc#1012382).
• affs_lookup(): close a race with affs_remove_link() (bnc#1012382).
• af_key: Always verify length of provided sadb_key (bnc#1012382).
• aio: fix io_destroy(2) vs. lookup_ioctx() race (bnc#1012382).
• alsa: control: fix a redundant-copy issue (bnc#1012382).
• alsa: hda: Add Lenovo C50 All in one to the power_save blacklist (bnc#1012382).
• alsa: hda - Use IS_REACHABLE() for dependency on input (bnc#1012382 bsc#1031717).
• alsa: timer: Call notifier in the same spinlock (bnc#1012382 bsc#973378).
• alsa: timer: Fix pause event notification (bnc#1012382 bsc#973378).
• alsa: usb: mixer: volume quirk for CM102-A+/102S+ (bnc#1012382).
• alsa: vmaster: Propagate slave error (bnc#1012382).
• arc: Fix malformed ARC_EMUL_UNALIGNED default (bnc#1012382).
• arm64: Add ARCH_WORKAROUND_2 probing (bsc#1085308).
• arm64: Add per-cpu infrastructure to call ARCH_WORKAROUND_2 (bsc#1085308).
• arm64: Add 'ssbd' command-line option (bsc#1085308).
• arm64: Add this_cpu_ptr() assembler macro for use in entry.S (bsc#1085308).
• arm64: Add work around for Arm Cortex-A55 Erratum 1024718 (bnc#1012382).
• arm64: alternatives: Add dynamic patching feature (bsc#1085308).
• arm64: assembler: introduce ldr_this_cpu (bsc#1085308).
• arm64: Call ARCH_WORKAROUND_2 on transitions between EL0 and EL1 (bsc#1085308).
• arm64: do not call C code with el0's fp register (bsc#1085308).
• arm64: fix endianness annotation for __apply_alternatives()/get_alt_insn() (bsc#1085308).
• arm64: introduce mov_q macro to move a constant into a 64-bit register (bnc#1012382 bsc#1068032).
• arm64: lse: Add early clobbers to some input/output asm operands (bnc#1012382).
• arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics (bnc#1012382).
• arm64: ssbd: Add global mitigation state accessor (bsc#1085308).
• arm64: ssbd: Add prctl interface for per-thread mitigation (bsc#1085308).
• arm64: ssbd: Introduce thread flag to control…

The SUSE Linux Enterprise 12 SP3 RT kernel was updated to 4.4.138 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-12233: A memory corruption bug in JFS could have been triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability could be triggered by an unprivileged user with the ability to create files and execute programs (bsc#1097234)
• CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086)
• CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356)
• CVE-2017-18249: The add_free_nid function did not properly track an allocated nid, which allowed local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads (bnc#1087036)
• CVE-2017-18241: Prevent a NULL pointer dereference by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure (bnc#1086400)
• CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read (bnc#1073311)
• CVE-2018-3639: Systems with microprocessors utilizing speculative execution and speculative execution of memory reads the addresses of all prior memory writes are known may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4 (bsc#1087082).
• CVE-2018-8781: The udl_fb_mmap function had an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bsc#1090643).
• CVE-2017-13305: Prevent information disclosure vulnerability in encrypted-keys (bsc#1094353)
• CVE-2018-1093: The ext4_valid_block_bitmap function allowed attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers (bsc#1087095)
• CVE-2018-1094: The ext4_fill_super function did not always initialize the crc32c checksum driver, which allowed attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (bsc#1087007)
• CVE-2018-1092: The ext4_iget function mishandled the case of a root directory with a zero i_links_count, which allowed attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (bsc#1087012)
• CVE-2018-1130: NULL pointer dereference in dccp_write_xmit() function that allowed a local user to cause a denial of service by a number of certain crafted system calls (bsc#1092904)
• CVE-2018-5803: Prevent error in the '_sctp_make_chunk()' function when handling SCTP packets length that could have been exploited to cause a kernel crash (bnc#1083900)
• CVE-2018-1065: The netfilter subsystem mishandled the case of a rule blob that contains a jump but lacks a user-defined chain, which allowed local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability (bsc#1083650)
• CVE-2018-7492: Prevent NULL pointer dereference in the net/rds/rdma.c __rds_rdma_map() function that allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bsc#1082962)
• CVE-2018-1000199: Prevent vulnerability in modify_user_hw_breakpoint() that …

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356)
• CVE-2018-1000204: Prevent infoleak caused by incorrect handling of the SG_IO ioctl (bsc#1096728).
• CVE-2017-18249: The add_free_nid function did not properly track an allocated nid, which allowed local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads (bnc#1087036)
• CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086)
• CVE-2017-18241: Prevent a NULL pointer dereference by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure (bnc#1086400)
• CVE-2017-13305: Prevent information disclosure vulnerability in encrypted-keys (bsc#1094353).
• CVE-2018-1093: The ext4_valid_block_bitmap function allowed attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c did not validate bitmap block numbers (bsc#1087095).
• CVE-2018-1094: The ext4_fill_super function did not always initialize the crc32c checksum driver, which allowed attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (bsc#1087007).
• CVE-2018-1092: The ext4_iget function mishandled the case of a root directory with a zero i_links_count, which allowed attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (bsc#1087012).
• CVE-2018-1130: NULL pointer dereference in dccp_write_xmit() function that allowed a local user to cause a denial of service by a number of certain crafted system calls (bsc#1092904).
• CVE-2018-1065: The netfilter subsystem mishandled the case of a rule blob that contains a jump but lacks a user-defined chain, which allowed local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability (bsc#1083650).
• CVE-2018-5803: Prevent error in the '_sctp_make_chunk()' function when handling SCTP packets length that could have been exploited to cause a kernel crash (bnc#1083900).
• CVE-2018-7492: Prevent NULL pointer dereference in the net/rds/rdma.c __rds_rdma_map() function that allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bsc#1082962).
• CVE-2018-1000199: Prevent vulnerability in modify_user_hw_breakpoint() that could have caused a crash and possibly memory corruption (bsc#1089895).

The following non-security bugs were fixed:

• ALSA: timer: Fix pause event notification (bsc#973378).
• Fix excessive newline in /proc/*/status (bsc#1094823).
• Fix the patch content (bsc#1085185)
• KVM: x86: Sync back MSR_IA32_SPEC_CTRL to VCPU data structure (bsc#1096242, bsc#1096281).
• Revert 'bs-upload-kernel: do not set %opensuse_bs' This reverts commit e89e2b8cbef05df6c874ba70af3cb4c57f82a821.
• ipv6: add mtu lock check in __ip6_rt_update_pmtu (bsc#1092552).
• ipv6: omit traffic class when calculating flow hash (bsc#1095042).
• kgraft/bnx2fc: Do not block kGraft in bnx2fc_l2_rcv kthread (bsc#1094033).
• mm, page_alloc: do not break __GFP_THISNODE by zonelist reset (bsc#1079152, VM Functionality).
• x86/boot: Fix early command-line parsing when partial word matches (bsc#1096140).
• x86/bugs: IBRS: make runtime disabling fully dynamic (bsc#1096281).
• x86/bugs: Respect retpoline command line option (bsc#1068032).
• x86/bugs: correctly force-disable…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356)
• CVE-2018-1000204: Prevent infoleak caused by incorrect handling of the SG_IO ioctl (bsc#1096728).
• CVE-2017-18249: The add_free_nid function did not properly track an allocated nid, which allowed local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads (bnc#1087036)
• CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086)
• CVE-2017-18241: Prevent a NULL pointer dereference by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure (bnc#1086400)
• CVE-2017-13305: Prevent information disclosure vulnerability in encrypted-keys (bsc#1094353).
• CVE-2018-1093: The ext4_valid_block_bitmap function allowed attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c did not validate bitmap block numbers (bsc#1087095).
• CVE-2018-1094: The ext4_fill_super function did not always initialize the crc32c checksum driver, which allowed attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (bsc#1087007).
• CVE-2018-1092: The ext4_iget function mishandled the case of a root directory with a zero i_links_count, which allowed attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (bsc#1087012).
• CVE-2018-1130: NULL pointer dereference in dccp_write_xmit() function that allowed a local user to cause a denial of service by a number of certain crafted system calls (bsc#1092904).
• CVE-2018-1065: The netfilter subsystem mishandled the case of a rule blob that contains a jump but lacks a user-defined chain, which allowed local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability (bsc#1083650).
• CVE-2018-5803: Prevent error in the '_sctp_make_chunk()' function when handling SCTP packets length that could have been exploited to cause a kernel crash (bnc#1083900).
• CVE-2018-7492: Prevent NULL pointer dereference in the net/rds/rdma.c __rds_rdma_map() function that allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bsc#1082962).
• CVE-2018-1000199: Prevent vulnerability in modify_user_hw_breakpoint() that could have caused a crash and possibly memory corruption (bsc#1089895).

The following non-security bugs were fixed:

• ALSA: timer: Fix pause event notification (bsc#973378).
• Fix excessive newline in /proc/*/status (bsc#1094823).
• Fix the patch content (bsc#1085185)
• KVM: x86: Sync back MSR_IA32_SPEC_CTRL to VCPU data structure (bsc#1096242, bsc#1096281).
• Revert 'bs-upload-kernel: do not set %opensuse_bs' This reverts commit e89e2b8cbef05df6c874ba70af3cb4c57f82a821.
• ipv6: add mtu lock check in __ip6_rt_update_pmtu (bsc#1092552).
• ipv6: omit traffic class when calculating flow hash (bsc#1095042).
• kgraft/bnx2fc: Do not block kGraft in bnx2fc_l2_rcv kthread (bsc#1094033).
• mm, page_alloc: do not break __GFP_THISNODE by zonelist reset (bsc#1079152, VM Functionality).
• x86/boot: Fix early command-line parsing when partial word matches (bsc#1096140).
• x86/bugs: IBRS: make runtime disabling fully dynamic (bsc#1096281).
• x86/bugs: Respect retpoline command line option (bsc#1068032).
• x86/bugs: correctly force-disable…

The SUSE Linux Enterprise 12 realtime kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-18249: Fixed tracking on allocated nid in the add_free_nid function fs/f2fs/node.c, which previously allowed local users to cause a denial of service (bnc#1087036).
• CVE-2019-3459: Fixed remote heap address information leak in use of l2cap_get_conf_opt (bnc#1120758).
• CVE-2019-3460: Fixed remote data leak in multiple location in the function l2cap_parse_conf_rsp (bnc#1120758).

The following non-security bugs were fixed:

• Disable MSI also when pcie-octeon.pcie_disable on (bnc#1012382).
• Fix problem with sharetransport= and NFSv4 (bsc#1114893).
• Revert 'bs-upload-kernel: do not set %opensuse_bs' This reverts commit e89e2b8cbef05df6c874ba70af3cb4c57f82a821.
• Yama: Check for pid death before checking ancestry (bnc#1012382).
• acpi / processor: Fix the return value of acpi_processor_ids_walk() (git fixes (acpi)).
• acpi/nfit: Block function zero DSMs (bsc#1123321).
• acpi/nfit: Fix command-supported detection (bsc#1123323).
• acpi: power: Skip duplicate power resource references in _PRx (bnc#1012382).
• alsa: bebob: fix model-id of unit for Apogee Ensemble (bnc#1012382).
• alsa: hda/realtek - Disable headset Mic VREF for headset mode of ALC225 (bnc#1012382).
• arm64/kvm: consistently handle host HCR_EL2 flags (bnc#1012382).
• arm64: Do not trap host pointer auth use to EL2 (bnc#1012382).
• arm64: perf: set suppress_bind_attrs flag to true (bnc#1012382).
• ata: Fix racy link clearance (bsc#1107866).
• block/loop: Use global lock for ioctl() operation (bnc#1012382).
• block/swim3: Fix -EBUSY error when re-opening device after unmount (Git-fixes).
• Btrfs: tree-check: reduce stack consumption in check_dir_item (bnc#1012382).
• Btrfs: tree-checker: Check level for leaves and nodes (bnc#1012382).
• Btrfs: tree-checker: Do not check max block group size as current max chunk size limit is unreliable (fixes for bnc#1012382 bsc#1102875 bsc#1102877 bsc#1102879 bsc#1102882 bsc#1102896).
• Btrfs: tree-checker: Fix misleading group system information (bnc#1012382).
• Btrfs: validate type when reading a chunk (bnc#1012382).
• Btrfs: wait on ordered extents on abort cleanup (bnc#1012382).
• can: gw: ensure DLC boundaries after CAN frame modification (bnc#1012382).
• cifs: Do not hide EINTR after sending network packets (bnc#1012382).
• cifs: Fix potential OOB access of lock element array (bnc#1012382).
• clk: imx6q: reset exclusive gates on init (bnc#1012382).
• crypto: authenc - fix parsing key with misaligned rta_len (bnc#1012382).
• crypto: authencesn - Avoid twice completion call in decrypt path (bnc#1012382).
• crypto: cts - fix crash on short inputs (bnc#1012382).
• crypto: user - support incremental algorithm dumps (bsc#1120902).
• dm crypt: add cryptographic data integrity protection (authenticated encryption) (Git-fixes).
• dm crypt: factor IV constructor out to separate function (Git-fixes).
• dm crypt: fix crash by adding missing check for auth key size (git-fixes).
• dm crypt: fix error return code in crypt_ctr() (git-fixes).
• dm crypt: fix memory leak in crypt_ctr_cipher_old() (git-fixes).
• dm crypt: introduce new format of cipher with 'capi:' prefix (Git-fixes).
• dm crypt: wipe kernel key copy after IV initialization (Git-fixes).
• dm kcopyd: Fix bug causing workqueue stalls (bnc#1012382).
• dm snapshot: Fix excessive memory usage and workqueue stalls (bnc#1012382).
• dm: do not allow readahead to limit IO size (git fixes (readahead)).
• e1000e: allow non-monotonic SYSTIM readings (bnc#1012382).
• edac: Raise the maximum number of memory controllers (bsc#1120722).
• efi/libstub/arm64: Use hidden attribute for struct screen_info reference (bsc#1122650).
• ext4: Fix crash during online resizing (bsc#1122779).
• ext4: fix a potential fiemap/page fault deadlock w/ inline_data (bnc#1012382).
• f2fs: Add sanity_check_inode() function (bnc#1012382).
• f2fs: avoid unneeded loop…

The SUSE Linux Enterprise 12 SP3 Azure kernel was updated to 4.4.176 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).
• CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free. (bnc#1124728)
• CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).
• CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).
• CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).
• CVE-2017-18249: The add_free_nid function in fs/f2fs/node.c did not properly track an allocated nid, which allowed local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads (bnc#1087036).

The following non-security bugs were fixed:

• acpi/nfit: Block function zero DSMs (bsc#1123321).
• acpi, nfit: Fix ARS overflow continuation (bsc#1125000).
• acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value (bsc#1124775).
• acpi/nfit: Fix command-supported detection (bsc#1123323).
• acpi: power: Skip duplicate power resource references in _PRx (bnc#1012382).
• acpi / processor: Fix the return value of acpi_processor_ids_walk() (git fixes (acpi)).
• alpha: Fix Eiger NR_IRQS to 128 (bnc#1012382).
• alpha: fix page fault handling for r16-r18 targets (bnc#1012382).
• alsa: bebob: fix model-id of unit for Apogee Ensemble (bnc#1012382).
• alsa: compress: Fix stop handling on compressed capture streams (bnc#1012382).
• alsa: hda - Add quirk for HP EliteBook 840 G5 (bnc#1012382).
• alsa: hda/realtek - Disable headset Mic VREF for headset mode of ALC225 (bnc#1012382).
• alsa: hda - Serialize codec registrations (bnc#1012382).
• alsa: usb-audio: Fix implicit fb endpoint setup by quirk (bnc#1012382).
• ARC: perf: map generic branches to correct hardware condition (bnc#1012382).
• arm64: Do not trap host pointer auth use to EL2 (bnc#1012382).
• arm64: ftrace: do not adjust the LR value (bnc#1012382).
• arm64: hyp-stub: Forbid kprobing of the hyp-stub (bnc#1012382).
• arm64/kvm: consistently handle host HCR_EL2 flags (bnc#1012382).
• arm64: KVM: Skip MMIO insn after emulation (bnc#1012382).
• arm64: perf: set suppress_bind_attrs flag to true (bnc#1012382).
• ARM: 8808/1: kexec:offline panic_smp_self_stop CPU (bnc#1012382).
• ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment (bnc#1012382).
• ARM: dts: da850-evm: Correct the sound card name (bnc#1012382).
• ARM: dts: Fix OMAP4430 SDP Ethernet startup (bnc#1012382).
• ARM: dts: kirkwood: Fix polarity of GPIO fan lines (bnc#1012382).
• ARM: dts: mmp2: fix TWSI2 (bnc#1012382).
• ARM: iop32x/n2100: fix PCI IRQ mapping (bnc#1012382).
• ARM: OMAP2+: hwmod: Fix some section annotations (bnc#1012382).
• ARM: pxa: avoid section mismatch warning (bnc#1012382).
• ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages (bnc#1012382).
• ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M (bnc#1012382).
• ASoC: Intel: mrfld: fix uninitialized variable access (bnc#1012382).
• ata: Fix racy link clearance (bsc#1107866).
• ax25: fix possible use-after-free (bnc#1012382).
• batman-adv: Avoid WARN on net_device without…

It was discovered that a race condition existed in the f2fs file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2017-18249)

Wen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100, CVE-2018-14614, CVE-2018-14616)

Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613)

Vasily Averin and Evgenii Shatokhin discovered that a use-after-free vulnerability existed in the NFS41+ subsystem when multiple network namespaces are in use. A local attacker in a container could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-16884)

It was discovered that a use-after-free vulnerability existed in the PPP over L2TP implementation in the Linux kernel. A privileged local attacker could use this to possibly execute arbitrary code. (CVE-2018-9517)

Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)

Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM). (CVE-2019-7222)

Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213)

Muyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code. (CVE-2019-3701)

Vladis Dronov discovered that the debug interface for the Linux kernel's HID subsystem did not properly validate passed parameters in some situations. A local privileged attacker could use this to cause a denial of service (infinite loop). (CVE-2019-3819)

USN-3932-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.

It was discovered that a race condition existed in the f2fs file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2017-18249)

Wen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100, CVE-2018-14614, CVE-2018-14616)

Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613)

Vasily Averin and Evgenii Shatokhin discovered that a use-after-free vulnerability existed in the NFS41+ subsystem when multiple network namespaces are in use. A local attacker in a container could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-16884)

It was discovered that a use-after-free vulnerability existed in the PPP over L2TP implementation in the Linux kernel. A privileged local attacker could use this to possibly execute arbitrary code. (CVE-2018-9517)

Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)

Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM). (CVE-2019-7222)

Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213)

Muyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code. (CVE-2019-3701)

Vladis Dronov discovered that the debug interface for the Linux kernel's HID subsystem did not properly validate passed parameters in some situations. A local privileged attacker could use this to cause a denial of service (infinite loop). (CVE-2019-3819)