CVE-2020-12351

Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.

Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux kernel contained a type-confusion error. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12351)

Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). (CVE-2020-12352)

Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-24490)

A flaw was found in the way the Linux kernel Bluetooth implementation handled L2CAP packets with A2MP CID. A remote attacker in adjacent range could use this flaw to crash the system causing denial of service or potentially execute arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2020-12351).

An information leak flaw was found in the way the Linux kernel's Bluetooth stack implementation handled initialization of stack memory when handling certain AMP packets. A remote attacker in adjacent range could use this flaw to leak small portions of stack memory on the system by sending a specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality (CVE-2020-12352).

A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability (CVE-2020-14385).

A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity (CVE-2020-14386).

A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (CVE-2020-14390).

A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability (CVE-2020-24490).

In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c (CVE-2020-25211).

get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv() (CVE-2020-25221).

The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices (CVE-2020-25284).

A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact (CVE-2020-25285).

A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability (CVE-2020-25641).

A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is…

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-12351: A type confusion while processing AMP packets could be used by physical close attackers to crash the kernel or potentially execute code was fixed (bsc#1177724).
• CVE-2020-12352: A stack information leak when handling certain AMP packets could be used by physical close attackers to leak information from the kernel was fixed (bsc#1177725).
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452 (bnc#1176381).
• CVE-2020-25645: Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality (bnc#1177511).

The following non-security bugs were fixed:

• 59c7c3caaaf8 ('nvme: fix possible hang when ns scanning fails during error recovery')
• NFS: On fatal writeback errors, we need to call nfs_inode_remove_request() (bsc#1177340).
• NFS: Revalidate the file mapping on all fatal writeback errors (bsc#1177340).
• drm/sun4i: mixer: Extend regmap max_register (git-fixes).
• ea43d9709f72 ('nvme: fix identify error status silent ignore')
• i2c: meson: fix clock setting overwrite (git-fixes).
• iommu/vt-d: Correctly calculate agaw in domain_init() (bsc#1176400).
• mac80211: do not allow bigger VHT MPDUs than the hardware supports (git-fixes).
• macsec: avoid use-after-free in macsec_handle_frame() (git-fixes).
• mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() (bsc#1177685).
• mmc: core: do not set limits.discard_granularity as 0 (git-fixes).
• nvme-multipath: do not reset on unknown status (bsc#1174748).
• nvme-rdma: Avoid double freeing of async event data (bsc#1174748).
• nvme: Fix ctrl use-after-free during sysfs deletion (bsc#1174748).
• nvme: Namepace identification descriptor list is optional (bsc#1174748).
• nvme: add a Identify Namespace Identification Descriptor list quirk (bsc#1174748).
• nvme: fix deadlock caused by ANA update wrong locking (bsc#1174748).
• nvme: fix possible io failures when removing multipathed ns (bsc#1174748).
• nvme: make nvme_identify_ns propagate errors back (bsc#1174748).
• nvme: make nvme_report_ns_ids propagate error back (bsc#1174748).
• nvme: pass status to nvme_error_status (bsc#1174748).
• nvme: return error from nvme_alloc_ns() (bsc#1174748).
• powerpc/dma: Fix dma_map_ops::get_required_mask (bsc#1065729).
• scsi: hisi_sas: Add debugfs ITCT file and add file operations (bsc#1140683).
• scsi: hisi_sas: Add manual trigger for debugfs dump (bsc#1140683).
• scsi: hisi_sas: Add missing seq_printf() call in hisi_sas_show_row_32() (bsc#1140683).
• scsi: hisi_sas: Change return variable type in phy_up_v3_hw() (bsc#1140683).
• scsi: hisi_sas: Correct memory allocation size for DQ debugfs (bsc#1140683).
• scsi: hisi_sas: Do some more tidy-up (bsc#1140683).
• scsi: hisi_sas: Fix a timeout race of driver internal and SMP IO (bsc#1140683).
• scsi: hisi_sas: Fix type casting and missing static qualifier in debugfs code (bsc#1140683). Refresh:
• scsi: hisi_sas: No need to check return value of debugfs_create functions (bsc#1140683). Update:
• scsi: hisi_sas: Some misc tidy-up (bsc#1140683).
• scsi: qla2xxx: Add IOCB resource tracking (bsc#1176946 bsc#1175520 bsc#1172538).
• scsi: qla2xxx: Add SLER and PI control support (bsc#1176946 bsc#1175520 bsc#1172538).
• scsi: qla2xxx: Add rport fields in debugfs (bsc#1176946 bsc#1175520 bsc#1172538).
• scsi: qla2xxx: Allow dev_loss_tmo setting for FC-NVMe devices (bsc#1176946 bsc#1175520 bsc#1172538).
• scsi: qla2xxx: Correct the check for sscanf() return value (bsc#1176946 bsc#1175520 bsc#1172538). -…

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth' aka 'BadVibes' (bsc#1177726).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' aka 'BadChoice' (bsc#1177725).
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code in the Linux kernel could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452 (bnc#1176381).
• CVE-2020-25645: Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality (bnc#1177511).
• CVE-2020-25643: Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (bnc#1177206).
• CVE-2020-25641: A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allowed a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability (bnc#1177121).

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1 (git-fixes).
• ASoC: img-i2s-out: Fix runtime PM imbalance on error (git-fixes).
• ASoC: kirkwood: fix IRQ error handling (git-fixes).
• ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions (git-fixes).
• ASoC: wm8994: Skip setting of the WM8994_MICBIAS register for WM1811 (git-fixes).
• Bluetooth: Fix refcount use-after-free issue (git-fixes).
• Bluetooth: Handle Inquiry Cancel error after Inquiry Complete (git-fixes).
• Bluetooth: L2CAP: handle l2cap config request during open state (git-fixes).
• Bluetooth: guard against controllers sending zero'd events (git-fixes).
• Bluetooth: prefetch channel before killing sock (git-fixes).
• Btrfs: fix crash during unmount due to race with delayed inode workers (bsc#1176019).
• Input: i8042 - add nopnp quirk for Acer Aspire 5 A515 (bsc#954532).
• Input: trackpoint - enable Synaptics trackpoints (git-fixes).
• Move upstreamed intel-vbtn patch into sorted section
• NFS: Do not move layouts to plh_return_segs list while in use (git-fixes).
• NFS: Do not return layout segments that are in use (git-fixes).
• NFS: Fix flexfiles read failover (git-fixes).
• NFSv4.2: fix client's attribute cache management for copy_file_range (git-fixes).
• PCI/IOV: Mark VFs as not implementing PCI_COMMAND_MEMORY (bsc#1176979).
• PCI: Avoid double hpmemsize MMIO window assignment (git-fixes).
• PCI: tegra194: Fix runtime PM imbalance on error (git-fixes).
• PCI: tegra: Fix runtime PM imbalance on error (git-fixes).
• Platform: OLPC: Fix memleak in olpc_ec_probe (git-fixes).
• RDMA/hfi1: Correct an interlock issue for TID RDMA WRITE request (bsc#1175621).
• Refresh patches.suse/fnic-to-not-call-scsi_done-for-unhandled-commands.patch (bsc#1168468, bsc#1171675).
• SUNRPC: Revert 241b1f419f0e ('SUNRPC: Remove xdr_buf_trim()') (git-fixes).
• USB: EHCI: ehci-mv: fix error handling in mv_ehci_probe() (git-fixes).
• USB: EHCI: ehci-mv: fix less than zero comparison of an…

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth' aka 'BadVibes' (bsc#1177726).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' aka 'BadChoice' (bsc#1177725).
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code in the Linux kernel could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452 (bnc#1176381).
• CVE-2020-25645: Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality (bnc#1177511).
• CVE-2020-25643: Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (bnc#1177206).
• CVE-2020-25641: A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allowed a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability (bnc#1177121).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25668: Make FONTX ioctl use the tty pointer they were actually passed (bsc#1178123).
• CVE-2020-25656: Extend func_buf_lock to readers (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812 (bnc#1176485).
• CVE-2020-14351: Fixed race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-8694: Restrict energy meter to root access (bsc#1170415).
• CVE-2020-16120: Check permission to open real file in overlayfs (bsc#1177470).
• CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: Always build evged in (git-fixes).
• ACPI: button: fix handling lid state changes when input device closed (git-fixes).
• ACPI: configfs: Add missing config_item_put() to fix refcount leak (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• act_ife: load meta modules before tcf_idr_check_alloc() (networking-stable-20_09_24).
• Add CONFIG_CHECK_CODESIGN_EKU
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: ac97: (cosmetic) align argument names (git-fixes).
• ALSA: aoa: i2sbus: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: asihpi: fix spellint typo in comments (git-fixes).
• ALSA: atmel: ac97: clarify operator precedence (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm:…

This update syncs the RT kernel from the SUSE Linux Enterprise 15-SP2 codestream.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the kernel-devel-5.14.6-1.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sca-patterns-sle12-1.0.8-2.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sca-patterns-sle15-1.0.8-2.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

This update for SCA patterns fixes the following issues:

sca-patterns-base:

• Version update from 1.3.1 to 1.5.0 to implement the conversion of SCA Tool to Python3 (jsc#SLE-25064, jsc#SLE-24335):
  • Convert SCA Tool from Python2 to Python3 (bsc#1191005, SLE-21579)
  • Added Core.loadFullFile for sectionless parsing (bsc#1187194)
  • Added SUSE.getNetworkInterfaces (bsc#1144162)
  • Changed required dependencies from python to python3-base (bsc#1191199)
  • Fix SUSE.getFileSystems invalid index error (bsc#1185594)
  • Fix SUSE.getFileSystems unbound local SWAP variable (bsc#1185593)
  • Removed Novell/OES references from libraries (bsc#1186034)
  • Updated documentation for SUSE.compareKernel
  • Updated kernel version constants for all SUSE libraries (bsc#1189483)

sca-patterns-hae:

• Version update from 1.3.1 to 1.5.1 to implement the conversion of SCA Tool to Python3 (jsc#SLE-25064, jsc#SLE-24335):
  • Convert SCA Tool from Python2 to Python3 (bsc#1191005, SLE-21579)
  • Added distribution and service pack subdirectories (bsc#1193878)
  • False positive hit from /usr/lib/sca/patterns/HAE/stonith-00002.pl (bsc#1124793)
  • HAE Policies Quorum 2 node cluster requires ignore policy (bsc#1167689)
  • supportconfig indicates IPv6 required by HAE, is already enabled (bsc#1045605)

sca-patterns-suma:

• Version update from 1.0 to 1.5.1 to implement the conversion of SCA Tool to Python3 (jsc#SLE-25064, jsc#SLE-24335):
  • Convert SCA Tool from Python2 to Python3 (bsc#1191005, SLE-21579)

sca-server-report:

• Version update from 1.0.1 to 1.5.1 to implement the conversion of SCA Tool to Python3 (jsc#SLE-25064, jsc#SLE-24335):
  • Convert SCA Tool from Python2 to Python3 (bsc#1191005, SLE-21579)
  • Changed absolute paths to relative ones (bsc#1186316)
  • Changed required dependencies from python to python3-base (bsc#1191199)
  • Ensure that the legacy SuSE-release file works (bsc#1196730)
  • Fix sca report header supportconfig file (bsc#1186442)
  • Fix the report file output path (bsc#1180894)
  • Removed preprocessor elements for OES Filr eDir (bsc#1186420)

sca-patterns-sle15:

• Version update from 1.0.1 to 1.5.1 to implement the conversion of SCA Tool to Python3 (jsc#SLE-25064, jsc#SLE-24335):
  • Convert SCA Tool from Python2 to Python3 (bsc#1191005, SLE-21579)
  • Added Video link to coredumpctl-000018634.py
  • Added video links to patterns (bsc#1190460):
    • bhc-scc-expired.py, bhc-scc-registered.py, bhc-diskused-00001.pl, bhc-memused-00001.pl
  • Fixed crosstalk message strings (bsc#1186312)
  • Fixed field reference in sle15all/lvm-00003.pl
  • Fixed metadata tags in scc-registered.py
  • Fixed percent used calculation for bhc-memused-00001.pl (bsc#1189889)
  • Removed outdated TID2 link in bhc-diskused-00001.pl (bsc#1190260)
  • Requires Core library 1.3.3 which contains Core.logFullFile function
  • Updated registration link in bhc-scc-registered.py
  • Updated renewal link in bhc-scc-expired.py
• New security announcement patterns:
  • Apr 2022 (13) for SUSE-SU-2022:1293-1 SUSE-SU-2022:1313-1 SUSE-SU-2022:1250-1 SUSE-SU-2022:1108-1 SUSE-SU-2022:1292-1 SUSE-SU-2022:1313-1 SUSE-SU-2022:1448-1 SUSE-SU-2022:1250-1 SUSE-SU-2022:1255-1 SUSE-SU-2022:1255-1 SUSE-SU-2022:1288-1 SUSE-SU-2022:1427-1 SUSE-SU-2022:1139-1
  • Mar 2022 (48) for SUSE-SU-2022:1293-1 SUSE-SU-2022:1313-1 SUSE-SU-2022:1250-1 SUSE-SU-2022:1108-1 SUSE-SU-2022:1292-1 SUSE-SU-2022:1313-1 SUSE-SU-2022:1448-1 SUSE-SU-2022:1250-1 SUSE-SU-2022:1255-1 SUSE-SU-2022:1255-1 SUSE-SU-2022:1288-1 SUSE-SU-2022:1427-1 SUSE-SU-2022:1139-1 SUSE-SU-2022:0931-1 SUSE-SU-2022:0703-1 SUSE-SU-2022:0779-1 SUSE-SU-2022:0695-1 SUSE-SU-2022:0826-1 SUSE-SU-2022:0825-1 SUSE-SU-2022:1058-1 SUSE-SU-2022:0679-1 SUSE-SU-2022:0853-1 SUSE-SU-2022:0819-1 SUSE-SU-2022:0778-1 SUSE-SU-2022:0676-1 SUSE-SU-2022:0725-1 SUSE-SU-2022:0754-1 SUSE-SU-2022:0929-1 SUSE-SU-2022:0732-1 SUSE-SU-2022:0703-1 SUSE-SU-2022:0810-1 SUSE-SU-2022:0694-1…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' aka 'BadChoice' (bsc#1177725).
• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177511).

The following non-security bugs were fixed:

• drm/sun4i: mixer: Extend regmap max_register (git-fixes).
• i2c: meson: fix clock setting overwrite (git-fixes).
• iommu/vt-d: Correctly calculate agaw in domain_init() (bsc#1176400).
• mac80211: do not allow bigger VHT MPDUs than the hardware supports (git-fixes).
• macsec: avoid use-after-free in macsec_handle_frame() (git-fixes).
• mmc: core: do not set limits.discard_granularity as 0 (git-fixes).
• mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() (bsc#1177685).
• NFS: On fatal writeback errors, we need to call nfs_inode_remove_request() (bsc#1177340).
• NFS: Revalidate the file mapping on all fatal writeback errors (bsc#1177340).
• nvme: add a Identify Namespace Identification Descriptor list quirk (bsc#1174748). add two previous futile attempts to fix the bug to blacklist.conf
• nvme: Fix ctrl use-after-free during sysfs deletion (bsc#1174748).
• nvme: fix deadlock caused by ANA update wrong locking (bsc#1174748).
• nvme: fix possible io failures when removing multipathed ns (bsc#1174748).
• nvme: make nvme_identify_ns propagate errors back (bsc#1174748). Refresh: - patches.suse/nvme-flush-scan_work-when-resetting-controller.patch
• nvme: make nvme_report_ns_ids propagate error back (bsc#1174748).
• nvme-multipath: do not reset on unknown status (bsc#1174748).
• nvme: Namepace identification descriptor list is optional (bsc#1174748).
• nvme: pass status to nvme_error_status (bsc#1174748).
• nvme-rdma: Avoid double freeing of async event data (bsc#1174748).
• nvme: return error from nvme_alloc_ns() (bsc#1174748).
• powerpc/dma: Fix dma_map_ops::get_required_mask (bsc#1065729).
• scsi-hisi-kabi-fixes.patch
• scsi-hisi-kabi-fixes.patch
• scsi: hisi_sas: Add debugfs ITCT file and add file operations (bsc#1140683).
• scsi: hisi_sas: Add manual trigger for debugfs dump (bsc#1140683).
• scsi: hisi_sas: Add missing seq_printf() call in hisi_sas_show_row_32() (bsc#1140683).
• scsi: hisi_sas: Change return variable type in phy_up_v3_hw() (bsc#1140683).
• scsi: hisi_sas: Correct memory allocation size for DQ debugfs (bsc#1140683).
• scsi: hisi_sas: Do some more tidy-up (bsc#1140683).
• scsi: hisi_sas: Fix a timeout race of driver internal and SMP IO (bsc#1140683).
• scsi: hisi_sas: Fix type casting and missing static qualifier in debugfs code (bsc#1140683). Refresh:
• scsi-hisi_sas-Issue-internal-abort-on-all-relevant-q.patch
• scsi: hisi_sas: No need to check return value of debugfs_create functions (bsc#1140683). Update:
• scsi: hisi_sas: Some misc tidy-up (bsc#1140683).
• scsi: qla2xxx: Add IOCB resource tracking (bsc#1176946 bsc#1175520 bsc#1172538).
• scsi: qla2xxx: Add rport fields in debugfs (bsc#1176946 bsc#1175520 bsc#1172538).
• scsi: qla2xxx: Add SLER and PI control support (bsc#1176946 bsc#1175520 bsc#1172538).
• scsi: qla2xxx: Allow dev_loss_tmo setting for FC-NVMe devices (bsc#1176946 bsc#1175520 bsc#1172538).
• scsi: qla2xxx: Correct the check for sscanf() return value (bsc#1176946 bsc#1175520 bsc#1172538).
• scsi: qla2xxx: Fix buffer-buffer credit extraction error (bsc#1176946 bsc#1175520 bsc#1172538).
• scsi: qla2xxx: Fix crash on session cleanup with unload (bsc#1176946 bsc#1175520 bsc#1172538).
• scsi: qla2xxx: Fix inconsistent format argument type in qla_dbg.c (bsc#1176946 bsc#1175520…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth' aka 'BadVibes' (bsc#1177726).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' aka 'BadChoice' (bsc#1177725).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177511).

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• airo: Fix read overflows sending packets (git-fixes).
• ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter (git-fixes).
• arm64: Enable PCI write-combine resources under sysfs (bsc#1175807).
• ASoC: img-i2s-out: Fix runtime PM imbalance on error (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1 (git-fixes).
• ASoC: kirkwood: fix IRQ error handling (git-fixes).
• ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions (git-fixes).
• ASoC: wm8994: Skip setting of the WM8994_MICBIAS register for WM1811 (git-fixes).
• ata: ahci: mvebu: Make SATA PHY optional for Armada 3720 (git-fixes).
• ath10k: fix array out-of-bounds access (git-fixes).
• ath10k: fix memory leak for tpc_stats_final (git-fixes).
• ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read (git-fixes).
• Bluetooth: Fix refcount use-after-free issue (git-fixes).
• Bluetooth: guard against controllers sending zero'd events (git-fixes).
• Bluetooth: Handle Inquiry Cancel error after Inquiry Complete (git-fixes).
• Bluetooth: L2CAP: handle l2cap config request during open state (git-fixes).
• Bluetooth: prefetch channel before killing sock (git-fixes).
• brcmfmac: Fix double freeing in the fmac usb data path (git-fixes).
• btrfs: block-group: do not set the wrong READA flag for btrfs_read_block_groups() (bsc#1176019).
• btrfs: block-group: fix free-space bitmap threshold (bsc#1176019).
• btrfs: block-group: refactor how we delete one block group item (bsc#1176019).
• btrfs: block-group: refactor how we insert a block group item (bsc#1176019).
• btrfs: block-group: refactor how we read one block group item (bsc#1176019).
• btrfs: block-group: rename write_one_cache_group() (bsc#1176019).
• btrfs: check the right error variable in btrfs_del_dir_entries_in_log (bsc#1177687).
• btrfs: do not set the full sync flag on the inode during page release (bsc#1177687).
• btrfs: do not take an extra root ref at allocation time (bsc#1176019).
• btrfs: drop logs when we've aborted a transaction (bsc#1176019).
• btrfs: fix a race between scrub and block group removal/allocation (bsc#1176019).
• Btrfs: fix crash during unmount due to race with delayed inode workers (bsc#1176019).
• btrfs: fix race between page release and a fast fsync (bsc#1177687).
• btrfs: free block groups after free'ing fs trees (bsc#1176019).
• btrfs: hold a ref on the root on the dead roots list (bsc#1176019).
• btrfs: kill the subvol_srcu (bsc#1176019).
• btrfs: make btrfs_cleanup_fs_roots use the radix tree lock (bsc#1176019).
• btrfs: make inodes hold a ref on their roots (bsc#1176019).
• btrfs: make the extent buffer leak check per fs info (bsc#1176019). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' aka 'BadChoice' (bsc#1177725).
• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177511).
• CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bsc#1176381).

The following non-security bugs were fixed:

• btrfs: check the right error variable in btrfs_del_dir_entries_in_log (bsc#1177687).
• btrfs: do not set the full sync flag on the inode during page release (bsc#1177687).
• btrfs: fix incorrect updating of log root tree (bsc#1177687).
• btrfs: fix race between page release and a fast fsync (bsc#1177687).
• btrfs: only commit delayed items at fsync if we are logging a directory (bsc#1177687).
• btrfs: only commit the delayed inode when doing a full fsync (bsc#1177687).
• btrfs: reduce contention on log trees when logging checksums (bsc#1177687).
• btrfs: release old extent maps during page release (bsc#1177687).
• btrfs: remove no longer needed use of log_writers for the log root tree (bsc#1177687).
• btrfs: stop incremening log_batch for the log root tree when syncing log (bsc#1177687).
• drm/amdgpu: prevent double kfree ttm->sg (git-fixes).
• drm/nouveau/mem: guard against NULL pointer access in mem_del (git-fixes).
• drm/sun4i: mixer: Extend regmap max_register (git-fixes).
• ext4: fix dir_nlink behaviour (bsc#1177359).
• i2c: meson: fix clock setting overwrite (git-fixes).
• include/linux/swapops.h: correct guards for non_swap_entry() (git-fixes (mm/swap)).
• iommu/vt-d: Correctly calculate agaw in domain_init() (bsc#1176400).
• leds: mt6323: move period calculation (git-fixes).
• mac80211: do not allow bigger VHT MPDUs than the hardware supports (git-fixes).
• macsec: avoid use-after-free in macsec_handle_frame() (git-fixes).
• mfd: sm501: Fix leaks in probe() (git-fixes).
• mmc: core: do not set limits.discard_granularity as 0 (git-fixes).
• mm/huge_memory.c: use head to check huge zero page (git-fixes (mm/thp)).
• mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup() (git-fixes (mm/hugetlb)).
• mm/ksm.c: do not WARN if page is still mapped in remove_stable_node() (git-fixes (mm/hugetlb)).
• mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() (bsc#1177685).
• mm/mempolicy.c: fix out of bounds write in mpol_parse_str() (git-fixes (mm/mempolicy)).
• mm/mempolicy.c: use match_string() helper to simplify the code (git-fixes (mm/mempolicy)).
• mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa (git-fixes (mm/numa)).
• mm/page_owner.c: remove drain_all_pages from init_early_allocated_pages (git-fixes (mm/debug)).
• mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio() (git-fixes (mm/writeback)).
• mm/page-writeback.c: improve arithmetic divisions (git-fixes (mm/writeback)).
• mm/page-writeback.c: use div64_ul() for u64-by-unsigned-long divide (git-fixes (mm/writeback)).
• mm/rmap: fixup copying of soft dirty and uffd ptes (git-fixes (mm/rmap)).
• mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n (git-fixes (mm/zsmalloc)).
• mm/zsmalloc.c: fix race condition in zs_destroy_pool (git-fixes (mm/zsmalloc)).
• mm/zsmalloc.c: fix the migrated zspage statistics (git-fixes (mm/zsmalloc)).
• mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely (git-fixes (mm/zsmalloc)).
• Move the upstreamed bluetooth fix into sorted section
• net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() (git-fixes).
• NFS: On fatal writeback errors, we need to…

The SUSE Linux Enterprise 12 SP5 kernel Azure was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).
• CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).
• CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The following non-security bugs were fixed:

• ACPI: dock: fix enum-conversion warning (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: mixart: Correct comment wrt obsoleted tasklet usage (git-fixes).
• ALSA: rawmidi: (cosmetic) align function parameters (git-fixes).
• ALSA: seq: oss: Avoid mutex lock for a long-time ioctl (git-fixes).
• ALSA: usb-audio: Add mixer support for Pioneer DJ DJM-250MK2 (git-fixes).
• ALSA: usb-audio: endpoint.c: fix repeated word 'there' (git-fixes).
• ALSA: usb-audio: fix spelling mistake 'Frequence' -> 'Frequency' (git-fixes).
• amd-xgbe: Add a check for an skb in the timestamp path (git-fixes).
• amd-xgbe: Add additional dynamic debug messages (git-fixes).
• amd-xgbe: Add additional ethtool statistics (git-fixes).
• amd-xgbe: Add ethtool show/set channels support (git-fixes).
• amd-xgbe: Add ethtool show/set ring parameter support (git-fixes).
• amd-xgbe: Add ethtool support to retrieve SFP module info (git-fixes).
• amd-xgbe: Add hardware features debug output (git-fixes).
• amd-xgbe: Add NUMA affinity support for IRQ hints (git-fixes).
• amd-xgbe: Add NUMA affinity support for memory allocations (git-fixes).
• amd-xgbe: Add per queue Tx and Rx statistics (git-fixes).
• amd-xgbe: Advertise FEC support with the KR re-driver (git-fixes).
• amd-xgbe: Always attempt link training in KR mode (git-fixes).
• amd-xgbe: Be sure driver shuts down cleanly on module removal (git-fixes).
• amd-xgbe: Convert to generic power management (git-fixes).
• amd-xgbe: Fix debug output of max channel counts (git-fixes).
• amd-xgbe: Fix error path in xgbe_mod_init() (git-fixes).
• amd-xgbe: Fixes for working with PHYs that support 2.5GbE (git-fixes).…

This update for the Linux Kernel 5.3.18-22 fixes several issues.

The following security issues were fixed:

• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724, bsc#1177729, bsc#1178397).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth' aka 'BadVibes' (bsc#1177726, bsc#1177727).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177513).

This update for the Linux Kernel 4.12.14-197_26 fixes several issues.

The following security issues were fixed:

• CVE-2017-1000405: Fixed a bug in the THP CoW support that could have been used by local attackers to corrupt memory of other processes and cause them to crash (bsc#1178264, bsc#1069496, bsc#1070307).
• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724, bsc#1177729, bsc#1178397).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177513).

This update for the Linux Kernel 5.3.18-24_12 fixes several issues.

The following security issues were fixed:

• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724, bsc#1177729, bsc#1178397).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177513).

This update for the Linux Kernel 4.12.14-150_47 fixes several issues.

The following security issues were fixed:

• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bsc#1176723, bsc#1178003).
• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724, bsc#1177729, bsc#1178397).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177513).

This update for the Linux Kernel 4.12.14-150_41 fixes several issues.

The following security issues were fixed:

• CVE-2017-1000405: Fixed a bug in the THP CoW support that could have been used by local attackers to corrupt memory of other processes and cause them to crash (bsc#1178264, bsc#1069496, bsc#1070307).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bsc#1176723, bsc#1178003).
• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724, bsc#1177729, bsc#1178397).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177513).

The SUSE Linux Enterprise 15 SP1 Azure kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-8694: Insufficient access control for some Intel(R) Processors may have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1170415).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).
• CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: mixart: Correct comment wrt obsoleted tasklet usage (git-fixes).
• ALSA: rawmidi: (cosmetic) align function parameters (git-fixes).
• ALSA: seq: oss: Avoid mutex lock for a long-time ioctl (git-fixes).
• ALSA: usb-audio: Add mixer support for Pioneer DJ DJM-250MK2 (git-fixes).
• ALSA: usb-audio: endpoint.c: fix repeated word 'there' (git-fixes).
• ALSA: usb-audio: fix spelling mistake 'Frequence' -> 'Frequency' (git-fixes).
• amd-xgbe: Add a check for…

The SUSE Linux Enterprise 15 SP2 kernel Azure was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).
• CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth' aka 'BadVibes' (bsc#1177726).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).
• CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: Always build evged in (git-fixes).
• ACPI: button: fix handling lid state changes when input device closed (git-fixes).
• ACPI: configfs: Add missing config_item_put() to fix refcount leak (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• act_ife: load meta modules before tcf_idr_check_alloc() (networking-stable-20_09_24).
• Add CONFIG_CHECK_CODESIGN_EKU
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: ac97: (cosmetic) align argument names (git-fixes).
• ALSA: aoa: i2sbus: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: asihpi: fix spellint typo in comments (git-fixes).
• ALSA: atmel: ac97: clarify operator precedence (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: fireworks: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda: (cosmetic) align function parameters (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - set mic to auto detect on a HP AIO machine (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use…

The SUSE Linux Enterprise 12 SP5 realtime kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-8694: Insufficient access control for some Intel(R) Processors may have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1170415).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470).
• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: mixart: Correct comment wrt obsoleted tasklet usage (git-fixes).
• ALSA: rawmidi: (cosmetic) align function parameters (git-fixes).
• ALSA: seq: oss: Avoid mutex lock for a long-time ioctl (git-fixes).
• ALSA: usb-audio: Add mixer support for Pioneer DJ DJM-250MK2 (git-fixes).
• ALSA: usb-audio: endpoint.c: fix repeated word 'there' (git-fixes).
• ALSA: usb-audio: Fix potential use-after-free of streams (gix-fixes).
• ALSA: usb-audio: fix spelling mistake 'Frequence' -> 'Frequency' (git-fixes).
• arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs…

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-8694: Insufficient access control for some Intel(R) Processors may have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1170415).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470).
• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: mixart: Correct comment wrt obsoleted tasklet usage (git-fixes).
• ALSA: rawmidi: (cosmetic) align function parameters (git-fixes).
• ALSA: seq: oss: Avoid mutex lock for a long-time ioctl (git-fixes).
• ALSA: usb-audio: Add mixer support for Pioneer DJ DJM-250MK2 (git-fixes).
• ALSA: usb-audio: endpoint.c: fix repeated word 'there' (git-fixes).
• ALSA: usb-audio: fix spelling mistake 'Frequence' -> 'Frequency' (git-fixes).
• ASoC: qcom: lpass-cpu: fix concurrency issue (git-fixes).
• ASoC: qcom: lpass-platform: fix memory leak (git-fixes).
• ata:…

The SUSE Linux Enterprise 15 SP2 realtime kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-8694: Insufficient access control for some Intel(R) Processors may have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1170415).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470).
• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth (bsc#1177726).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon (bsc#1178589)

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• ACPI: Always build evged in (git-fixes).
• ACPI: button: fix handling lid state changes when input device closed (git-fixes).
• ACPI: configfs: Add missing config_item_put() to fix refcount leak (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: GED: fix -Wformat (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• act_ife: load meta modules before tcf_idr_check_alloc() (networking-stable-20_09_24).
• ALSA: ac97: (cosmetic) align argument names (git-fixes).
• ALSA: aoa: i2sbus: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: asihpi: fix spellint typo in comments (git-fixes).
• ALSA: atmel: ac97: clarify operator precedence (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: fireworks: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: fix kernel-doc markups (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda: (cosmetic) align function parameters (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close…

The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470).
• CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).
• CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-2521: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).

The following non-security bugs were fixed:

• btrfs: cleanup root usage by btrfs_get_alloc_profile (bsc#1131277).
• btrfs: reloc: clear DEAD_RELOC_TREE bit for orphan roots to prevent runaway balance (bsc#1171417 bsc#1160947 bsc#1172366 bsc#1176922).
• btrfs: reloc: fix reloc root leak and NULL pointer dereference (bsc#1171417…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).
• CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).
• CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).
• CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-14381: Fixed a UAF in the fast user mutex (futex) wait operation (bsc#1176011).
• CVE-2020-25643: Fixed an improper input validation in the ppp_cp_parse_cr function of the HDLC_PPP module (bnc#1177206).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).

The following non-security bugs were fixed:

• btrfs: remove root usage from can_overcommit (bsc#1131277).
• hv: vmbus: Add timeout to vmbus_wait_for_unload (bsc#1177816).
• hyperv_fb: disable superfluous VERSION_WIN10_V5 case (bsc#1175306).
• hyperv_fb: Update screen_info after removing old framebuffer (bsc#1175306).
• livepatch: Add -fdump-ipa-clones to build (). Add support for -fdump-ipa-clones GCC option. Update config files accordingly.
• livepatch: Test if -fdump-ipa-clones is really available As of now we add -fdump-ipa-clones unconditionally. It does not cause a trouble if the kernel is build with the supported toolchain. Otherwise it could fail easily. Do the correct thing and test for the availability.
• NFS: On fatal…

Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux kernel contained a type-confusion error. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12351)

Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). (CVE-2020-12352)

Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux kernel contained a type-confusion error. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12351)

Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). (CVE-2020-12352)

Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-24490)

Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux kernel contained a type-confusion error. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12351)

Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). (CVE-2020-12352)

Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-24490)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• Media drivers;
• Network drivers;
• SMB network file system;
• Bluetooth subsystem;
• Amateur Radio drivers;
• Network traffic control;
• VMware vSockets driver; (CVE-2024-43904, CVE-2024-35963, CVE-2024-35967, CVE-2024-40973, CVE-2024-26822, CVE-2024-35965, CVE-2024-40910, CVE-2024-38553, CVE-2024-53057, CVE-2024-50264, CVE-2024-35966)

Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux kernel contained a type-confusion error. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12351)

Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). (CVE-2020-12352)

Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-24490)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• Media drivers;
• Network drivers;
• SMB network file system;
• Bluetooth subsystem;
• Amateur Radio drivers;
• Network traffic control;
• VMware vSockets driver; (CVE-2024-35963, CVE-2024-38553, CVE-2024-35965, CVE-2024-26822, CVE-2024-35966, CVE-2024-53057, CVE-2024-43904, CVE-2024-50264, CVE-2024-40973, CVE-2024-40910, CVE-2024-35967)

Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux kernel contained a type-confusion error. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12351)

Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). (CVE-2020-12352)

Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-24490)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• Media drivers;
• Network drivers;
• SMB network file system;
• Bluetooth subsystem;
• Amateur Radio drivers;
• Network traffic control;
• VMware vSockets driver; (CVE-2024-43904, CVE-2024-35963, CVE-2024-35967, CVE-2024-40973, CVE-2024-26822, CVE-2024-35965, CVE-2024-40910, CVE-2024-38553, CVE-2024-53057, CVE-2024-50264, CVE-2024-35966)

Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux kernel contained a type-confusion error. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12351)

Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). (CVE-2020-12352)

Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-24490)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• Media drivers;
• Network drivers;
• SMB network file system;
• Bluetooth subsystem;
• Amateur Radio drivers;
• Network traffic control;
• VMware vSockets driver; (CVE-2024-43904, CVE-2024-35963, CVE-2024-35967, CVE-2024-40973, CVE-2024-26822, CVE-2024-35965, CVE-2024-40910, CVE-2024-38553, CVE-2024-53057, CVE-2024-50264, CVE-2024-35966)