In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fails to add a port, which may cause denial of service, aka CID-6caabe7f197d.

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-20095: mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c had some error-handling cases that did not free allocated hostcmd memory. This will cause a memory leak and denial of service (bnc#1159909).

CVE-2019-20054: Fixed a a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links (bnc#1159910).

CVE-2019-20096: Fixed a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service (bnc#1159908).

CVE-2019-19966: Fixed a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that will cause denial of service (bnc#1159841).

CVE-2019-19447: Mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c (bnc#1158819).

CVE-2019-19319: A setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when a large old_size value is used in a memset call (bnc#1158021).

CVE-2019-19767: Fixed mishandling of ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c (bnc#1159297).

CVE-2019-18808: A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c allowed attackers to cause a denial of service (memory consumption) (bnc#1156259).

CVE-2019-16746: An issue was discovered in net/wireless/nl80211.c where the length of variable elements in a beacon head were not checked, leading to a buffer overflow (bnc#1152107).

CVE-2019-19066: A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c allowed attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures (bnc#1157303).

CVE-2019-19051: There was a memory leak in the i2400m_op_rfkill_sw_toggle() function in drivers/net/wimax/i2400m/op-rfkill.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1159024).

CVE-2019-19338: There was an incomplete fix for Transaction Asynchronous Abort (TAA) (bnc#1158954).

CVE-2019-19332: There was an OOB memory write via kvm_dev_ioctl_get_cpuid (bnc#1158827).

CVE-2019-19537: There was a race condition bug that can be caused by a malicious USB device in the USB character device driver layer (bnc#1158904).

CVE-2019-19535: There was an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driver (bnc#1158903).

CVE-2019-19527: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver (bnc#1158900).

CVE-2019-19526: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver (bnc#1158893).

CVE-2019-19533: There was an info-leak bug that can be caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c driver (bnc#1158834).

CVE-2019-19532: There were multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers (bnc#1158824).

CVE-2019-19523: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver, aka CID-44efc269db79 (bnc#1158381 1158823 1158834).

CVE-2019-15213: There was a use-after-free caused by a malicious USB device in the drivers/media/usb/dvb-usb/dvb-usb-init.c driver (bnc#1146544).

CVE-2019-19531: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/yurex.c driver (bnc#1158445).

CVE-2019-19543: There was a use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c (bnc#1158427).

CVE-2019-19525: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver (bnc#1158417).

CVE-2019-19530: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver (bnc#1158410).

CVE-2019-19536: There was an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c driver (bnc#1158394).

CVE-2019-19524: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver (bnc#1158413).

CVE-2019-19528: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver (bnc#1158407).

CVE-2019-19534: There was an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver (bnc#1158398).

CVE-2019-19529: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c driver (bnc#1158381).

CVE-2019-14901: A heap overflow flaw was found in the Linux kernel in Marvell WiFi chip driver. The vulnerability allowed a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system (bnc#1157042).

CVE-2019-14895: A heap-based buffer overflow was discovered in the Linux kernel in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could have allowed the remote device to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1157158).

CVE-2019-18660: The Linux kernel on powerpc allowed Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c (bnc#1157038).

CVE-2019-18683: An issue was discovered in drivers/media/platform/vivid in the Linux kernel. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded.
There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free (bnc#1155897).

CVE-2019-18809: A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1156258).

CVE-2019-19046: A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering ida_simple_get() failure (bnc#1157304).

CVE-2019-19078: A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures (bnc#1157032).

CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures (bnc#1157333).

CVE-2019-19057: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures (bnc#1157197).

CVE-2019-19056: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures (bnc#1157197).

CVE-2019-19068: A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures (bnc#1157307).

CVE-2019-19063: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157298).

CVE-2019-19227: In the AppleTalk subsystem in the Linux kernel there was a potential NULL pointer dereference because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregister_snap_client (bnc#1157678).

CVE-2019-19081: A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157045).

CVE-2019-19080: Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157044).

CVE-2019-19065: A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering rhashtable_init() failures (bnc#1157191).

CVE-2019-19077: A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering copy to udata failures (bnc#1157171).

CVE-2019-19052: A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures (bnc#1157324).

CVE-2019-19067: Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering mfd_add_hotplug_devices() or pm_genpd_add_device() failures (bsc#1157180).

CVE-2019-19060: A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157178).

CVE-2019-19049: A memory leak in the unittest_data_add() function in drivers/of/unittest.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering of_fdt_unflatten_tree() failures (bsc#1157173).

CVE-2019-19075: A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures (bnc#1157162).

CVE-2019-19058: A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering alloc_page() failures (bnc#1157145).

CVE-2019-19074: A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157143).

CVE-2019-19073: Fixed memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c allowed attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures (bnc#1157070).

CVE-2019-19083: Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157049).

CVE-2019-19082: Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157046).

CVE-2019-15916: An issue was discovered in the Linux kernel There was a memory leak in register_queue_kobjects() in net/core/net-sysfs.c, which will cause denial of service (bnc#1149448).

CVE-2019-0154: Insufficient access control in subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 and E-2100 Processor Families may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1135966).

CVE-2019-0155: Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and E-2200 Processor Families; Intel(R) Graphics Driver for Windows (DCH) or 26.20.100.6812 and before 21.20.x.5077 (aka15.45.5077), i915 Linux Driver for Intel(R) Processor Graphics before versions 5.4-rc7, 5.3.11, 4.19.84, 4.14.154, 4.9.201, 4.4.201 may have allowed an authenticated user to potentially enable escalation of privilege via local access (bnc#1135967).

CVE-2019-16231: drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 did not check the alloc_workqueue return value, leading to a NULL pointer dereference (bnc#1150466).

CVE-2019-18805: An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel There was a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact (bnc#1156187).

CVE-2019-17055: base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel did not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket (bnc#1152782).

CVE-2019-16995: In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fails to add a port, which may cause denial of service, aka CID-6caabe7f197d (bnc#1152685).

CVE-2019-11135: TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access (bnc#1139073).

CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 did not check the alloc_workqueue return value, leading to a NULL pointer dereference (bnc#1150457).

CVE-2018-12207: Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may have allowed an authenticated user to potentially enable denial of service of the host system via local access (bnc#1117665).

CVE-2019-10220: Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists (bnc#1144903).

CVE-2019-17666: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow (bnc#1154372).

CVE-2019-16232: drivers/net/wireless/marvell/libertas/if_sdio.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference (bnc#1150465).

CVE-2019-16234: drivers/net/wireless/intel/iwlwifi/pcie/trans.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference (bnc#1150452).

CVE-2019-17133: cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c did not reject a long SSID IE, leading to a Buffer Overflow (bnc#1153158).

CVE-2019-17056: llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel did not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-3a359798b176 (bnc#1152788).

CVE-2019-14821: An out-of-bounds access issue was found in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation (bnc#1151350).

CVE-2017-18595: An issue was discovered in the Linux kernel A double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c (bnc#1149555).

CVE-2019-9506: The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and did not prevent an attacker from influencing the key length negotiation. This allowed practical brute-force attacks (aka 'KNOB') that can decrypt traffic and inject arbitrary ciphertext without the victim noticing (bnc#1146042).

CVE-2019-14835: A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration (bnc#1150112).

CVE-2019-9456: Ther is an issue inside the USB monitor driver that can lead to a possible OOB write due to a missing bounds check (bnc#1150025).

CVE-2019-15031: In the Linux kernel on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt (bnc#1149713).

CVE-2019-15030: In the Linux kernel on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception (bnc#1149713).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-15916: Fixed a memory leak in register_queue_kobjects() which might have led denial of service (bsc#1149448).

CVE-2019-0154: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable denial of service via local access (bsc#1135966).

CVE-2019-0155: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1135967).

CVE-2019-16231: Fixed a NULL pointer dereference due to lack of checking the alloc_workqueue return value (bsc#1150466).

CVE-2019-18805: Fixed an integer overflow in tcp_ack_update_rtt() leading to a denial of service or possibly unspecified other impact (bsc#1156187).

CVE-2019-17055: Enforced CAP_NET_RAW in the AF_ISDN network module to restrict unprivileged users to create a raw socket (bsc#1152782).

CVE-2019-16995: Fixed a memory leak in hsr_dev_finalize() which may have caused denial of service (bsc#1152685).

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.(bsc#1139073). The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW). The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference.
(bsc#1150457).

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903)

CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

CVE-2019-15291: Fixed a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function (bsc#1146519).

CVE-2019-14821: Fixed an out-of-bounds access resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).

CVE-2017-18595: Fixed a double free which caused by the function allocate_trace_buffer (bsc#1149555).

CVE-2019-9506: Fixed an issue with Bluetooth which permited low encryption key length and did not prevent an attacker from influencing the key length negotiation allowing brute-force attacks (bsc#1137865).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-19081: Fixed a memory leak in the nfp_flower_spawn_vnic_reprs() could have allowed attackers to cause a denial of service (bsc#1157045).

CVE-2019-19080: Fixed four memory leaks in the nfp_flower_spawn_phy_reprs() could have allowed attackers to cause a denial of service (bsc#1157044).

CVE-2019-19052: Fixed a memory leak in the gs_can_open() which could have led to denial of service (bsc#1157324).

CVE-2019-19067: Fixed multiple memory leaks in acp_hw_init (bsc#1157180).

CVE-2019-19060: Fixed a memory leak in the adis_update_scan_mode() which could have led to denial of service (bsc#1157178).

CVE-2019-19049: Fixed a memory leak in unittest_data_add (bsc#1157173).

CVE-2019-19075: Fixed a memory leak in the ca8210_probe() which could have led to denial of service by triggering ca8210_get_platform_data() failures (bsc#1157162).

CVE-2019-19058: Fixed a memory leak in the alloc_sgtable() which could have led to denial of service by triggering alloc_page() failures (bsc#1157145).

CVE-2019-19074: Fixed a memory leak in the ath9k_wmi_cmd() function which could have led to denial of service (bsc#1157143).

CVE-2019-19073: Fixed multiple memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c which could have led to denial of service by triggering wait_for_completion_timeout() failures (bsc#1157070).

CVE-2019-19083: Fixed multiple memory leaks in *clock_source_create() functions which could have led to denial of service (bsc#1157049).

CVE-2019-19082: Fixed multiple memory leaks in *create_resource_pool() which could have led to denial of service (bsc#1157046).

CVE-2019-15916: Fixed a memory leak in register_queue_kobjects() which might have led denial of service (bsc#1149448).

CVE-2019-0154: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable denial of service via local access (bsc#1135966).

CVE-2019-0155: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1135967).

CVE-2019-16231: Fixed a NULL pointer dereference due to lack of checking the alloc_workqueue return value (bsc#1150466).

CVE-2019-18805: Fixed an integer overflow in tcp_ack_update_rtt() leading to a denial of service or possibly unspecified other impact (bsc#1156187).

CVE-2019-17055: Enforced CAP_NET_RAW in the AF_ISDN network module to restrict unprivileged users to create a raw socket (bsc#1152782).

CVE-2019-16995: Fixed a memory leak in hsr_dev_finalize() which may have caused denial of service (bsc#1152685).

CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference.
(bsc#1150457).

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903)

CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's kvm hypervisor. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).

CVE-2017-18595: A double free in allocate_trace_buffer was fixed (bnc#1149555).

CVE-2019-9506: The Bluetooth BR/EDR specification used to permit sufficiently low encryption key length and did not prevent an attacker from influencing the key length negotiation. This allowed practical brute-force attacks (aka 'KNOB') that could decrypt traffic and inject arbitrary ciphertext without the victim noticing (bnc#1137865).

CVE-2019-14835: A buffer overflow flaw was found in the kernel's vhost functionality that translates virtqueue buffers to IOVs. A privileged guest user able to pass descriptors with invalid length to the host could use this flaw to increase their privileges on the host (bnc#1150112).

CVE-2019-9456: An out-of-bounds write in the USB monitor driver has been fixed. This issue could lead to local escalation of privilege with System execution privileges needed. (bnc#1150025).

CVE-2019-15030, CVE-2019-15031: On the powerpc platform, a local user could read vector registers of other users' processes via an interrupt (bsc#1149713).

CVE-2019-18683: An issue was discovered in drivers/media/platform/vivid. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free (bnc#1155897).

CVE-2019-18809: A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559 (bnc#1156258).

CVE-2019-19078: A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-b8d17e7d93d2 (bnc#1157032).

CVE-2019-18660: The Linux kernel on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c (bnc#1157038).

CVE-2019-14895: A heap-based buffer overflow was discovered in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1157158).

CVE-2019-19065: A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c allows attackers to cause a denial of service (memory consumption) by triggering rhashtable_init() failures, aka CID-34b3be18a04e (bnc#1157191).

CVE-2019-19057: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c allow attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-d10dcb615c8e (bnc#1157193).

CVE-2019-19056: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c allows attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-db8fd2cde932 (bnc#1157197).

CVE-2019-19063: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c allow attackers to cause a denial of service (memory consumption), aka CID-3f9361695113 (bnc#1157298).

CVE-2019-19046: A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c allow attackers to cause a denial of service (bsc#1157304).

CVE-2019-19068: A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-a2cdd07488e6 (bnc#1157307).

CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042 (bnc#1157333).

CVE-2019-19227: In the AppleTalk subsystem, there is a potential NULL pointer dereference because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregister_snap_client, aka CID-9804501fa122 (bnc#1157678).

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - ocfs2: protect extent tree in     ocfs2_prepare_inode_for_write (Shuning Zhang) [Orabug:
    30036349]

  - ocfs2: direct-IO: protect get_blocks (Junxiao Bi)     [Orabug: 30036349]

  - SUNRPC: Remove xprt_connect_status (Trond Myklebust)     [Orabug: 30165838]

  - SUNRPC: Handle ENETDOWN errors (Trond Myklebust)     [Orabug: 30165838]

  - vhost: make sure log_num < in_num (yongduan) [Orabug:
    30312787] (CVE-2019-14835)

  - vhost: block speculation of translated descriptors     (Michael S. Tsirkin) [Orabug: 30312787] (CVE-2019-14835)

  - vhost: Fix Spectre V1 vulnerability (Jason Wang)     [Orabug: 30312787]

  - array_index_nospec: Sanitize speculative array     de-references (Dan Williams) [Orabug: 30312787]

  - net: hsr: fix memory leak in hsr_dev_finalize (Mao     Wenan) [Orabug: 30444853] (CVE-2019-16995)

  - ieee802154: enforce CAP_NET_RAW for raw sockets (Ori     Nimron) [Orabug: 30444946] (CVE-2019-17053)

  - mISDN: enforce CAP_NET_RAW for raw sockets (Ori Nimron)     [Orabug: 30445158] (CVE-2019-17055)

  - net: sit: fix memory leak in sit_init_net (Mao Wenan)     [Orabug: 30445305] (CVE-2019-16994)

  - media: dvb: usb: fix use after free in     dvb_usb_device_exit (Oliver Neukum) [Orabug: 30490491]     (CVE-2019-15213)

  - media: cpia2_usb: first wake up, then free in disconnect     (Oliver Neukum) [Orabug: 30511741] (CVE-2019-15215)

  - media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in     zr364xx_vidioc_querycap (Vandana BN) [Orabug: 30532774]     (CVE-2019-15217)

  - target: Propagate backend read-only to core_tpg_add_lun     (Nicholas Bellinger) [Orabug: 30538419]

  - kvm: mmu: ITLB_MULTIHIT mitigation selection (Kanth     Ghatraju) [Orabug: 30539766]

  - cpu/speculation: Uninline and export CPU mitigations     helpers (Kanth Ghatraju) [Orabug: 30539766]

  - rds: Use correct conn when dropping connections due to     cancel (H&aring kon Bugge) [Orabug: 30316058]

  - rds: ib: Optimize rds_ib_laddr_check (H&aring kon Bugge)     [Orabug: 30327671]

  - rds: Bring loop-back peer down as well (H&aring kon     Bugge) [Orabug: 30271704]

  - rds: ib: Avoid connect retry on loopback connections     (H&aring kon Bugge) 

  - rds: ib: Qualify CM REQ duplicate detection with     connection being up (H&aring kon Bugge) [Orabug:
    30062150]

  - rds: Further prioritize local loop-back connections     (H&aring kon Bugge) 

  - rds: Fix initial zero delay when queuing re-connect work     (H&aring kon Bugge) 

  - rds: Re-introduce separate work-queue for local     connections (H&aring kon Bugge) [Orabug: 30062150]

  - rds: Re-factor and avoid superfluous queuing of shutdown     work (H&aring kon Bugge) [Orabug: 29994551]

  - rds: ib: Flush ARP cache when connection attempt is     rejected (H&aring kon Bugge) [Orabug: 29994550]

  - rds: ib: Fix incorrect setting of cp_reconnect_racing     (H&aring kon Bugge) 

  - RDMA/cma: Make # CM retries configurable (H&aring kon     Bugge) [Orabug: 29994555]

  - rds: Re-factor and avoid superfluous queuing of     reconnect work (H&aring kon Bugge) [Orabug: 29994558]

  - rds: ib: Correct the cm_id compare commit (H&aring kon     Bugge) [Orabug: 29994560]

  - rds: Increase entropy in hashing (H&aring kon Bugge)     [Orabug: 29994561]

  - rds: ib: Resurrect the CQs instead of delete+create     (H&aring kon Bugge) 

  - rds: Avoid queuing superfluous send and recv work     (H&aring kon Bugge) 

  - x86/tsx: Add config options to set tsx=on|off|auto     (Michal Hocko) [Orabug: 30517133] (CVE-2019-11135)

  - x86/speculation/taa: Add documentation for TSX Async     Abort (Pawan Gupta) [Orabug: 30517133] (CVE-2019-11135)

  - x86/tsx: Add 'auto' option to the tsx= cmdline parameter     (Pawan Gupta) [Orabug: 30517133] (CVE-2019-11135)

  - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled     (Pawan Gupta) [Orabug: 30517133] (CVE-2019-11135)

  - x86/speculation/taa: Add sysfs reporting for TSX Async     Abort (Pawan Gupta) [Orabug: 30517133] (CVE-2019-11135)

  - x86/speculation/taa: Add mitigation for TSX Async Abort     (Kanth Ghatraju) [Orabug: 30517133] (CVE-2019-11135)

  - x86/cpu: Add a 'tsx=' cmdline option with TSX disabled     by default (Pawan Gupta) [Orabug: 30517133]     (CVE-2019-11135)

  - x86/cpu: Add a helper function x86_read_arch_cap_msr     (Pawan Gupta) [Orabug: 30517133] (CVE-2019-11135)

  - x86/msr: Add the IA32_TSX_CTRL MSR (Pawan Gupta)     [Orabug: 30517133] (CVE-2019-11135)

  - kvm: x86: mmu: Recovery of shattered NX large pages     (Junaid Shahid) [Orabug: 30517059] (CVE-2018-12207)

  - kvm: Add helper function for creating VM worker threads     (Junaid Shahid) [Orabug: 30517059] (CVE-2018-12207)

  - kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini)     [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: remove now unneeded hugepage gfn adjustment     (Paolo Bonzini) [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: make FNAME(fetch) and __direct_map more     similar (Paolo Bonzini) [Orabug: 30517059]     (CVE-2018-12207)

  - kvm: x86: Do not release the page inside mmu_set_spte     (Junaid Shahid) [Orabug: 30517059] (CVE-2018-12207)

  - x86/cpu: Add Tremont to the cpu vulnerability whitelist     (Pawan Gupta) [Orabug: 30517059] (CVE-2018-12207)

  - x86: Add ITLB_MULTIHIT bug infrastructure (Pawan Gupta)     [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Move mapping_level_dirty_bitmap call in     mapping_level (Takuya Yoshikawa) [Orabug: 30517059]     (CVE-2018-12207)

  - Revert 'KVM: x86: use the fast way to invalidate all     pages' (Sean Christopherson) [Orabug: 30517059]     (CVE-2018-12207)

  - kvm: Convert kvm_lock to a mutex (Junaid Shahid)     [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Simplify force_pt_level calculation code     in FNAME(page_fault) (Takuya Yoshikawa) [Orabug:
    30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Make force_pt_level bool (Takuya     Yoshikawa) [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Remove unused parameter parent_pte from     kvm_mmu_get_page (Takuya Yoshikawa) [Orabug: 30517059]     (CVE-2018-12207)

  - KVM: x86: extend usage of RET_MMIO_PF_* constants (Paolo     Bonzini) [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Make mmu_set_spte return emulate value     (Takuya Yoshikawa) [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Move parent_pte handling from     kvm_mmu_get_page to link_shadow_page (Takuya Yoshikawa)     [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Move initialization of parent_ptes out     from kvm_mmu_alloc_page (Takuya Yoshikawa) [Orabug:
    30517059] (CVE-2018-12207)

  - scsi: qla2xxx: Fix NULL pointer crash due to probe     failure [Orabug: 30161119]

  - i2c: core-smbus: prevent stack corruption on read     I2C_BLOCK_DATA (Jeremy Compostella) [Orabug: 30210503]     (CVE-2017-18551)

  - scsi: qla2xxx: Ability to process multiple SGEs in     Command SGL for CT passthrough commands. (Giridhar     Malavali) [Orabug: 30256423]

  - net-sysfs: Fix mem leak in netdev_register_kobject     (YueHaibing) [Orabug: 30350263] (CVE-2019-15916)

  - Drivers: hv: vmbus: add special crash handler (Vitaly     Kuznetsov)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4850 advisory.

    - vhost: make sure log_num < in_num (yongduan)  [Orabug: 30312787]  {CVE-2019-14835}
    - vhost: block speculation of translated descriptors (Michael S. Tsirkin)  [Orabug: 30312787]     {CVE-2019-14835}
    - net: hsr: fix memory leak in hsr_dev_finalize() (Mao Wenan)  [Orabug: 30444853]  {CVE-2019-16995}
    - ieee802154: enforce CAP_NET_RAW for raw sockets (Ori Nimron)  [Orabug: 30444946]  {CVE-2019-17053}
    - mISDN: enforce CAP_NET_RAW for raw sockets (Ori Nimron)  [Orabug: 30445158]  {CVE-2019-17055}
    - net: sit: fix memory leak in sit_init_net() (Mao Wenan)  [Orabug: 30445305]  {CVE-2019-16994}
    - media: dvb: usb: fix use after free in dvb_usb_device_exit (Oliver Neukum)  [Orabug: 30490491]     {CVE-2019-15213}
    - media: cpia2_usb: first wake up, then free in disconnect (Oliver Neukum)  [Orabug: 30511741]     {CVE-2019-15215}
    - media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap (Vandana BN)  [Orabug:
    30532774]  {CVE-2019-15217}
    - x86/tsx: Add config options to set tsx=on|off|auto (Michal Hocko)  [Orabug: 30517133]  {CVE-2019-11135}
    - x86/speculation/taa: Add documentation for TSX Async Abort (Pawan Gupta)  [Orabug: 30517133]     {CVE-2019-11135}
    - x86/tsx: Add 'auto' option to the tsx= cmdline parameter (Pawan Gupta)  [Orabug: 30517133]     {CVE-2019-11135}
    - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled (Pawan Gupta)  [Orabug: 30517133]     {CVE-2019-11135}
    - x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Pawan Gupta)  [Orabug: 30517133]     {CVE-2019-11135}
    - x86/speculation/taa: Add mitigation for TSX Async Abort (Kanth Ghatraju)  [Orabug: 30517133]     {CVE-2019-11135}
    - x86/cpu: Add a 'tsx=' cmdline option with TSX disabled by default (Pawan Gupta)  [Orabug: 30517133]     {CVE-2019-11135}
    - x86/cpu: Add a helper function x86_read_arch_cap_msr() (Pawan Gupta)  [Orabug: 30517133]     {CVE-2019-11135}
    - x86/msr: Add the IA32_TSX_CTRL MSR (Pawan Gupta)  [Orabug: 30517133]  {CVE-2019-11135}
    - kvm: x86: mmu: Recovery of shattered NX large pages (Junaid Shahid)  [Orabug: 30517059]     {CVE-2018-12207}
    - kvm: Add helper function for creating VM worker threads (Junaid Shahid)  [Orabug: 30517059]     {CVE-2018-12207}
    - kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini)  [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini)  [Orabug: 30517059]     {CVE-2018-12207}
    - KVM: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini)  [Orabug: 30517059]     {CVE-2018-12207}
    - kvm: x86: Do not release the page inside mmu_set_spte() (Junaid Shahid)  [Orabug: 30517059]     {CVE-2018-12207}
    - x86/cpu: Add Tremont to the cpu vulnerability whitelist (Pawan Gupta)  [Orabug: 30517059]     {CVE-2018-12207}
    - x86: Add ITLB_MULTIHIT bug infrastructure (Pawan Gupta)  [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: MMU: Move mapping_level_dirty_bitmap() call in mapping_level() (Takuya Yoshikawa)  [Orabug:
    30517059]  {CVE-2018-12207}
    - Revert 'KVM: x86: use the fast way to invalidate all pages' (Sean Christopherson)  [Orabug: 30517059]     {CVE-2018-12207}
    - kvm: Convert kvm_lock to a mutex (Junaid Shahid)  [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: MMU: Simplify force_pt_level calculation code in FNAME(page_fault)() (Takuya Yoshikawa)     [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: MMU: Make force_pt_level bool (Takuya Yoshikawa)  [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: MMU: Remove unused parameter parent_pte from kvm_mmu_get_page() (Takuya Yoshikawa)  [Orabug:
    30517059]  {CVE-2018-12207}
    - KVM: x86: extend usage of RET_MMIO_PF_* constants (Paolo Bonzini)  [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: MMU: Make mmu_set_spte() return emulate value (Takuya Yoshikawa)  [Orabug: 30517059]     {CVE-2018-12207}
    - KVM: x86: MMU: Move parent_pte handling from kvm_mmu_get_page() to link_shadow_page() (Takuya Yoshikawa)     [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: MMU: Move initialization of parent_ptes out from kvm_mmu_alloc_page() (Takuya Yoshikawa)     [Orabug: 30517059]  {CVE-2018-12207}
    - i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA (Jeremy Compostella)  [Orabug:
    30210503]  {CVE-2017-18551}
    - net-sysfs: Fix mem leak in netdev_register_kobject (YueHaibing)  [Orabug: 30350263]  {CVE-2019-15916}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735 CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251 CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

CVE-2019-17055: The AF_ISDN network module in the Linux kernel did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bnc#1152782).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

CVE-2019-16413: The 9p filesystem did not protect i_size_write() properly, which caused an i_size_read() infinite loop and denial of service on SMP systems (bnc#1151347).

CVE-2019-15902: A backporting issue was discovered that re-introduced the Spectre vulnerability it had aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped (bnc#1149376).

CVE-2019-15291: Fixed a NULL pointer dereference issue that could be caused by a malicious USB device (bnc#1146519).

CVE-2019-15807: Fixed a memory leak in the SCSI module that could be abused to cause denial of service (bnc#1148938).

CVE-2019-13272: Fixed a mishandled the recording of the credentials of a process that wants to create a ptrace relationship, which allowed local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker).
(bnc#1140671).

CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's kvm hypervisor. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).

CVE-2019-15505: An out-of-bounds issue had been fixed that could be caused by crafted USB device traffic (bnc#1147122).

CVE-2017-18595: A double free in allocate_trace_buffer was fixed (bnc#1149555).

CVE-2019-14835: A buffer overflow flaw was found in the kernel's vhost functionality that translates virtqueue buffers to IOVs. A privileged guest user able to pass descriptors with invalid length to the host could use this flaw to increase their privileges on the host (bnc#1150112).

CVE-2019-15216: A NULL pointer dereference was fixed that could be malicious USB device (bnc#1146361).

CVE-2019-15924: A a NULL pointer dereference has been fixed in the drivers/net/ethernet/intel/fm10k module (bnc#1149612).

CVE-2019-9456: An out-of-bounds write in the USB monitor driver has been fixed. This issue could lead to local escalation of privilege with System execution privileges needed. (bnc#1150025).

CVE-2019-15926: An out-of-bounds access was fixed in the drivers/net/wireless/ath/ath6kl module. (bnc#1149527).

CVE-2019-15927: An out-of-bounds access was fixed in the sound/usb/mixer module (bnc#1149522).

CVE-2019-15666: There was an out-of-bounds array access in the net/xfrm module that could cause denial of service (bnc#1148394).

CVE-2019-15219: A NULL pointer dereference was fixed that could be abused by a malicious USB device (bnc#1146519 1146524).

CVE-2019-15220: A use-after-free issue was fixed that could be caused by a malicious USB device (bnc#1146519 1146526).

CVE-2019-15221: A NULL pointer dereference was fixed that could be caused by a malicious USB device (bnc#1146519 1146529).

CVE-2019-14814: A heap-based buffer overflow was fixed in the marvell wifi chip driver. That issue allowed local users to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1146512).

CVE-2019-14815: A missing length check while parsing WMM IEs was fixed (bsc#1146512, bsc#1146514, bsc#1146516).

CVE-2019-14816: A heap-based buffer overflow in the marvell wifi chip driver was fixed. Local users would have abused this issue to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1146516).

CVE-2017-18509: An issue in net/ipv6 as fixed. By setting a specific socket option, an attacker could control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. (bnc#1145477)

CVE-2019-9506: The Bluetooth BR/EDR specification used to permit sufficiently low encryption key length and did not prevent an attacker from influencing the key length negotiation. This allowed practical brute-force attacks (aka 'KNOB') that could decrypt traffic and inject arbitrary ciphertext without the victim noticing (bnc#1137865).

CVE-2019-15098: A NULL pointer dereference in drivers/net/wireless/ath was fixed (bnc#1146378).

CVE-2019-15290: A NULL pointer dereference in ath6kl_usb_alloc_urb_from_pipe was fixed (bsc#1146378).

CVE-2019-15212: A double-free issue was fixed in drivers/usb driver (bnc#1146391).

CVE-2016-10906: A use-after-free issue was fixed in drivers/net/ethernet/arc (bnc#1146584).

CVE-2019-15211: A use-after-free issue caused by a malicious USB device was fixed in the drivers/media/v4l2-core driver (bnc#1146519).

CVE-2019-15217: A a NULL pointer dereference issue caused by a malicious USB device was fixed in the drivers/media/usb/zr364xx driver (bnc#1146519).

CVE-2019-15214: An a use-after-free issue in the sound subsystem was fixed (bnc#1146519).

CVE-2019-15218: A NULL pointer dereference caused by a malicious USB device was fixed in the drivers/media/usb/siano driver (bnc#1146413).

CVE-2019-15215: A use-after-free issue caused by a malicious USB device was fixed in the drivers/media/usb/cpia2 driver (bnc#1146425).

CVE-2018-20976: A use-after-free issue was fixed in the fs/xfs driver (bnc#1146285).

CVE-2019-0154: An unprotected read access to i915 registers has been fixed that could have been abused to facilitate a local denial-of-service attack. (bsc#1135966)

CVE-2019-0155: A privilege escalation vulnerability has been fixed in the i915 module that allowed batch buffers from user mode to gain super user privileges. (bsc#1135967)

CVE-2019-16231: The fjes driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bnc#1150466)

CVE-2019-18805: Fix signed integer overflow in tcp_ack_update_rtt() that could have lead to a denial of service or possibly unspecified other impact (bsc#1156187)

CVE-2019-18680: A NULL pointer dereference in rds_tcp_kill_sock() could cause denial of service (bnc#1155898)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2019-0154: An unprotected read access to i915     registers has been fixed that could have been abused to     facilitate a local denial-of-service attack.
    (bsc#1135966)

  - CVE-2019-0155: A privilege escalation vulnerability has     been fixed in the i915 module that allowed batch buffers     from user mode to gain super user privileges.
    (bsc#1135967)

  - CVE-2019-16231: drivers/net/fjes/fjes_main.c did not     check the alloc_workqueue return value, leading to a     NULL pointer dereference (bnc#1150466).

  - CVE-2019-18805: There was a net/ipv4/tcp_input.c signed     integer overflow in tcp_ack_update_rtt() when userspace     writes a very large integer to     /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial     of service or possibly unspecified other impact, aka     CID-19fad20d15a6 (bnc#1156187).

  - CVE-2019-17055: base_sock_create in     drivers/isdn/mISDN/socket.c in the AF_ISDN network     module did not enforce CAP_NET_RAW, which means that     unprivileged users can create a raw socket, aka     CID-b91ee4aa2a21 (bnc#1152782).

  - CVE-2019-16995: A memory leak exits in     hsr_dev_finalize() in net/hsr/hsr_device.c, if     hsr_add_port fails to add a port, which may cause denial     of service, aka CID-6caabe7f197d (bnc#1152685).

  - CVE-2019-11135: Aborting an asynchronous TSX operation     on Intel CPUs with Transactional Memory support could be     used to facilitate sidechannel information leaks out of     microarchitectural buffers, similar to the previously     described 'Microarchitectural Data Sampling' attack.

    The Linux kernel was supplemented with the option to     disable TSX operation altogether (requiring CPU     Microcode updates on older systems) and better flushing     of microarchitectural buffers (VERW).

    The set of options available is described in our TID at     https://www.suse.com/support/kb/doc/?id=7024251

  - CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not     check the alloc_workqueue return value, leading to a     NULL pointer dereference (bnc#1150457).

  - CVE-2018-12207: Untrusted virtual machines on Intel CPUs     could exploit a race condition in the Instruction Fetch     Unit of the Intel CPU to cause a Machine Exception     during Page Size Change, causing the CPU core to be     non-functional.

    The Linux Kernel kvm hypervisor was adjusted to avoid     page size changes in executable pages by splitting /     merging huge pages into small pages as needed.

    More information can be found on     https://www.suse.com/support/kb/doc/?id=7023735

  - CVE-2019-10220: Added sanity checks on the pathnames     passed to the user space. (bsc#1144903).

The following non-security bugs were fixed :

  - ALSA: bebob: Fix prototype of helper function to return     negative value (bsc#1051510).

  - ALSA: bebob: fix to detect configured source of sampling     clock for Focusrite Saffire Pro i/o series (git-fixes).

  - ALSA: hda: Add Elkhart Lake PCI ID (bsc#1051510).

  - ALSA: hda: Add Tigerlake/Jasperlake PCI ID     (bsc#1051510).

  - ALSA: hda/ca0132 - Fix possible workqueue stall     (bsc#1155836).

  - ALSA: hda/realtek - Add support for ALC623     (bsc#1051510).

  - ALSA: hda/realtek - Add support for ALC711     (bsc#1051510).

  - ALSA: hda/realtek - Fix 2 front mics of codec 0x623     (bsc#1051510).

  - ALSA: timer: Fix incorrectly assigned timer instance     (git-fixes).

  - ALSA: timer: Fix mutex deadlock at releasing card     (bsc#1051510).

  - arcnet: provide a buffer big enough to actually receive     packets (networking-stable-19_09_30).

  - ASoc: rockchip: i2s: Fix RPM imbalance (bsc#1051510).

  - ASoC: rsnd: Reinitialize bit clock inversion flag for     every format setting (bsc#1051510).

  - bpf: fix use after free in prog symbol exposure     (bsc#1083647).

  - btrfs: block-group: Fix a memory leak due to missing     btrfs_put_block_group() (bsc#1155178).

  - btrfs: qgroup: Always free PREALLOC META reserve in     btrfs_delalloc_release_extents() (bsc#1155179).

  - btrfs: tracepoints: Fix bad entry members of qgroup     events (bsc#1155186).

  - btrfs: tracepoints: Fix wrong parameter order for qgroup     events (bsc#1155184).

  - can: dev: call netif_carrier_off() in register_candev()     (bsc#1051510).

  - crypto: af_alg - consolidation of duplicate code     (bsc#1154737).

  - crypto: af_alg - fix race accessing cipher request     (bsc#1154737).

  - crypto: af_alg - Fix race around ctx->rcvused by making     it atomic_t (bsc#1154737).

  - crypto: af_alg - Initialize sg_num_bytes in error code     path (bsc#1051510).

  - crypto: af_alg - remove locking in async callback     (bsc#1154737).

  - crypto: af_alg - update correct dst SGL entry     (bsc#1051510).

  - crypto: af_alg - wait for data at beginning of recvmsg     (bsc#1154737).

  - crypto: algif_aead - copy AAD from src to dst     (bsc#1154737).

  - crypto: algif_aead - fix reference counting of null     skcipher (bsc#1154737).

  - crypto: algif_aead - overhaul memory management     (bsc#1154737).

  - crypto: algif_aead - skip SGL entries with NULL page     (bsc#1154737).

  - crypto: algif - return error code when no data was     processed (bsc#1154737).

  - crypto: algif_skcipher - overhaul memory management     (bsc#1154737).

  - cxgb4:Fix out-of-bounds MSI-X info array access     (networking-stable-19_10_05).

  - dmaengine: bcm2835: Print error in case setting DMA mask     fails (bsc#1051510).

  - dmaengine: imx-sdma: fix size check for sdma     script_number (bsc#1051510).

  - drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50     (bsc#1051510).

  - drm/i915: Add gen9 BCS cmdparsing (bsc#1135967)

  - drm/i915: Add support for mandatory cmdparsing     (bsc#1135967)

  - drm/i915: Allow parsing of unsized batches (bsc#1135967)

  - drm/i915/cmdparser: Add support for backward jumps     (bsc#1135967)

  - drm/i915/cmdparser: Ignore Length operands during     command matching (bsc#1135967)

  - drm/i915/cmdparser: Use explicit goto for error paths     (bsc#1135967)

  - drm/i915: Disable Secure Batches for gen6+

  - drm/i915/gen8+: Add RC6 CTX corruption WA (bsc#1135967)

  - drm/i915/gtt: Add read only pages to gen8_pte_encode     (bsc#1135967)

  - drm/i915/gtt: Disable read-only support under GVT     (bsc#1135967)

  - drm/i915/gtt: Read-only pages for insert_entries on bdw     (bsc#1135967)

  - drm/i915: Lower RM timeout to avoid DSI hard hangs     (bsc#1135967)

  - drm/i915: Prevent writing into a read-only object via a     GGTT mmap (bsc#1135967)

  - drm/i915: Remove Master tables from cmdparser

  - drm/i915: Rename gen7 cmdparser tables (bsc#1135967)

  - drm/i915: Support ro ppgtt mapped cmdparser shadow     buffers (bsc#1135967)

  - efi: cper: print AER info of PCIe fatal error     (bsc#1051510).

  - efi/memattr: Do not bail on zero VA if it equals the     region's PA (bsc#1051510).

  - efivar/ssdt: Do not iterate over EFI vars if no SSDT     override was specified (bsc#1051510).

  - HID: fix error message in hid_open_report()     (bsc#1051510).

  - HID: logitech-hidpp: do all FF cleanup in     hidpp_ff_destroy() (bsc#1051510).

  - hso: fix NULL-deref on tty open (bsc#1051510).

  - hyperv: set nvme msi interrupts to unmanaged     (jsc#SLE-8953, jsc#SLE-9221, jsc#SLE-4941, bsc#1119461,     bsc#1119465, bsc#1138190, bsc#1154905).

  - IB/core: Add mitigation for Spectre V1 (bsc#1155671)

  - ieee802154: ca8210: prevent memory leak (bsc#1051510).

  - input: synaptics-rmi4 - avoid processing unknown IRQs     (bsc#1051510).

  - integrity: prevent deadlock during digsig verification     (bsc#1090631).

  - ipv6: drop incoming packets having a v4mapped source     address (networking-stable-19_10_05).

  - ipv6: Handle missing host route in __ipv6_ifa_notify     (networking-stable-19_10_05).

  - iwlwifi: do not panic in error path on non-msix systems     (bsc#1155692).

  - iwlwifi: exclude GEO SAR support for 3168 (git-fixes).

  - kABI workaround for crypto/af_alg changes (bsc#1154737).

  - kABI workaround for drm_vma_offset_node readonly field     addition (bsc#1135967)

  - ksm: cleanup stable_node chain collapse case     (bnc#1144338).

  - ksm: fix use after free with merge_across_nodes = 0     (bnc#1144338).

  - ksm: introduce ksm_max_page_sharing per page     deduplication limit (bnc#1144338).

  - ksm: optimize refile of stable_node_dup at the head of     the chain (bnc#1144338).

  - ksm: swap the two output parameters of chain/chain_prune     (bnc#1144338).

  - KVM: vmx, svm: always run with EFER.NXE=1 when shadow     paging is active (bsc#1117665).

  - mac80211: fix txq NULL pointer dereference     (bsc#1051510).

  - mac80211: Reject malformed SSID elements (bsc#1051510).

  - md/raid0: avoid RAID0 data corruption due to layout     confusion (bsc#1140090).

  - md/raid0: fix warning message for parameter     default_layout (bsc#1140090).

  - Move upstreamed CA0132 fix into sorted section

  - netfilter: nf_nat: do not bug when mapping already     exists (bsc#1146612).

  - net: openvswitch: free vport unless register_netdevice()     succeeds (git-fixes).

  - net/phy: fix DP83865 10 Mbps HDX loopback disable     function (networking-stable-19_09_30).

  - net: qlogic: Fix memory leak in ql_alloc_large_buffers     (networking-stable-19_10_05).

  - net: qrtr: Stop rx_worker before freeing node     (networking-stable-19_09_30).

  - net/rds: Fix error handling in rds_ib_add_one()     (networking-stable-19_10_05).

  - net/rds: fix warn in rds_message_alloc_sgs     (bsc#1154848).

  - net/rds: remove user triggered WARN_ON in rds_sendmsg     (bsc#1154848).

  - net: Replace NF_CT_ASSERT() with WARN_ON()     (bsc#1146612).

  - net/sched: act_sample: do not push mac header on ip6gre     ingress (networking-stable-19_09_30).

  - net_sched: add policy validation for action attributes     (networking-stable-19_09_30).

  - net_sched: fix backward compatibility for TCA_ACT_KIND     (git-fixes).

  - net: Unpublish sk from sk_reuseport_cb before call_rcu     (networking-stable-19_10_05).

  - NFSv4.1 - backchannel request should hold ref on xprt     (bsc#1152624).

  - nl80211: fix NULL pointer dereference (bsc#1051510).

  - openvswitch: change type of UPCALL_PID attribute to     NLA_UNSPEC (networking-stable-19_09_30).

  - power: supply: max14656: fix potential use-after-free     (bsc#1051510).

  - qmi_wwan: add support for Cinterion CLS8 devices     (networking-stable-19_10_05).

  - r8152: Set macpassthru in reset_resume callback     (bsc#1051510).

  - rds: Fix warning (bsc#1154848).

  - Revert 'ALSA: hda: Flush interrupts on disabling'     (bsc#1051510).

  - Revert 'drm/radeon: Fix EEH during kexec' (bsc#1051510).

  - Revert synaptics-rmi4 patch due to regression     (bsc#1155982) Also blacklisting it

  - rpm/kernel-subpackage-spec: Mention debuginfo in the     subpackage description (bsc#1149119).

  - s390/cmf: set_schib_wait add timeout (bsc#1153509,     bsc#1153476).

  - s390/cpumsf: Check for CPU Measurement sampling     (bsc#1153681 LTC#181855).

  - sc16is7xx: Fix for 'Unexpected interrupt: 8'     (bsc#1051510).

  - sch_cbq: validate TCA_CBQ_WRROPT to avoid crash     (networking-stable-19_10_05).

  - sch_dsmark: fix potential NULL deref in dsmark_init()     (networking-stable-19_10_05).

  - sched/fair: Avoid divide by zero when rebalancing     domains (bsc#1096254).

  - sch_netem: fix a divide by zero in tabledist()     (networking-stable-19_09_30).

  - scsi: lpfc: Fix devices that do not return after devloss     followed by rediscovery (bsc#1137040).

  - scsi: lpfc: Limit xri count for kdump environment     (bsc#1154124).

  - scsi: qla2xxx: Add error handling for PLOGI ELS     passthrough (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Capture FW dump on MPI heartbeat stop     event (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Check for MB timeout while capturing     ISP27/28xx FW dump (bsc#1143706 bsc#1082635     bsc#1123034).

  - scsi: qla2xxx: Do command completion on abort timeout     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: do not use zero for FC4_PRIORITY_NVME     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Dual FCP-NVMe target port support     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix a dma_pool_free() call (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix device connect issues in P2P     configuration (bsc#1143706 bsc#1082635 bsc#1154526     bsc#1048942).

  - scsi: qla2xxx: Fix double scsi_done for abort path     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix driver unload hang (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix memory leak when sending I/O fails     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix N2N link reset (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix N2N link up fail (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix partial flash write of MBI     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix SRB leak on switch command timeout     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix stale mem access on driver unload     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix unbound sleep in fcport delete path     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: fixup incorrect usage of host_byte     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix wait condition in loop (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Improve logging for scan thread     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Initialized mailbox to prevent driver     load failure (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: initialize fc4_type_priority (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Optimize NPIV tear down process     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Remove an include directive (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: remove redundant assignment to pointer     host (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Retry PLOGI on FC-NVMe PRLI failure     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Set remove flag for all VP (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Silence fwdump template message     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: stop timer in shutdown path (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Update driver version to 10.01.00.20-k     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Update driver version to 10.01.00.21-k     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: sd: Ignore a failure to sync cache due to lack of     authorization (git-fixes).

  - scsi: storvsc: Add ability to change scsi queue depth     (bsc#1155021).

  - scsi: zfcp: fix reaction on bit error threshold     notification (bsc#1154956 LTC#182054).

  - serial: fix kernel-doc warning in comments     (bsc#1051510).

  - serial: mctrl_gpio: Check for NULL pointer     (bsc#1051510).

  - serial: uartlite: fix exit path NULL pointer     (bsc#1051510).

  - skge: fix checksum byte order     (networking-stable-19_09_30).

  - staging: rtl8188eu: fix null dereference when kzalloc     fails (bsc#1051510).

  - staging: wlan-ng: fix exit return when sme->key_idx >=     NUM_WEPKEYS (bsc#1051510).

  - supporte.conf: add efivarfs to kernel-default-base     (bsc#1154858).

  - tipc: fix unlimited bundling of small messages     (networking-stable-19_10_05).

  - tracing: Get trace_array reference for available_tracers     files (bsc#1156429).

  - usb: gadget: Reject endpoints with 0 maxpacket value     (bsc#1051510).

  - usb: gadget: udc: atmel: Fix interrupt storm in FIFO     mode (bsc#1051510).

  - usb: handle warm-reset port requests on hub resume     (bsc#1051510).

  - usb: ldusb: fix control-message timeout (bsc#1051510).

  - usb: ldusb: fix memleak on disconnect (bsc#1051510).

  - usb: ldusb: fix NULL-derefs on driver unbind     (bsc#1051510).

  - usb: ldusb: fix read info leaks (bsc#1051510).

  - usb: ldusb: fix ring-buffer locking (bsc#1051510).

  - usb: legousbtower: fix a signedness bug in tower_probe()     (bsc#1051510).

  - usb: legousbtower: fix memleak on disconnect     (bsc#1051510).

  - usb: serial: ti_usb_3410_5052: fix port-close races     (bsc#1051510).

  - usb: serial: whiteheat: fix line-speed endianness     (bsc#1051510).

  - usb: serial: whiteheat: fix potential slab corruption     (bsc#1051510).

  - usb-storage: Revert commit 747668dbc061 ('usb-storage:
    Set virt_boundary_mask to avoid SG overflows')     (bsc#1051510).

  - usb: udc: lpc32xx: fix bad bit shift operation     (bsc#1051510).

  - usb: usblp: fix use-after-free on disconnect     (bsc#1051510).

  - vsock: Fix a lockdep warning in __vsock_release()     (networking-stable-19_10_05).

  - x86/boot/64: Make level2_kernel_pgt pages invalid     outside kernel area (bnc#1153969).

  - x86/boot/64: Round memory hole size up to next PMD page     (bnc#1153969).

The SUSE Linux Enterprise 15-SP1 Azure Kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as More information can be found on https://www.suse.com/support/kb/doc/?id=7023735 (bnc#1117665 1152505 1155812 1155817 1155945) CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251 (bnc#1139073 1152497 1152505 1152506). CVE-2019-18805: There was a signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6 (bnc#1156187).

CVE-2019-17055: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bnc#1152782).

CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference.
(bsc#1150457).

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12-SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735 CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251 CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

CVE-2019-17055: The AF_ISDN network module in the Linux kernel did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bnc#1152782).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

CVE-2019-16413: The 9p filesystem did not protect i_size_write() properly, which caused an i_size_read() infinite loop and denial of service on SMP systems (bnc#1151347).

CVE-2019-15902: A backporting issue was discovered that re-introduced the Spectre vulnerability it had aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped (bnc#1149376).

CVE-2019-15291: Fixed a NULL pointer dereference issue that could be caused by a malicious USB device (bnc#1146519).

CVE-2019-15807: Fixed a memory leak in the SCSI module that could be abused to cause denial of service (bnc#1148938).

CVE-2019-13272: Fixed a mishandled the recording of the credentials of a process that wants to create a ptrace relationship, which allowed local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker).
(bnc#1140671).

CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's KVM hypervisor. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).

CVE-2019-15505: An out-of-bounds issue had been fixed that could be caused by crafted USB device traffic (bnc#1147122).

CVE-2017-18595: A double free in allocate_trace_buffer was fixed (bnc#1149555).

CVE-2019-14835: A buffer overflow flaw was found in the kernel's vhost functionality that translates virtqueue buffers to IOVs. A privileged guest user able to pass descriptors with invalid length to the host could use this flaw to increase their privileges on the host (bnc#1150112).

CVE-2019-15216: A NULL pointer dereference was fixed that could be malicious USB device (bnc#1146361).

CVE-2019-15924: A a NULL pointer dereference has been fixed in the drivers/net/ethernet/intel/fm10k module (bnc#1149612).

CVE-2019-9456: An out-of-bounds write in the USB monitor driver has been fixed. This issue could lead to local escalation of privilege with System execution privileges needed. (bnc#1150025).

CVE-2019-15926: An out-of-bounds access was fixed in the drivers/net/wireless/ath/ath6kl module. (bnc#1149527).

CVE-2019-15927: An out-of-bounds access was fixed in the sound/usb/mixer module (bnc#1149522).

CVE-2019-15666: There was an out-of-bounds array access in the net/xfrm module that could cause denial of service (bnc#1148394).

CVE-2017-18379: An out-of-boundary access was fixed in the drivers/nvme/target module (bnc#1143187).

CVE-2019-15219: A NULL pointer dereference was fixed that could be abused by a malicious USB device (bnc#1146519 1146524).

CVE-2019-15220: A use-after-free issue was fixed that could be caused by a malicious USB device (bnc#1146519 1146526).

CVE-2019-15221: A NULL pointer dereference was fixed that could be caused by a malicious USB device (bnc#1146519 1146529).

CVE-2019-14814: A heap-based buffer overflow was fixed in the marvell wifi chip driver. That issue allowed local users to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1146512).

CVE-2019-14815: A missing length check while parsing WMM IEs was fixed (bsc#1146512, bsc#1146514, bsc#1146516).

CVE-2019-14816: A heap-based buffer overflow in the marvell wifi chip driver was fixed. Local users would have abused this issue to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1146516).

CVE-2017-18509: An issue in net/ipv6 as fixed. By setting a specific socket option, an attacker could control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. (bnc#1145477)

CVE-2019-9506: The Bluetooth BR/EDR specification used to permit sufficiently low encryption key length and did not prevent an attacker from influencing the key length negotiation. This allowed practical brute-force attacks (aka 'KNOB') that could decrypt traffic and inject arbitrary ciphertext without the victim noticing (bnc#1137865).

CVE-2019-15098: A NULL pointer dereference in drivers/net/wireless/ath was fixed (bnc#1146378).

CVE-2019-15290: A NULL pointer dereference in ath6kl_usb_alloc_urb_from_pipe was fixed (bsc#1146378).

CVE-2019-15239: A incorrect patch to net/ipv4 was fixed. By adding to a write queue between disconnection and re-connection, a local attacker could trigger multiple use-after-free conditions. This could result in kernel crashes or potentially in privilege escalation.
(bnc#1146589)

CVE-2019-15212: A double-free issue was fixed in drivers/usb driver (bnc#1146391).

CVE-2016-10906: A use-after-free issue was fixed in drivers/net/ethernet/arc (bnc#1146584).

CVE-2019-15211: A use-after-free issue caused by a malicious USB device was fixed in the drivers/media/v4l2-core driver (bnc#1146519).

CVE-2019-15217: A a NULL pointer dereference issue caused by a malicious USB device was fixed in the drivers/media/usb/zr364xx driver (bnc#1146519).

CVE-2019-15214: An a use-after-free issue in the sound subsystem was fixed (bnc#1146519).

CVE-2019-15218: A NULL pointer dereference caused by a malicious USB device was fixed in the drivers/media/usb/siano driver (bnc#1146413).

CVE-2019-15215: A use-after-free issue caused by a malicious USB device was fixed in the drivers/media/usb/cpia2 driver (bnc#1146425).

CVE-2018-20976: A use-after-free issue was fixed in the fs/xfs driver (bnc#1146285).

CVE-2017-18551: An out-of-bounds write was fixed in the drivers/i2c driver (bnc#1146163).

CVE-2019-0154: An unprotected read access to i915 registers has been fixed that could have been abused to facilitate a local denial-of-service attack. (bsc#1135966)

CVE-2019-0155: A privilege escalation vulnerability has been fixed in the i915 module that allowed batch buffers from user mode to gain super user privileges. (bsc#1135967)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15-SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735 CVE-2019-11135:
Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251 CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference.
(bsc#1150457).

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735 CVE-2019-11135:
Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251 CVE-2019-0154: Fix a local denial of service via read of unprotected i915 registers.
(bsc#1135966)

CVE-2019-0155: Fix privilege escalation in the i915 driver. Batch buffers from usermode could have escalated privileges via blitter command stream. (bsc#1135967)

CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference.
(bsc#1150457).

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465)

CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
132925	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:0093-1)	Nessus	SuSE Local Security Checks	critical
132071	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:3295-1)	Nessus	SuSE Local Security Checks	critical
131833	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:3200-1)	Nessus	SuSE Local Security Checks	critical
131208	OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0056)	Nessus	OracleVM Local Security Checks	high
131174	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4850)	Nessus	Oracle Linux Local Security Checks	high
131120	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2984-1)	Nessus	SuSE Local Security Checks	critical
131057	openSUSE Security Update : the Linux Kernel (openSUSE-2019-2503)	Nessus	SuSE Local Security Checks	critical
130951	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2953-1)	Nessus	SuSE Local Security Checks	critical
130949	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2949-1)	Nessus	SuSE Local Security Checks	critical
130947	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:2947-1)	Nessus	SuSE Local Security Checks	critical
130946	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:2946-1)	Nessus	SuSE Local Security Checks	critical
130582	openSUSE Security Update : the Linux Kernel (openSUSE-2019-2444)	Nessus	SuSE Local Security Checks	critical
129163	Photon OS 3.0: Linux PHSA-2019-3.0-0030	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2019-16995

high

Tenable Plugins

critical

critical

critical

high

high

critical

critical

critical

critical

critical

critical

critical

high