In em28xx_unregister_dvb of em28xx-dvb.c, there is a possible use after free issue. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-111761954References: Upstream kernel

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: stack-based buffer overflow in chap_server_compute_md5() in iscsi target (CVE-2018-14633)

  - kernel: infinite loop in update_blocked_averages() in kernel/sched/fair.c leading to denial of service     (CVE-2018-20784)

  - The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to     obtain sensitive information from kernel memory via adjtimex. (CVE-2018-11508)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4118-1 advisory.

  - The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an     integer overflow via a large relative timeout because ktime_add_safe is not used. (CVE-2018-13053)

  - An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer     dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted     xfs image. This occurs because of a lack of proper validation that cached inodes are free during     allocation. (CVE-2018-13093)

  - An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. A denial of service (out-of-     bounds memory access and BUG) can occur upon encountering an abnormal bitmap size when mounting a crafted     f2fs image. (CVE-2018-13096)

  - An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. There is an out-of-bounds     read or a divide-by-zero error for an incorrect user_block_count in a corrupted f2fs image, leading to a     denial of service (BUG). (CVE-2018-13097)

  - An issue was discovered in fs/f2fs/inode.c in the Linux kernel through 4.17.3. A denial of service (slab     out-of-bounds read and BUG) can occur for a modified f2fs filesystem image in which FI_EXTRA_ATTR is set     in an inode. (CVE-2018-13098)

  - An issue was discovered in fs/f2fs/inline.c in the Linux kernel through 4.4. A denial of service (out-of-     bounds memory access and BUG) can occur for a modified f2fs filesystem image in which an inline inode     contains an invalid reserved blkaddr. (CVE-2018-13099)

  - An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3, which does not properly     validate secs_per_zone in a corrupted f2fs image, as demonstrated by a divide-by-zero error.
    (CVE-2018-13100)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in
    __del_reloc_root() in fs/btrfs/relocation.c when mounting a crafted btrfs image, related to removing reloc     rb_trees when reloc control has not been initialized. (CVE-2018-14609)

  - An issue was discovered in the Linux kernel through 4.17.10. There is out-of-bounds access in     write_extent_buffer() when mounting and operating a crafted btrfs image, because of a lack of verification     that each block group has a corresponding chunk at mount time, within btrfs_read_block_groups in     fs/btrfs/extent-tree.c. (CVE-2018-14610)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a use-after-free in     try_merge_free_space() when mounting a crafted btrfs image, because of a lack of chunk type flag checks in     btrfs_check_chunk_valid in fs/btrfs/volumes.c. (CVE-2018-14611)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in     btrfs_root_node() when mounting a crafted btrfs image, because of a lack of chunk block group mapping     validation in btrfs_read_block_groups in fs/btrfs/extent-tree.c, and a lack of empty-tree checks in     check_leaf in fs/btrfs/tree-checker.c. (CVE-2018-14612)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in     io_ctl_map_page() when mounting and operating a crafted btrfs image, because of a lack of block group item     validation in check_leaf_item in fs/btrfs/tree-checker.c. (CVE-2018-14613)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an out-of-bounds access in
    __remove_dirty_segment() in fs/f2fs/segment.c when mounting an f2fs image. (CVE-2018-14614)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a buffer overflow in     truncate_inline_inode() in fs/f2fs/inline.c when umounting an f2fs image, because a length value may be     negative. (CVE-2018-14615)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference in     fscrypt_do_page_crypto() in fs/crypto/crypto.c when operating on a file in a corrupted f2fs image.
    (CVE-2018-14616)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic     in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+     filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.
    (CVE-2018-14617)

  - A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after     the final file truncation (removal). The new file created with the same inode may contain leftover pages     from cleancache and the old file data instead of the new one. (CVE-2018-16862)

  - The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num     from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds     (OOB) read that potentially allows arbitrary read in the kernel address space. (CVE-2018-19985)

  - An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during     the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
    (CVE-2018-20169)

  - An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in     drivers/net/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by     leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call.
    (CVE-2018-20511)

  - In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to     cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other     impact by inducing a high load. (CVE-2018-20784)

  - An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an
    __blk_drain_queue() use-after-free because a certain error case is mishandled. (CVE-2018-20856)

  - Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and     iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate     elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may     allow a remote attacker to obtain the encryption key used by the device. (CVE-2018-5383)

  - Insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver before version 21.10 may     allow an unauthenticated user to potentially enable denial of service via adjacent access. (CVE-2019-0136)

  - A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function     in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other     consequences. (CVE-2019-10126)

  - A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before     4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware     could use this flaw to issue a specially crafted ioctl function call and cause the system to crash.
    (CVE-2019-10207)

  - In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel     produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple     destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and     thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page     that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. (CVE-2019-10638)

  - The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel     address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel     image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and     ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash     collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This     key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via     enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the     attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled     IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic     is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the     attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP     addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to     have a dependency on an address associated with a network namespace. (CVE-2019-10639)

  - Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0     may allow an authenticated user to potentially enable escalation of privilege via local access.
    (CVE-2019-11085)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to     prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive     information, cause a denial of service, or possibly have unspecified other impact by triggering a race     condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c,     fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c. (CVE-2019-11599)

  - An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when     megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c.
    This causes a Denial of Service, related to a use-after-free. (CVE-2019-11810)

  - An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a     race condition leading to a use-after-free, related to net namespace cleanup. (CVE-2019-11815)

  - fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the     extent tree block, which might allow local users to obtain sensitive information by reading uninitialized     data in the filesystem. (CVE-2019-11833)

  - The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a     local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command,     because a name field may not end with a '\0' character. (CVE-2019-11884)

  - An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in     net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL     pointer dereference. This will cause denial of service. This affects nfc_llcp_build_gb in     net/nfc/llcp_core.c. (CVE-2019-12818)

  - An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in     drivers/net/phy/mdio_bus.c calls put_device(), which will trigger a fixed_mdio_bus_init use-after-free.
    This will cause a denial of service. (CVE-2019-12819)

  - A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c     in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC     attributes, leading to denial of service. (CVE-2019-12984)

  - In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an     LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds     violation. (CVE-2019-13233)

  - In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the     credentials of a process that wants to create a ptrace relationship, which allows local users to obtain     root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops     privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an     object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of     a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper     with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
    (CVE-2019-13272)

  - In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a     malicious USB device can send an HID report that triggers an out-of-bounds write during generation of     debugging messages. (CVE-2019-13631)

  - In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and     head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an     unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by     default. (CVE-2019-14283)

  - In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params     division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry     with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should     be called. It can be triggered by an unprivileged local user even when a floppy disk has not been     inserted. NOTE: QEMU creates the floppy device by default. (CVE-2019-14284)

  - In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/gadget.c may potentially     cause a deadlock with f_hid. (CVE-2019-14763)

  - An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the     qedi_dbg_* family of functions, there is an out-of-bounds read. (CVE-2019-15090)

  - An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious     USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c     does not properly allocate memory. (CVE-2019-15211)

  - An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB     device in the drivers/usb/misc/rio500.c driver. (CVE-2019-15212)

  - An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound     subsystem because card disconnection causes certain data structures to be deleted too early. This is     related to sound/core/init.c and sound/core/info.c. (CVE-2019-15214)

  - An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious     USB device in the drivers/media/usb/cpia2/cpia2_usb.c driver. (CVE-2019-15215)

  - An issue was discovered in the Linux kernel before 5.0.14. There is a NULL pointer dereference caused by a     malicious USB device in the drivers/usb/misc/yurex.c driver. (CVE-2019-15216)

  - An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a     malicious USB device in the drivers/media/usb/siano/smsusb.c driver. (CVE-2019-15218)

  - An issue was discovered in the Linux kernel before 5.2.1. There is a use-after-free caused by a malicious     USB device in the drivers/net/wireless/intersil/p54/p54usb.c driver. (CVE-2019-15220)

  - An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a     malicious USB device in the sound/usb/line6/pcm.c driver. (CVE-2019-15221)

  - An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit,     related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c.
    (CVE-2019-15292)

  - In em28xx_unregister_dvb of em28xx-dvb.c, there is a possible use after free issue. This could lead to     local escalation of privilege with no additional execution privileges needed. User interaction is not     needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-111761954References:
    Upstream kernel (CVE-2019-2024)

  - In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input     validation. This could lead to local information disclosure with no additional execution privileges     needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel.
    Android ID: A-111760968. (CVE-2019-2101)

  - An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN     frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field.
    The privileged user root with CAP_NET_ADMIN can create a CAN frame modification rule that makes the data     length code a higher value than the available CAN frame data size. In combination with a configured     checksum calculation where the result is stored relatively to the end of the data (e.g. cgw_csum_xor_rel)     the tail of the skb (e.g. frag_list pointer in skb_shared_info) can be rewritten which finally can cause a     system crash. Because of a missing check, the CAN drivers may write arbitrary content beyond the data     registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames.
    (CVE-2019-3701)

  - A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c     file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged     user (root) can cause a system lock up and a denial of service. Versions from v4.18 and newer are     vulnerable. (CVE-2019-3819)

  - A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the     mwifiex kernel module while connecting to a malicious wireless network. (CVE-2019-3846)

  - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster     than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the     vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

  - The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key     length and does not prevent an attacker from influencing the key length negotiation. This allows practical     brute-force attacks (aka KNOB) that can decrypt traffic and inject arbitrary ciphertext without the     victim noticing. (CVE-2019-9506)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4094-1 advisory.

  - The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an     integer overflow via a large relative timeout because ktime_add_safe is not used. (CVE-2018-13053)

  - An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer     dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted     xfs image. This occurs because of a lack of proper validation that cached inodes are free during     allocation. (CVE-2018-13093)

  - An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. A denial of service (out-of-     bounds memory access and BUG) can occur upon encountering an abnormal bitmap size when mounting a crafted     f2fs image. (CVE-2018-13096)

  - An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. There is an out-of-bounds     read or a divide-by-zero error for an incorrect user_block_count in a corrupted f2fs image, leading to a     denial of service (BUG). (CVE-2018-13097)

  - An issue was discovered in fs/f2fs/inode.c in the Linux kernel through 4.17.3. A denial of service (slab     out-of-bounds read and BUG) can occur for a modified f2fs filesystem image in which FI_EXTRA_ATTR is set     in an inode. (CVE-2018-13098)

  - An issue was discovered in fs/f2fs/inline.c in the Linux kernel through 4.4. A denial of service (out-of-     bounds memory access and BUG) can occur for a modified f2fs filesystem image in which an inline inode     contains an invalid reserved blkaddr. (CVE-2018-13099)

  - An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3, which does not properly     validate secs_per_zone in a corrupted f2fs image, as demonstrated by a divide-by-zero error.
    (CVE-2018-13100)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in
    __del_reloc_root() in fs/btrfs/relocation.c when mounting a crafted btrfs image, related to removing reloc     rb_trees when reloc control has not been initialized. (CVE-2018-14609)

  - An issue was discovered in the Linux kernel through 4.17.10. There is out-of-bounds access in     write_extent_buffer() when mounting and operating a crafted btrfs image, because of a lack of verification     that each block group has a corresponding chunk at mount time, within btrfs_read_block_groups in     fs/btrfs/extent-tree.c. (CVE-2018-14610)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a use-after-free in     try_merge_free_space() when mounting a crafted btrfs image, because of a lack of chunk type flag checks in     btrfs_check_chunk_valid in fs/btrfs/volumes.c. (CVE-2018-14611)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in     btrfs_root_node() when mounting a crafted btrfs image, because of a lack of chunk block group mapping     validation in btrfs_read_block_groups in fs/btrfs/extent-tree.c, and a lack of empty-tree checks in     check_leaf in fs/btrfs/tree-checker.c. (CVE-2018-14612)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in     io_ctl_map_page() when mounting and operating a crafted btrfs image, because of a lack of block group item     validation in check_leaf_item in fs/btrfs/tree-checker.c. (CVE-2018-14613)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an out-of-bounds access in
    __remove_dirty_segment() in fs/f2fs/segment.c when mounting an f2fs image. (CVE-2018-14614)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a buffer overflow in     truncate_inline_inode() in fs/f2fs/inline.c when umounting an f2fs image, because a length value may be     negative. (CVE-2018-14615)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference in     fscrypt_do_page_crypto() in fs/crypto/crypto.c when operating on a file in a corrupted f2fs image.
    (CVE-2018-14616)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic     in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+     filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.
    (CVE-2018-14617)

  - A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after     the final file truncation (removal). The new file created with the same inode may contain leftover pages     from cleancache and the old file data instead of the new one. (CVE-2018-16862)

  - An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during     the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
    (CVE-2018-20169)

  - An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in     drivers/net/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by     leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call.
    (CVE-2018-20511)

  - An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an
    __blk_drain_queue() use-after-free because a certain error case is mishandled. (CVE-2018-20856)

  - Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and     iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate     elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may     allow a remote attacker to obtain the encryption key used by the device. (CVE-2018-5383)

  - A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function     in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other     consequences. (CVE-2019-10126)

  - An information disclosure vulnerability exists when certain central processing units (CPU) speculatively     access memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from     CVE-2019-1071, CVE-2019-1073. (CVE-2019-1125)

  - An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux     kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause     a denial of service (NULL pointer dereference and system crash). (CVE-2019-12614)

  - An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in     net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL     pointer dereference. This will cause denial of service. This affects nfc_llcp_build_gb in     net/nfc/llcp_core.c. (CVE-2019-12818)

  - An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in     drivers/net/phy/mdio_bus.c calls put_device(), which will trigger a fixed_mdio_bus_init use-after-free.
    This will cause a denial of service. (CVE-2019-12819)

  - A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c     in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC     attributes, leading to denial of service. (CVE-2019-12984)

  - In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an     LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds     violation. (CVE-2019-13233)

  - In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the     credentials of a process that wants to create a ptrace relationship, which allows local users to obtain     root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops     privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an     object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of     a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper     with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
    (CVE-2019-13272)

  - In em28xx_unregister_dvb of em28xx-dvb.c, there is a possible use after free issue. This could lead to     local escalation of privilege with no additional execution privileges needed. User interaction is not     needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-111761954References:
    Upstream kernel (CVE-2019-2024)

  - In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input     validation. This could lead to local information disclosure with no additional execution privileges     needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel.
    Android ID: A-111760968. (CVE-2019-2101)

  - A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the     mwifiex kernel module while connecting to a malicious wireless network. (CVE-2019-3846)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

This updated advisory text adds a note about the need to install new binary packages.

CVE-2018-5995

ADLab of VenusTech discovered that the kernel logged the virtual addresses assigned to per-CPU data, which could make it easier to exploit other vulnerabilities.

CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091

Multiple researchers have discovered vulnerabilities in the way that Intel processor designs implement speculative forwarding of data filled into temporary microarchitectural structures (buffers). This flaw could allow an attacker controlling an unprivileged process to read sensitive information, including from the kernel and all other processes running on the system, or across guest/host boundaries to read host memory.

See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/m ds.html for more details.

To fully resolve these vulnerabilities it is also necessary to install updated CPU microcode. An updated intel-microcode package (only available in Debian non-free) was provided via DLA-1789-1. The updated CPU microcode may also be available as part of a system firmware ('BIOS') update.

CVE-2019-2024

A use-after-free bug was discovered in the em28xx video capture driver. Local users might be able to use this for denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-3459, CVE-2019-3460

Shlomi Oberman, Yuli Shapiro, and Karamba Security Ltd. research team discovered missing range checks in the Bluetooth L2CAP implementation.
If Bluetooth is enabled, a nearby attacker could use these to read sensitive information from the kernel.

CVE-2019-3882

It was found that the vfio implementation did not limit the number of DMA mappings to device memory. A local user granted ownership of a vfio device could use this to cause a denial of service (out-of-memory condition).

CVE-2019-3901

Jann Horn of Google reported a race condition that would allow a local user to read performance events from a task after it executes a setuid program. This could leak sensitive information processed by setuid programs. Debian's kernel configuration does not allow unprivileged users to access peformance events by default, which fully mitigates this issue.

CVE-2019-6133

Jann Horn of Google found that Policykit's authentication check could be bypassed by a local user creating a process with the same start time and process ID as an older authenticated process. PolicyKit was already updated to fix this in DLA-1644-1. The kernel has additionally been updated to avoid a delay between assigning start time and process ID, which should make the attack impractical.

CVE-2019-9503

Hugues Anguelkov and others at Quarkslab discovered that the brcmfmac (Broadcom wifi FullMAC) driver did not correctly distinguish messages sent by the wifi firmware from other packets. An attacker using the same wifi network could use this for denial of service or to exploit other vulnerabilities in the driver.

CVE-2019-11190

Robert &#x15A;wi&#x119;cki reported that when a setuid program was executed it was still possible to read performance events while the kernel set up the program's address space. A local user could use this to defeat ASLR in a setuid program, making it easier to exploit other vulnerabilities in the program. Debian's kernel configuration does not allow unprivileged users to access peformance events by default, which fully mitigates this issue.

CVE-2019-11486

Jann Horn of Google reported numerous race conditions in the Siemens R3964 line discipline. A local user could use these to cause unspecified security impact. This module has therefore been disabled.

CVE-2019-11599

Jann Horn of Google reported a race condition in the core dump implementation which could lead to a use-after-free. A local user could use this to read sensitive information, to cause a denial of service (memory corruption), or for privilege escalation.

For Debian 8 'Jessie', these problems have been fixed in version 3.16.68-1. This version also includes a fix for Debian bug #927781, and other fixes included in upstream stable updates.

We recommend that you upgrade your linux and linux-latest packages.
You will need to use 'apt-get upgrade --with-new-pkgs' or 'apt upgrade' as the binary package names have changed.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP3 Azure kernel was updated to 4.4.176 to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free. (bnc#1124728)

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2017-18249: The add_free_nid function in fs/f2fs/node.c did not properly track an allocated nid, which allowed local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads (bnc#1087036).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. (bnc#1107829).

CVE-2019-7221: The KVM implementation in the Linux kernel had a Use-after-Free (bnc#1124732).

CVE-2019-7222: The KVM implementation in the Linux kernel had an Information Leak (bnc#1124735).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, which led to a use-after-free (bnc#1124728).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.176 to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE Leap 42.3 kernel was updated to 4.4.176 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2019-9213: expand_downwards in mm/mmap.c lacked a     check for the mmap minimum address, which made it easier     for attackers to exploit kernel NULL pointer     dereferences on non-SMAP platforms. This is related to a     capability check for the wrong task (bnc#1128166).

  - CVE-2019-2024: A use-after-free when disconnecting a     source was fixed which could lead to crashes.
    bnc#1129179).

The following non-security bugs were fixed :

  - ax25: fix possible use-after-free (bnc#1012382).

  - block_dev: fix crash on chained bios with O_DIRECT     (bsc#1090435).

  - block: do not use bio->bi_vcnt to figure out segment     number (bsc#1128893).

  - bnxt_re: Fix couple of memory leaks that could lead to     IOMMU call traces (bsc#1020413).

  - bpf: fix replace_map_fd_with_map_ptr's ldimm64 second     imm field (bsc#1012382).

  - btrfs: ensure that a DUP or RAID1 block group has     exactly two stripes (bsc#1128452).

  - ceph: avoid repeatedly adding inode to     mdsc->snap_flush_list (bsc#1126773).

  - ch: add missing mutex_lock()/mutex_unlock() in     ch_release() (bsc#1124235).

  - ch: fixup refcounting imbalance for SCSI devices     (bsc#1124235).

  - copy_mount_string: Limit string length to PATH_MAX     (bsc#1082943).

  - device property: Fix the length used in     PROPERTY_ENTRY_STRING() (bsc#1129770).

  - Drivers: hv: vmbus: Check for ring when getting debug     info (bsc#1126389).

  - drm: Fix error handling in drm_legacy_addctx     (bsc#1106929)

  - drm/nouveau/bios/ramcfg: fix missing parentheses when     calculating RON (bsc#1106929)

  - drm/nouveau/pmu: do not print reply values if exec is     false (bsc#1106929)

  - drm/radeon/evergreen_cs: fix missing break in switch     statement (bsc#1106929)

  - drm/vmwgfx: Do not double-free the mode stored in     par->set_mode (bsc#1103429)

  - enic: add wq clean up budget (bsc#1075697, bsc#1120691.
    bsc#1102959).

  - enic: do not overwrite error code (bnc#1012382).

  - fbdev: chipsfb: remove set but not used variable 'size'     (bsc#1106929)

  - ibmvnic: Report actual backing device speed and duplex     values (bsc#1129923).

  - ibmvscsi: Fix empty event pool access during host     removal (bsc#1119019).

  - Input: mms114 - fix license module information     (bsc#1087092).

  - iommu/dmar: Fix buffer overflow during PCI bus     notification (bsc#1129237).

  - iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables     (bsc#1129238).

  - iommu/vt-d: Check identity map for hot-added devices     (bsc#1129239).

  - iommu/vt-d: Fix NULL pointer reference in     intel_svm_bind_mm() (bsc#1129240).

  - ixgbe: fix crash in build_skb Rx code path (git-fixes).

  - kABI: protect struct inet_peer (kabi).

  - kallsyms: Handle too long symbols in kallsyms.c     (bsc#1126805).

  - KMPs: obsolete older KMPs of the same flavour     (bsc#1127155, bsc#1109137).

  - KVM: arm/arm64: vgic-its: Check CBASER/BASER validity     before enabling the ITS (bsc#1109248).

  - KVM: arm/arm64: vgic-its: Check GITS_BASER Valid bit     before saving tables (bsc#1109248).

  - KVM: arm/arm64: vgic-its: Fix return value for device     table restore (bsc#1109248).

  - KVM: arm/arm64: vgic-its: Fix     vgic_its_restore_collection_table returned value     (bsc#1109248).

  - kvm: nVMX: Do not halt vcpu when L1 is injecting events     to L2 (bsc#1129413).

  - kvm: nVMX: Free the VMREAD/VMWRITE bitmaps if     alloc_kvm_area() fails (bsc#1129414).

  - kvm: nVMX: NMI-window and interrupt-window exiting     should wake L2 from HLT (bsc#1129415).

  - kvm: nVMX: Set VM instruction error for VMPTRLD of     unbacked page (bsc#1129416).

  - kvm: VMX: Do not allow reexecute_instruction() when     skipping MMIO instr (bsc#1129417).

  - kvm: vmx: Set IA32_TSC_AUX for legacy mode guests     (bsc#1129418).

  - kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs     (bsc#1127082).

  - kvm: x86: IA32_ARCH_CAPABILITIES is always supported     (bsc#1129419).

  - libceph: handle an empty authorize reply (bsc#1126772).

  - mdio_bus: Fix use-after-free on device_register fails     (git-fixes).

  - mfd: as3722: Handle interrupts on suspend (bnc#1012382).

  - mfd: as3722: Mark PM functions as __maybe_unused     (bnc#1012382).

  - mISDN: fix a race in dev_expire_timer() (bnc#1012382).

  - mlxsw: pci: Correctly determine if descriptor queue is     full (git-fixes).

  - mlxsw: reg: Use correct offset in field definiton     (git-fixes).

  - mm, devm_memremap_pages: mark devm_memremap_pages()     EXPORT_SYMBOL_GPL (bnc#1012382).

  - mm,memory_hotplug: fix scan_movable_pages() for gigantic     hugepages (bsc#1127731).

  - net: Add header for usage of fls64() (bnc#1012382).

  - net: Do not allocate page fragments that are not skb     aligned (bnc#1012382).

  - net: dsa: bcm_sf2: Do not assume DSA master supports WoL     (git-fixes).

  - net: dsa: mv88e6xxx: fix port VLAN maps (git-fixes).

  - net: Fix for_each_netdev_feature on Big endian     (bnc#1012382).

  - net: fix IPv6 prefix route residue (bnc#1012382).

  - net/hamradio/6pack: Convert timers to use timer_setup()     (git-fixes).

  - net/hamradio/6pack: use mod_timer() to rearm timers     (git-fixes).

  - net: ipv4: use a dedicated counter for icmp_v4 redirect     packets (bnc#1012382).

  - net: lan78xx: Fix race in tx pending skb size     calculation (git-fixes).

  - net/mlx4_core: drop useless LIST_HEAD (git-fixes).

  - net/mlx4_core: Fix qp mtt size calculation (git-fixes).

  - net/mlx4_core: Fix reset flow when in command polling     mode (git-fixes).

  - net/mlx4: Fix endianness issue in qp context params     (git-fixes).

  - net/mlx5: Continue driver initialization despite debugfs     failure (git-fixes).

  - net/mlx5e: Fix TCP checksum in LRO buffers (git-fixes).

  - net/mlx5: Fix driver load bad flow when having fw     initializing timeout (git-fixes).

  - net/mlx5: fix uaccess beyond 'count' in debugfs     read/write handlers (git-fixes).

  - net/mlx5: Fix use-after-free in self-healing flow     (git-fixes).

  - net/mlx5: Return success for PAGE_FAULT_RESUME in     internal error state (git-fixes).

  - net: mv643xx_eth: fix packet corruption with TSO and     tiny unaligned packets (git-fixes).

  - net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS     (git-fixes).

  - net: phy: bcm7xxx: Fix shadow mode 2 disabling     (git-fixes).

  - net: qca_spi: Fix race condition in spi transfers     (git-fixes).

  - net: stmmac: Fix a race in EEE enable callback     (bnc#1012382).

  - net: stmmac: Fix a race in EEE enable callback     (git-fixes).

  - net: thunderx: set tso_hdrs pointer to NULL in     nicvf_free_snd_queue (git-fixes).

  - net/x25: do not hold the cpu too long in x25_new_lci()     (bnc#1012382).

  - pci/pme: Fix hotplug/sysfs remove deadlock in     pcie_pme_remove() (bsc#1129241).

  - perf/x86: Add sysfs entry to freeze counters on SMI     (bsc#1121805).

  - perf/x86/intel: Delay memory deallocation until     x86_pmu_dead_cpu() (bsc#1121805).

  - perf/x86/intel: Do not enable freeze-on-smi for PerfMon     V1 (bsc#1121805).

  - perf/x86/intel: Fix memory corruption (bsc#1121805).

  - perf/x86/intel: Generalize dynamic constraint creation     (bsc#1121805).

  - perf/x86/intel: Implement support for TSX Force Abort     (bsc#1121805).

  - perf/x86/intel: Make cpuc allocations consistent     (bsc#1121805).

  - phy: micrel: Ensure interrupts are reenabled on resume     (git-fixes).

  - powerpc/pseries: Add CPU dlpar remove functionality     (bsc#1128756).

  - powerpc/pseries: Consolidate CPU hotplug code to     hotplug-cpu.c (bsc#1128756).

  - powerpc/pseries: Factor out common cpu hotplug code     (bsc#1128756).

  - powerpc/pseries: Perform full re-add of CPU for topology     update post-migration (bsc#1128756).

  - pppoe: fix reception of frames with no mac header     (git-fixes).

  - pptp: dst_release sk_dst_cache in pptp_sock_destruct     (git-fixes).

  - pseries/energy: Use OF accessor function to read     ibm,drc-indexes (bsc#1129080).

  - RDMA/bnxt_re: Synchronize destroy_qp with poll_cq     (bsc#1125446).

  - Refresh     patches.suse/scsi-do-not-print-reservation-conflict-for-     TEST-UNIT.patch (bsc#1119843)

  - Revert 'mm, devm_memremap_pages: mark     devm_memremap_pages() EXPORT_SYMBOL_GPL' (bnc#1012382).

  - Revert 'x86/platform/UV: Use efi_runtime_lock to     serialise BIOS calls' (bsc#1128565).

  - s390/qeth: cancel close_dev work before removing a card     (LTC#175898, bsc#1127561).

  - scsi: aacraid: Fix missing break in switch statement     (bsc#1128696).

  - scsi: ibmvscsi: Fix empty event pool access during host     removal (bsc#1119019).

  - scsi: lpfc: do not set queue->page_count to 0 if     pc_sli4_params.wqpcnt is invalid (bsc#1127725).

  - scsi: qla2xxx: Fix early srb free on abort     (bsc#1121713).

  - scsi: qla2xxx: Fix for double free of SRB structure     (bsc#1121713).

  - scsi: qla2xxx: Increase abort timeout value     (bsc#1121713).

  - scsi: qla2xxx: Move (get|rel)_sp to base_qpair struct     (bsc#1121713).

  - scsi: qla2xxx: Return switch command on a timeout     (bsc#1121713).

  - scsi: qla2xxx: Turn off IOCB timeout timer on IOCB     completion (bsc#1121713).

  - scsi: qla2xxx: Use correct qpair for ABTS/CMD     (bsc#1121713).

  - scsi: sym53c8xx: fix NULL pointer dereference panic in     sym_int_sir() (bsc#1125315).

  - sky2: Increase D3 delay again (bnc#1012382).

  - tcp: clear icsk_backoff in tcp_write_queue_purge()     (bnc#1012382).

  - tcp: tcp_v4_err() should be more careful (bnc#1012382).

  - team: avoid complex list operations in     team_nl_cmd_options_set() (bnc#1012382).

  - team: Free BPF filter when unregistering netdev     (git-fixes).

  - tracing: Do not free iter->trace in fail path of     tracing_open_pipe() (bsc#1129581).

  - vsock: cope with memory allocation failure at socket     creation time (bnc#1012382).

  - vxlan: test dev->flags & IFF_UP before calling     netif_rx() (bnc#1012382).

  - wireless: airo: potential buffer overflow in sprintf()     (bsc#1120902).

  - x86: Add TSX Force Abort CPUID/MSR (bsc#1121805).

  - x86: livepatch: Treat R_X86_64_PLT32 as R_X86_64_PC32     (bnc#1012382).

  - xen, cpu_hotplug: Prevent an out of bounds access     (bsc#1065600).

  - xen: remove pre-xen3 fallback handlers (bsc#1065600).

  - xfs: remove filestream item xfs_inode reference     (bsc#1127961).

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

CVE-2019-9213: expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).

CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable (bnc#1123161).

CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).

CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).

CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks.
(bnc#1122971).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise Server 12 SP4 Azure kernel was updated to fix various issues.

The following security bugs were fixed :

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166 1128378 1129016).

CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).

CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).

CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which led to a use-after-free in sockfs_setattr (bnc#1125907 1126284).

CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).

CVE-2018-20669: An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c where a local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation (bnc#1122971).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks.
(bnc#1122971).

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728 ).

CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).

CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).

CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).

CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199918	RHEL 7 : kernel-alt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
128478	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (AWS) vulnerabilities (USN-4118-1)	Nessus	Ubuntu Local Security Checks	critical
127889	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4094-1)	Nessus	Ubuntu Local Security Checks	critical
125478	Debian DLA-1799-2 : linux security update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Debian Local Security Checks	high
124050	openSUSE Security Update : the Linux Kernel (openSUSE-2019-1193)	Nessus	SuSE Local Security Checks	high
123927	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0901-1)	Nessus	SuSE Local Security Checks	high
123635	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0828-1)	Nessus	SuSE Local Security Checks	high
123546	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:0801-1)	Nessus	SuSE Local Security Checks	high
123545	openSUSE Security Update : the Linux Kernel (openSUSE-2019-1085)	Nessus	SuSE Local Security Checks	high
123496	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:0784-1)	Nessus	SuSE Local Security Checks	high
123445	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0767-1)	Nessus	SuSE Local Security Checks	high
123413	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:0765-1) (Spectre)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-2024

high

Tenable Plugins

critical

critical

critical

high

high

high

high

high

high

high

high

high