Security update for the Linux Kernel
| Announcement ID: | SUSE-SU-2019:1529-1 |
|---|---|
| Rating: | important |
| References: |
|
| Cross-References: | |
| CVSS scores: |
|
| Affected Products: |
|
An update that solves 14 vulnerabilities and has 130 security fixes can now be installed.
Description:
The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2019-11477: A sequence of SACKs may have been crafted such that one can trigger an integer overflow, leading to a kernel panic.
- CVE-2019-11478: It was possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. An attacker may have been able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection.
- CVE-2019-11479: An attacker could force the Linux kernel to segment its responses into multiple TCP segments. This would drastically increased the bandwidth required to deliver the same amount of data. Further, it would consume additional resources such as CPU and NIC processing power.
- CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network. (bnc#1136424)
- CVE-2019-12382: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel, there was an unchecked kstrdup of fwstr, which might have allowed an attacker to cause a denial of service (NULL pointer dereference and system crash). (bnc#1136586)
- CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux kernel allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may have been possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. (bnc#1120843)
- CVE-2019-11487: The Linux kernel allowed page reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM existed. It could have occured with FUSE requests. (bnc#1133190)
- CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the unused memory region in the extent tree block, which might have allowed local users to obtain sensitive information by reading uninitialized data in the filesystem. (bnc#1135281)
- CVE-2018-7191: In the tun subsystem in the Linux kernel, dev_get_valid_name was not called before register_netdevice. This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. (bnc#1135603)
- CVE-2019-11085: Insufficient input validation in Kernel Mode Driver in i915 Graphics for Linux may have allowed an authenticated user to potentially enable escalation of privilege via local access. (bnc#1135278)
- CVE-2019-11815: An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel There was a race condition leading to a use-after-free, related to net namespace cleanup. (bnc#1134537)
- CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel allowed a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character. (bnc#1134848)
- CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel had multiple race conditions. (bnc#1133188)
The following non-security bugs were fixed:
- 9p locks: add mount option for lock retry interval (bsc#1051510).
- acpi / utils: Drop reference in test for device presence (bsc#1051510).
- acpi: button: reinitialize button state upon resume (bsc#1051510).
- acpi: fix menuconfig presentation of ACPI submenu (bsc#1117158).
- acpicA: AML interpreter: add region addresses in global list during initialization (bsc#1051510).
- acpica: Namespace: remove address node from global list after method termination (bsc#1051510).
- alsa: core: Do not refer to snd_cards array directly (bsc#1051510).
- alsa: emu10k1: Drop superfluous id-uniquification behavior (bsc#1051510).
- alsa: hda - Register irq handler after the chip initialization (bsc#1051510).
- alsa: hda - Use a macro for snd_array iteration loops (bsc#1051510).
- alsa: hda/hdmi - Consider eld_valid when reporting jack event (bsc#1051510).
- alsa: hda/hdmi - Read the pin sense from register when repolling (bsc#1051510).
- alsa: hda/realtek - Add new Dell platform for headset mode (bsc#1051510).
- alsa: hda/realtek - Apply the fixup for ASUS Q325UAR (bsc#1051510).
- alsa: hda/realtek - Avoid superfluous COEF EAPD setups (bsc#1051510).
- alsa: hda/realtek - Corrected fixup for System76 Gazelle (gaze14) (bsc#1051510).
- alsa: hda/realtek - EAPD turn on later (bsc#1051510).
- alsa: hda/realtek - Fix for Lenovo B50-70 inverted internal microphone bug (bsc#1051510).
- alsa: hda/realtek - Fixed Dell AIO speaker noise (bsc#1051510).
- alsa: hda/realtek - Fixup headphone noise via runtime suspend (bsc#1051510).
- alsa: hda/realtek - Improve the headset mic for Acer Aspire laptops (bsc#1051510).
- alsa: hdea/realtek - Headset fixup for System76 Gazelle (gaze14) (bsc#1051510).
- alsa: line6: Avoid polluting led_* namespace (bsc#1051510).
- alsa: line6: use dynamic buffers (bsc#1051510).
- alsa: seq: Align temporary re-locking with irqsave version (bsc#1051510).
- alsa: seq: Correct unlock sequence at snd_seq_client_ioctl_unlock() (bsc#1051510).
- alsa: seq: Cov