Security update for the Linux Kernel

Announcement ID: SUSE-SU-2020:3507-1
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2020-25668 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2020-25668 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2020-25704 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2020-25704 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2020-25705 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  • CVE-2020-25705 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products:
  • Basesystem Module 15-SP1
  • Development Tools Module 15-SP1
  • Legacy Module 15-SP1
  • SUSE Linux Enterprise Desktop 15 SP1
  • SUSE Linux Enterprise High Availability Extension 15 SP1
  • SUSE Linux Enterprise High Performance Computing 15 SP1
  • SUSE Linux Enterprise Live Patching 15-SP1
  • SUSE Linux Enterprise Real Time 15 SP1
  • SUSE Linux Enterprise Server 15 SP1
  • SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP1
  • SUSE Linux Enterprise Workstation Extension 15 SP1
  • SUSE Manager Proxy 4.0
  • SUSE Manager Retail Branch Server 4.0
  • SUSE Manager Server 4.0

An update that solves three vulnerabilities and has 17 security fixes can now be installed.

Description:

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
  • CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
  • CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).

The following non-security bugs were fixed:

  • 9P: Cast to loff_t before multiplying (git-fixes).
  • acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
  • ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
  • ACPI: dock: fix enum-conversion warning (git-fixes).
  • ACPI / extlog: Check for RDMSR failure (git-fixes).
  • ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
  • ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
  • ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
  • ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
  • ata: sata_rcar: Fix DMA boundary mask (git-fixes).
  • ath10k: fix VHT NSS calculation when STBC is enabled (git-fixes).
  • ath10k: start recovery process when payload length exceeds max htc length for sdio (git-fixes).
  • bus/fsl_mc: Do not rely on caller to provide non NULL mc_io (git-fixes).
  • can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() (git-fixes).
  • can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames (git-fixes).
  • can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context (git-fixes).
  • can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on (git-fixes).
  • can: peak_usb: add range checking in decode operations (git-fixes).
  • can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping (git-fixes).
  • can: rx-offload: do not call kfree_skb() from IRQ context (git-fixes).
  • clk: ti: clockdomain: fix static checker warning (git-fixes).
  • crypto: bcm - Verify GCM/CCM key length in setkey (git-fixes).
  • device property: Do not clear secondary pointer for shared primary firmware node (git-fixes).
  • device property: Keep secondary firmware node secondary by type (git-fixes).
  • drbd: code cleanup by using sendpage_ok() to check page for kernel_sendpage() (bsc#1172873).
  • drm/amd/display: Do not invoke kgdb_breakpoint() unconditionally (git-fixes).
  • drm/amd/display: HDMI remote sink need mode validation for Linux (git-fixes).
  • drm/amdgpu: do not map BO in reserved region (git-fixes).
  • drm/bridge/synopsys: dsi: add support for non-continuous HS clock (git-fixes).
  • drm/brige/megachips: Add checking if ge_b850v3_lvds_init() is working correctly (git-fixes).
  • drm/i915: Break up error capture compression loops with cond_resched() (git-fixes).
  • drm/i915: Force VT'd workarounds when running as a guest OS (git-fixes).
  • drm/imx: tve remove extraneous type qualifier (git-fixes).
  • drm/ttm: fix eviction valuable range check (git-fixes).
  • drm/vc4: drv: Add error handding for bind (git-fixes).
  • efivarfs: Replace invalid slashes with exclamation marks in dentries (git-fixes).
  • ftrace: Fix recursion check for NMI test (git-fixes).
  • ftrace: Handle tracing when switching between context (git-fixes).
  • hv_netvsc: Add XDP support (bsc#1177819, bsc#1177820).
  • hv_netvsc: Fix XDP refcnt for synthetic and VF NICs (bsc#1177819, bsc#1177820).
  • hyperv_fb: Update screen_info after removing old framebuffer (bsc#1175306).
  • icmp: randomize the global rate limiter (git-fixes).
  • kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled (git-fixes).
  • leds: bcm6328, bcm6358: use devres LED registering function (git-fixes).
  • libceph: use sendpage_ok() in ceph_tcp_sendpage() (bsc#1172873).
  • media: platform: Improve queue set up flow for bug fixing (git-fixes).
  • media: tw5864: check status of tw5864_frameinterval_get (git-fixes).
  • memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event (bsc#1177703).
  • mmc: sdhci-of-esdhc: Handle pulse width detection erratum for more SoCs (git-fixes).
  • mmc: sdhci-of-esdhc: set timeout to max before tuning (git-fixes).
  • mm/memcg: fix refcount error while moving and swapping (bsc#1178686).
  • Move the upstreamed powercap fix into sorted sectio
  • mtd: lpddr: Fix bad logic in print_drs_error (git-fixes).
  • net: add WARN_ONCE in kernel_sendpage() for improper zero-copy send (bsc#1172873).
  • net: introduce helper sendpage_ok() in include/linux/net.h (bsc#1172873).
  • net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition (git-fixes).
  • nvme-tcp: check page by sendpage_ok() before calling kernel_sendpage() (bsc#1172873).
  • p54: avoid accessing the data mapped to streaming DMA (git-fixes).
  • pinctrl: intel: Set default bias in case no particular value given (git-fixes).
  • powerpc/pseries/cpuidle: add polling idle for shared processor guests (bsc#1178765 ltc#188968).
  • powerpc/vnic: Extend "failover pending" window (bsc#1176855 ltc#187293).
  • power: supply: test_power: add missing newlines when printing parameters by sysfs (git-fixes).
  • regulator: defer probe when trying to get voltage from unresolved supply (git-fixes).
  • regulator: resolve supply after creating regulator (git-fixes).
  • ring-buffer: Fix recursion protection transitions between interrupt context (git-fixes).
  • rpm/kernel-module-subpackage: make Group tag optional (bsc#1163592)
  • scsi: libiscsi: use sendpage_ok() in iscsi_tcp_segment_map() (bsc#1172873).
  • staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice (git-fixes).
  • staging: octeon: Drop on uncorrectable alignment or FCS error (git-fixes).
  • staging: octeon: repair "fixed-link" support (git-fixes).
  • thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() (git-fixes).
  • USB: Add NO_LPM quirk for Kingston flash drive (git-fixes).
  • USB: adutux: fix debugging (git-fixes).
  • usb: cdc-acm: fix cooldown mechanism (git-fixes).
  • usb: host: fsl-mph-dr-of: check return of dma_set_mask() (git-fixes).
  • usb: mtu3: fix panic in mtu3_gadget_stop() (git-fixes).
  • USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 (git-fixes).
  • USB: serial: option: add Quectel EC200T module support (git-fixes).
  • USB: serial: option: add Telit FN980 composition 0x1055 (git-fixes).
  • usb: typec: tcpm: During PR_SWAP, source caps should be sent only after tSwapSourceStart (git-fixes).
  • usb: typec: tcpm: reset hard_reset_count for any disconnect (git-fixes).
  • video: fbdev: pvr2fb: initialize variables (git-fixes).
  • video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host (bsc#1175306).
  • video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver (bsc#1175306).
  • video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1 VMs (bsc#1175306).
  • vt: Disable KD_FONT_OP_COPY (bsc#1178589).
  • x86/kexec: Use up-to-dated screen_info copy to fill boot params (bsc#1175306).
  • x86/unwind/orc: Fix inactive tasks with stack pointer in %sp on GCC 10 compiled kernels (bsc#1058115 bsc#1176907).
  • xfs: do not update mtime on COW faults (bsc#1167030).
  • xfs: fix a missing unlock on error in xfs_fs_map_blocks (git-fixes).
  • xfs: fix flags argument to rmap lookup when converting shared file rmaps (git-fixes).
  • xfs: fix rmap key and record comparison functions (git-fixes).
  • xfs: flush new eof page on truncate to avoid post-eof corruption (git-fixes).

Special Instructions and Notes:

  • Please reboot the system after installing this update.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • Basesystem Module 15-SP1
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2020-3507=1
  • Development Tools Module 15-SP1
    zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP1-2020-3507=1
  • Legacy Module 15-SP1
    zypper in -t patch SUSE-SLE-Module-Legacy-15-SP1-2020-3507=1
  • SUSE Linux Enterprise Live Patching 15-SP1
    zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP1-2020-3507=1
    Please note that this is the initial kernel livepatch without fixes itself, this package is later updated by separate standalone kernel livepatch updates.
  • SUSE Linux Enterprise High Availability Extension 15 SP1
    zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2020-3507=1
  • SUSE Linux Enterprise Workstation Extension 15 SP1
    zypper in -t patch SUSE-SLE-Product-WE-15-SP1-2020-3507=1

Package List:

  • Basesystem Module 15-SP1 (aarch64 ppc64le s390x x86_64 nosrc)
    • kernel-default-4.12.14-197.72.1
  • Basesystem Module 15-SP1 (aarch64 ppc64le s390x x86_64)
    • kernel-default-devel-4.12.14-197.72.1
    • kernel-default-debugsource-4.12.14-197.72.1
    • kernel-default-base-4.12.14-197.72.1
    • kernel-default-devel-debuginfo-4.12.14-197.72.1
    • kernel-default-base-debuginfo-4.12.14-197.72.1
    • kernel-default-debuginfo-4.12.14-197.72.1
  • Basesystem Module 15-SP1 (noarch)
    • kernel-macros-4.12.14-197.72.1
    • kernel-devel-4.12.14-197.72.1
  • Basesystem Module 15-SP1 (s390x)
    • kernel-zfcpdump-debugsource-4.12.14-197.72.1
    • kernel-zfcpdump-debuginfo-4.12.14-197.72.1
    • kernel-default-man-4.12.14-197.72.1
  • Basesystem Module 15-SP1 (nosrc)
    • kernel-zfcpdump-4.12.14-197.72.1
  • Development Tools Module 15-SP1 (noarch nosrc)
    • kernel-docs-4.12.14-197.72.2
  • Development Tools Module 15-SP1 (aarch64 ppc64le s390x x86_64)
    • kernel-obs-build-debugsource-4.12.14-197.72.1
    • kernel-obs-build-4.12.14-197.72.1
    • kernel-syms-4.12.14-197.72.1
  • Development Tools Module 15-SP1 (noarch)
    • kernel-source-4.12.14-197.72.1
  • Legacy Module 15-SP1 (nosrc)
    • kernel-default-4.12.14-197.72.1
  • Legacy Module 15-SP1 (aarch64 ppc64le s390x x86_64)
    • kernel-default-debuginfo-4.12.14-197.72.1
    • kernel-default-debugsource-4.12.14-197.72.1
    • reiserfs-kmp-default-debuginfo-4.12.14-197.72.1
    • reiserfs-kmp-default-4.12.14-197.72.1
  • SUSE Linux Enterprise Live Patching 15-SP1 (nosrc)
    • kernel-default-4.12.14-197.72.1
  • SUSE Linux Enterprise Live Patching 15-SP1 (ppc64le x86_64)
    • kernel-default-debugsource-4.12.14-197.72.1
    • kernel-default-livepatch-devel-4.12.14-197.72.1
    • kernel-default-livepatch-4.12.14-197.72.1
    • kernel-livepatch-4_12_14-197_72-default-1-3.3.1
    • kernel-default-debuginfo-4.12.14-197.72.1
  • SUSE Linux Enterprise High Availability Extension 15 SP1 (aarch64 ppc64le s390x x86_64)
    • cluster-md-kmp-default-4.12.14-197.72.1
    • kernel-default-debugsource-4.12.14-197.72.1
    • dlm-kmp-default-debuginfo-4.12.14-197.72.1
    • ocfs2-kmp-default-4.12.14-197.72.1
    • ocfs2-kmp-default-debuginfo-4.12.14-197.72.1
    • cluster-md-kmp-default-debuginfo-4.12.14-197.72.1
    • gfs2-kmp-default-4.12.14-197.72.1
    • dlm-kmp-default-4.12.14-197.72.1
    • kernel-default-debuginfo-4.12.14-197.72.1
    • gfs2-kmp-default-debuginfo-4.12.14-197.72.1
  • SUSE Linux Enterprise High Availability Extension 15 SP1 (nosrc)
    • kernel-default-4.12.14-197.72.1
  • SUSE Linux Enterprise Workstation Extension 15 SP1 (nosrc)
    • kernel-default-4.12.14-197.72.1
  • SUSE Linux Enterprise Workstation Extension 15 SP1 (x86_64)
    • kernel-default-debuginfo-4.12.14-197.72.1
    • kernel-default-debugsource-4.12.14-197.72.1
    • kernel-default-extra-debuginfo-4.12.14-197.72.1
    • kernel-default-extra-4.12.14-197.72.1

References: