|
The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various
security and bugfixes.
The following security bugs were fixed:
- CVE-2017-18595: A double free may be caused by the function
allocate_trace_buffer in the file kernel/trace/trace.c (bnc#1149555).
- CVE-2019-14821: An out-of-bounds access issue was found in the way Linux
kernel's KVM hypervisor implements the coalesced MMIO write operation.
It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object,
wherein write indices 'ring->first' and 'ring->last' value could be
supplied by a host user-space process. An unprivileged host user or
process with access to '/dev/kvm' device could use this flaw to crash
the host kernel, resulting in a denial of service or potentially
escalating privileges on the system (bnc#1151350).
- CVE-2019-15291: There was a NULL pointer dereference caused by a
malicious USB device in the flexcop_usb_probe function in the
drivers/media/usb/b2c2/flexcop-usb.c driver (bnc#1146540).
- CVE-2019-9506: The Bluetooth BR/EDR specification up to and including
version 5.1 permitted sufficiently low encryption key length and did not
prevent an attacker from influencing the key length negotiation. This
allowed practical brute-force attacks (aka "KNOB") that could decrypt
traffic and injected arbitrary ciphertext without the victim noticing
(bnc#1137865 bnc#1146042).
- CVE-2019-16232: Fixed a NULL pointer dereference in
drivers/net/wireless/marvell/libertas/if_sdio.c, which did not check the
alloc_workqueue return value (bnc#1150465).
- CVE-2019-16234: Fixed a NULL pointer dereference in
drivers/net/wireless/intel/iwlwifi/pcie/trans.c, which did not check the
alloc_workqueue return value (bnc#1150452).
- CVE-2019-17056: Added enforcement of CAP_NET_RAW in llcp_sock_create in
net/nfc/llcp_sock.c in the AF_NFC network module, the lack of which
allowed unprivileged users to create a raw socket, aka CID-3a359798b176
(bnc#1152788).
- CVE-2019-17133: Fixed a buffer overflow in cfg80211_mgd_wext_giwessid in
net/wireless/wext-sme.c caused by long SSID IEs (bsc#1153158).
- CVE-2019-17666: Added an upper-bound check in rtl_p2p_noa_ie in
drivers/net/wireless/realtek/rtlwifi/ps.c, the lack of which could have
led to a buffer overflow (bnc#1154372).
The following non-security bugs were fixed:
http://lists.suse.com/pipermail/sle-security-updates/2019-October/006083.html
|