A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ("root") can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable.
{"redhatcve": [{"lastseen": "2022-07-07T17:51:49", "description": "A flaw was found in the Linux kernel in the function hid_debug_events_read() in the drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a user space. A local privileged user (\"root\") can cause a system lock up and a denial of service.\n", "cvss3": {"exploitabilityScore": 0.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "baseScore": 4.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-03-30T08:22:33", "type": "redhatcve", "title": "CVE-2019-3819", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 4.9, "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-3819"], "modified": "2022-07-07T12:05:07", "id": "RH:CVE-2019-3819", "href": "https://access.redhat.com/security/cve/cve-2019-3819", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}], "debiancve": [{"lastseen": "2022-08-11T15:56:40", "description": "A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user (\"root\") can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable.", "cvss3": {"exploitabilityScore": 0.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "baseScore": 4.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-01-25T18:29:00", "type": "debiancve", "title": "CVE-2019-3819", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 4.9, "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-3819"], "modified": "2019-01-25T18:29:00", "id": "DEBIANCVE:CVE-2019-3819", "href": "https://security-tracker.debian.org/tracker/CVE-2019-3819", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}], "ubuntucve": [{"lastseen": "2022-08-04T13:43:09", "description": "A flaw was found in the Linux kernel in the function\nhid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an\ninfinite loop with certain parameters passed from a userspace. A local\nprivileged user (\"root\") can cause a system lock up and a denial of\nservice. Versions from v4.18 and newer are vulnerable.\n\n#### Bugs\n\n * <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3819>\n\n\n#### Notes\n\nAuthor| Note \n---|--- \n[sbeattie](<https://launchpad.net/~sbeattie>) | claims to be introduced by fix for CVE-2018-9516 \n[tyhicks](<https://launchpad.net/~tyhicks>) | HID debug events are exposed via debugfs which is only accessible by the root user in Ubuntu\n", "cvss3": {"exploitabilityScore": 0.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "baseScore": 4.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-01-25T00:00:00", "type": "ubuntucve", "title": "CVE-2019-3819", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 4.9, "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-9516", "CVE-2019-3819"], "modified": "2019-01-25T00:00:00", "id": "UB:CVE-2019-3819", "href": "https://ubuntu.com/security/CVE-2019-3819", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}], "suse": [{"lastseen": "2022-04-18T12:42:07", "description": "An update that solves 6 vulnerabilities and has 171 fixes\n is now available.\n\nDescription:\n\n\n\n The openSUSE Leap 15.0 was updated to receive various security and\n bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2019-2024: A use-after-free when disconnecting a source was fixed\n which could lead to crashes. bnc#1129179).\n - CVE-2019-3819: A flaw was found in the Linux kernel in the function\n hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter\n an infinite loop with certain parameters passed from a userspace. A\n local privileged user (\"root\") can cause a system lock up and a denial\n of service. Versions from v4.18 and newer are vulnerable (bnc#1123161).\n - CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds\n speculation on pointer arithmetic in various cases, including cases of\n different branches with different state or limits to sanitize, leading\n to side-channel attacks (bnc#1124055).\n - CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a\n NULL value for a certain structure member, which leads to a\n use-after-free in sockfs_setattr (bnc#1125907).\n - CVE-2019-8980: A memory leak in the kernel_read_file function in\n fs/exec.c allowed attackers to cause a denial of service (memory\n consumption) by triggering vfs_read failures (bnc#1126209).\n - CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap\n minimum address, which made it easier for attackers to exploit kernel\n NULL pointer dereferences on non-SMAP platforms. This is related to a\n capability check for the wrong task (bnc#1128166).\n\n The following non-security bugs were fixed:\n\n - 9p/net: fix memory leak in p9_client_create (bsc#1051510).\n - 9p: use inode->i_lock to protect i_size_write() under 32-bit\n (bsc#1051510).\n - acpi: acpi_pad: Do not launch acpi_pad threads on idle cpus\n (bsc#1113399).\n - acpi/APEI: Clear GHES block_status before panic() (bsc#1051510).\n - acpi/device_sysfs: Avoid OF modalias creation for removed device\n (bsc#1051510).\n - acpi/nfit: Fix bus command validation (bsc#1051510).\n - acpi: NUMA: Use correct type for printing addresses on i386-PAE\n (bsc#1051510).\n - acpi / video: Extend chassis-type detection with a \"Lunch Box\" check\n (bsc#1051510).\n - acpi / video: Refactor and fix dmi_is_desktop() (bsc#1051510).\n - alsa: bebob: use more identical mod_alias for Saffire Pro 10 I/O against\n Liquid Saffire 56 (bsc#1051510).\n - alsa: compress: prevent potential divide by zero bugs (bsc#1051510).\n - alsa: echoaudio: add a check for ioremap_nocache (bsc#1051510).\n - alsa: firewire: add const qualifier to identifiers for read-only symbols\n (bsc#1051510).\n - alsa: firewire-motu: add a flag for AES/EBU on XLR interface\n (bsc#1051510).\n - alsa: firewire-motu: add specification flag for position of flag for\n MIDI messages (bsc#1051510).\n - alsa: firewire-motu: add support for MOTU Audio Express (bsc#1051510).\n - alsa: firewire-motu: add support for Motu Traveler (bsc#1051510).\n - alsa: firewire-motu: fix construction of PCM frame for capture direction\n (bsc#1051510).\n - alsa: firewire-motu: use 'version' field of unit directory to identify\n model (bsc#1051510).\n - alsa: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist\n (bsc#1051510).\n - alsa: hda - Add quirk for HP EliteBook 840 G5 (bsc#1051510).\n - alsa: hda - Enforces runtime_resume after S3 and S4 for each codec\n (bsc#1051510).\n - alsa: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset\n mic (bsc#1051510).\n - alsa: hda/realtek: Disable PC beep in passthrough on alc285\n (bsc#1051510).\n - alsa: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256\n (bsc#1051510).\n - alsa: hda/realtek: Enable audio jacks of ASUS UX362FA with ALC294\n (bsc#1051510).\n - alsa: hda/realtek: Enable headset MIC of Acer AIO with ALC286\n (bsc#1051510).\n - alsa: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with ALC286\n (bsc#1051510).\n - alsa: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256\n (bsc#1051510).\n - alsa: hda/realtek - Headset microphone and internal speaker support for\n System76 oryp5 (bsc#1051510).\n - alsa: hda/realtek - Headset microphone support for System76 darp5\n (bsc#1051510).\n - alsa: hda/realtek - Reduce click noise on Dell Precision 5820 headphone\n (bsc#1126131).\n - alsa: hda - Record the current power state before suspend/resume calls\n (bsc#1051510).\n - alsa: opl3: fix mismatch between snd_opl3_drum_switch definition and\n declaration (bsc#1051510).\n - alsa: pcm: Do not suspend stream in unrecoverable PCM state\n (bsc#1051510).\n - alsa: pcm: Fix possible OOB access in PCM oss plugins (bsc#1051510).\n - alsa: rawmidi: Fix potential Spectre v1 vulnerability (bsc#1051510).\n - alsa: sb8: add a check for request_region (bsc#1051510).\n - alsa: seq: oss: Fix Spectre v1 vulnerability (bsc#1051510).\n - alsa: usb-audio: Fix implicit fb endpoint setup by quirk (bsc#1051510).\n - altera-stapl: check for a null key before strcasecmp'ing it\n (bsc#1051510).\n - apparmor: Fix aa_label_build() error handling for failed merges\n (bsc#1051510).\n - applicom: Fix potential Spectre v1 vulnerabilities (bsc#1051510).\n - aquantia: Setup max_mtu in ndev to enable jumbo frames (bsc#1051510).\n - arm64: fault: avoid send SIGBUS two times (bsc#1126393).\n - arm: 8808/1: kexec:offline panic_smp_self_stop CPU (bsc#1051510).\n - arm/arm64: KVM: Rename function kvm_arch_dev_ioctl_check_extension()\n (bsc#1126393).\n - arm: iop32x/n2100: fix PCI IRQ mapping (bsc#1051510).\n - arm: OMAP2+: hwmod: Fix some section annotations (bsc#1051510).\n - arm: pxa: avoid section mismatch warning (bsc#1051510).\n - arm: tango: Improve ARCH_MULTIPLATFORM compatibility (bsc#1051510).\n - ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages\n (bsc#1051510).\n - ASoC: dapm: change snprintf to scnprintf for possible overflow\n (bsc#1051510).\n - ASoC: fsl_esai: fix register setting issue in RIGHT_J mode (bsc#1051510).\n - ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M (bsc#1051510).\n - ASoC: imx-audmux: change snprintf to scnprintf for possible overflow\n (bsc#1051510).\n - ASoC: imx-sgtl5000: put of nodes if finding codec fails (bsc#1051510).\n - ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field\n (bsc#1051510).\n - ASoC: msm8916-wcd-analog: add missing license information (bsc#1051510).\n - ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()\n (bsc#1051510).\n - ASoC: rsnd: fixup rsnd_ssi_master_clk_start() user count check\n (bsc#1051510).\n - assoc_array: Fix shortcut creation (bsc#1051510).\n - ata: ahci: mvebu: remove stale comment (bsc#1051510).\n - ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom (bsc#1051510).\n - ath9k: dynack: check da->enabled first in sampling routines\n (bsc#1051510).\n - ath9k: dynack: make ewma estimation faster (bsc#1051510).\n - ath9k: dynack: use authentication messages for 'late' ack (bsc#1051510).\n - atm: he: fix sign-extension overflow on large shift (bsc#1051510).\n - auxdisplay: hd44780: Fix memory leak on ->remove() (bsc#1051510).\n - auxdisplay: ht16k33: fix potential user-after-free on module unload\n (bsc#1051510).\n - ax25: fix possible use-after-free (bsc#1051510).\n - backlight: pwm_bl: Use gpiod_get_value_cansleep() to get initial\n (bsc#1113722)\n - batman-adv: Avoid WARN on net_device without parent in netns\n (bsc#1051510).\n - batman-adv: fix uninit-value in batadv_interface_tx() (bsc#1051510).\n - batman-adv: Force mac header to start of data on xmit (bsc#1051510).\n - bio: Introduce BIO_ALLOCED flag and check it in bio_free (bsc#1128094).\n - blk-mq: fix a hung issue when fsync (bsc#1125252).\n - block_dev: fix crash on chained bios with O_DIRECT (bsc#1128094).\n - block_dev: fix crash on chained bios with O_DIRECT (bsc#1128094).\n - blockdev: Fix livelocks on loop device (bsc#1124984).\n - block: do not use bio->bi_vcnt to figure out segment number\n (bsc#1128895).\n - block: do not warn when doing fsync on read-only devices (bsc#1125252).\n - block/loop: Use global lock for ioctl() operation (bsc#1124974).\n - block: move bio_integrity_{intervals,bytes} into blkdev.h (bsc#1114585).\n - bluetooth: Fix decrementing reference count twice in releasing socket\n (bsc#1051510).\n - bluetooth: Fix locking in bt_accept_enqueue() for BH context\n (bsc#1051510).\n - bluetooth: Fix unnecessary error message for HCI request completion\n (bsc#1051510).\n - bluetooth: hci_ldisc: Initialize hci_dev before open() (bsc#1051510).\n - bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in\n hci_uart_set_proto() (bsc#1051510).\n - bnxt_en: Fix typo in firmware message timeout logic (bsc#1086282 ).\n - bnxt_en: Wait longer for the firmware message response to complete\n (bsc#1086282).\n - bpf: decrease usercnt if bpf_map_new_fd() fails in\n bpf_map_get_fd_by_id() (bsc#1083647).\n - bpf: drop refcount if bpf_map_new_fd() fails in map_create()\n (bsc#1083647).\n - bpf: fix lockdep false positive in percpu_freelist (bsc#1083647).\n - bpf: fix replace_map_fd_with_map_ptr's ldimm64 second imm field\n (bsc#1083647).\n - bpf: fix sanitation rewrite in case of non-pointers (bsc#1083647).\n - bpf: Fix syscall's stackmap lookup potential deadlock (bsc#1083647).\n - bpf, lpm: fix lookup bug in map_delete_elem (bsc#1083647).\n - bpf/verifier: fix verifier instability (bsc#1056787).\n - bsg: Do not copy sense if no response buffer is allocated\n (bsc#1106811,bsc#1126555).\n - btrfs: dedupe_file_range ioctl: remove 16MiB restriction (bsc#1127494).\n - btrfs: do not unnecessarily pass write_lock_level when processing leaf\n (bsc#1126802).\n - btrfs: ensure that a DUP or RAID1 block group has exactly two stripes\n (bsc#1128451).\n - btrfs: fix clone vs chattr NODATASUM race (bsc#1127497).\n - btrfs: fix corruption reading shared and compressed extents after hole\n punching (bsc#1126476).\n - btrfs: fix deadlock between clone/dedupe and rename (bsc#1130518).\n - btrfs: fix deadlock when allocating tree block during leaf/node split\n (bsc#1126806).\n - btrfs: fix deadlock when using free space tree due to block group\n creation (bsc#1126804).\n - btrfs: fix fsync after succession of renames and unlink/rmdir\n (bsc#1126488).\n - btrfs: fix fsync after succession of renames of different files\n (bsc#1126481).\n - btrfs: fix invalid-free in btrfs_extent_same (bsc#1127498).\n - btrfs: fix reading stale metadata blocks after degraded raid1 mounts\n (bsc#1126803).\n - btrfs: fix use-after-free of cmp workspace pages (bsc#1127603).\n - btrfs: grab write lock directly if write_lock_level is the max level\n (bsc#1126802).\n - btrfs: Improve btrfs_search_slot description (bsc#1126802).\n - btrfs: move get root out of btrfs_search_slot to a helper (bsc#1126802).\n - btrfs: qgroup: Cleanup old subtree swap code (bsc#1063638).\n - btrfs: qgroup: Do not trace subtree if we're dropping reloc tree\n (bsc#1063638).\n - btrfs: qgroup: Finish rescan when hit the last leaf of extent tree\n (bsc#1129327).\n - btrfs: qgroup: Introduce function to find all new tree blocks of reloc\n tree (bsc#1063638).\n - btrfs: qgroup: Introduce function to trace two swaped extents\n (bsc#1063638).\n - btrfs: qgroup: Introduce per-root swapped blocks infrastructure\n (bsc#1063638).\n - btrfs: qgroup: Introduce trace event to analyse the number of dirty\n extents accounted (bsc#1063638 dependency).\n - btrfs: qgroup: Make qgroup async transaction commit more aggressive\n (bsc#1113042).\n - btrfs: qgroup: Only trace data extents in leaves if we're relocating\n data block group (bsc#1063638).\n - btrfs: qgroup: Refactor btrfs_qgroup_trace_subtree_swap (bsc#1063638).\n - btrfs: qgroup: Search commit root for rescan to avoid missing extent\n (bsc#1129326).\n - btrfs: qgroup: Use delayed subtree rescan for balance (bsc#1063638).\n - btrfs: qgroup: Use generation-aware subtree swap to mark dirty extents\n (bsc#1063638).\n - btrfs: quota: Set rescan progress to (u64)-1 if we hit last leaf\n (bsc#1129327).\n - btrfs: relocation: Delay reloc tree deletion after merge_reloc_roots\n (bsc#1063638).\n - btrfs: reloc: Fix NULL pointer dereference due to expanded reloc_root\n lifespan (bsc#1129497).\n - btrfs: remove always true check in unlock_up (bsc#1126802).\n - btrfs: remove superfluous free_extent_buffer in read_block_for_search\n (bsc#1126802).\n - btrfs: remove unnecessary level check in balance_level (bsc#1126802).\n - btrfs: remove unused check of skip_locking (bsc#1126802).\n - btrfs: reuse cmp workspace in EXTENT_SAME ioctl (bsc#1127495).\n - btrfs: send, fix race with transaction commits that create snapshots\n (bsc#1126802).\n - btrfs: simplify IS_ERR/PTR_ERR checks (bsc#1126481).\n - btrfs: split btrfs_extent_same (bsc#1127493).\n - btrfs: use kvzalloc for EXTENT_SAME temporary data (bsc#1127496).\n - btrfs: use more straightforward extent_buffer_uptodate check\n (bsc#1126802).\n - cdc-wdm: pass return value of recover_from_urb_loss (bsc#1051510).\n - ceph: avoid repeatedly adding inode to mdsc->snap_flush_list\n (bsc#1126790).\n - ceph: clear inode pointer when snap realm gets dropped by its inode\n (bsc#1125799).\n - cfg80211: extend range deviation for DMG (bsc#1051510).\n - ch: add missing mutex_lock()/mutex_unlock() in ch_release()\n (bsc#1124235).\n - ch: fixup refcounting imbalance for SCSI devices (bsc#1124235).\n - cifs: allow guest mounts to work for smb3.11 (bsc#1051510).\n - cifs: Always resolve hostname before reconnecting (bsc#1051510).\n - cifs: connect to servername instead of IP for IPC$ share (bsc#1051510).\n - cifs: Fix NULL pointer dereference of devname (bnc#1129519).\n - cifs: invalidate cache when we truncate a file (bsc#1051510).\n - cifs: OFD locks do not conflict with eachothers (bsc#1051510).\n - clk: armada-370: fix refcount leak in a370_clk_init() (bsc#1051510).\n - clk: armada-xp: fix refcount leak in axp_clk_init() (bsc#1051510).\n - clk: clk-twl6040: Fix imprecise external abort for pdmclk (bsc#1051510).\n - clk: dove: fix refcount leak in dove_clk_init() (bsc#1051510).\n - clk: highbank: fix refcount leak in hb_clk_init() (bsc#1051510).\n - clk: imx6q: fix refcount leak in imx6q_clocks_init() (bsc#1051510).\n - clk: imx6sl: ensure MMDC CH0 handshake is bypassed (bsc#1051510).\n - clk: imx6sx: fix refcount leak in imx6sx_clocks_init() (bsc#1051510).\n - clk: imx7d: fix refcount leak in imx7d_clocks_init() (bsc#1051510).\n - clk: ingenic: Fix doc of ingenic_cgu_div_info (bsc#1051510).\n - clk: ingenic: Fix round_rate misbehaving with non-integer dividers\n (bsc#1051510).\n - clk: kirkwood: fix refcount leak in kirkwood_clk_init() (bsc#1051510).\n - clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init()\n (bsc#1051510).\n - clk: qoriq: fix refcount leak in clockgen_init() (bsc#1051510).\n - clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()\n (bsc#1051510).\n - clk: socfpga: fix refcount leak (bsc#1051510).\n - clk: sunxi: A31: Fix wrong AHB gate number (bsc#1051510).\n - clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks\n (bsc#1051510).\n - clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it\n (bsc#1051510).\n - clk: sunxi-ng: v3s: Fix TCON reset de-assert bit (bsc#1051510).\n - clk: uniphier: Fix update register for CPU-gear (bsc#1051510).\n - clk: vc5: Abort clock configuration without upstream clock (bsc#1051510).\n - clk: vf610: fix refcount leak in vf610_clocks_init() (bsc#1051510).\n - clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown\n (bsc#1051510).\n - clocksource/drivers/exynos_mct: Fix error path in timer resources\n initialization (bsc#1051510).\n - clocksource/drivers/exynos_mct: Move one-shot check from tick clear to\n ISR (bsc#1051510).\n - clocksource/drivers/integrator-ap: Add missing of_node_put()\n (bsc#1051510).\n - clocksource/drivers/sun5i: Fail gracefully when clock rate is\n unavailable (bsc#1051510).\n - configfs: fix registered group removal (bsc#1051510).\n - copy_mount_string: Limit string length to PATH_MAX (bsc#1082943).\n - cpcap-charger: generate events for userspace (bsc#1051510).\n - cpufreq: Cap the default transition delay value to 10 ms (bsc#1127042).\n - cpufreq: conservative: Take limits changes into account properly\n (bsc#1051510).\n - cpufreq: governor: Avoid accessing invalid governor_data (bsc#1051510).\n - cpufreq: governor: Drop min_sampling_rate (bsc#1127042).\n - cpufreq: governor: Ensure sufficiently large sampling intervals\n (bsc#1127042).\n - cpufreq: pxa2xx: remove incorrect __init annotation (bsc#1051510).\n - cpufreq: tegra124: add missing of_node_put() (bsc#1051510).\n - cpufreq: Use transition_delay_us for legacy governors as well\n (bsc#1127042).\n - cpuidle: big.LITTLE: fix refcount leak (bsc#1051510).\n - crypto: aes_ti - disable interrupts while accessing S-box (bsc#1051510).\n - crypto: ahash - fix another early termination in hash walk (bsc#1051510).\n - crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling\n (bsc#1051510).\n - crypto: arm/crct10dif - revert to C code for short inputs (bsc#1051510).\n - crypto: brcm - Fix some set-but-not-used warning (bsc#1051510).\n - crypto: caam - fixed handling of sg list (bsc#1051510).\n - crypto: cavium/zip - fix collision with generic cra_driver_name\n (bsc#1051510).\n - crypto: crypto4xx - add missing of_node_put after of_device_is_available\n (bsc#1051510).\n - crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove()\n arguments (bsc#1051510).\n - crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails (bsc#1051510).\n - crypto: testmgr - skip crc32c context test for ahash algorithms\n (bsc#1051510).\n - crypto: tgr192 - fix unaligned memory access (bsc#1051510).\n - crypto: ux500 - Use proper enum in cryp_set_dma_transfer (bsc#1051510).\n - crypto: ux500 - Use proper enum in hash_set_dma_transfer (bsc#1051510).\n - cw1200: drop useless LIST_HEAD (bsc#1051510).\n - cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()\n (bsc#1051510).\n - cw1200: fix missing unlock on error in cw1200_hw_scan() (bsc#1051510).\n - dccp: fool proof ccid_hc_[rt]x_parse_options() (bsc#1051510).\n - debugfs: fix debugfs_rename parameter checking (bsc#1051510).\n - device property: Fix the length used in PROPERTY_ENTRY_STRING()\n (bsc#1051510).\n - dlm: Do not swamp the CPU with callbacks queued during recovery\n (bsc#1051510).\n - dmaengine: at_hdmac: drop useless LIST_HEAD (bsc#1051510).\n - dmaengine: at_xdmac: Fix wrongfull report of a channel as in use\n (bsc#1051510).\n - dmaengine: bcm2835: Fix abort of transactions (bsc#1051510).\n - dmaengine: bcm2835: Fix interrupt race on RT (bsc#1051510).\n - dmaengine: dmatest: Abort test in case of mapping error (bsc#1051510).\n - dmaengine: dw: drop useless LIST_HEAD (bsc#1051510).\n - dmaengine: imx-dma: fix wrong callback invoke (bsc#1051510).\n - dmaengine: mv_xor: Use correct device for DMA API (bsc#1051510).\n - dmaengine: pl330: drop useless LIST_HEAD (bsc#1051510).\n - dmaengine: sa11x0: drop useless LIST_HEAD (bsc#1051510).\n - dmaengine: st_fdma: drop useless LIST_HEAD (bsc#1051510).\n - dmaengine: stm32-dma: fix incomplete configuration in cyclic mode\n (bsc#1051510).\n - dma: Introduce dma_max_mapping_size() (bsc#1120008).\n - doc: rcu: Suspicious RCU usage is a warning (bsc#1051510).\n - Do not log confusing message on reconnect by default (bsc#1129664).\n - driver core: Do not resume suppliers under device_links_write_lock()\n (bsc#1051510).\n - drivers: hv: vmbus: Check for ring when getting debug info (bsc#1126389,\n bsc#1126579).\n - drivers: hv: vmbus: preserve hv_ringbuffer_get_debuginfo kABI\n (bsc#1126389, bsc#1126579).\n - drivers: hv: vmbus: Return -EINVAL for the sys files for unopened\n channels (bsc#1126389, bsc#1126579).\n - drm/amdgpu: Add delay after enable RLC ucode (bsc#1051510).\n - drm/ast: Fix connector leak during driver unload (bsc#1051510).\n - drm/ast: fixed reading monitor EDID not stable issue (bsc#1051510).\n - drm/atomic-helper: Complete fake_commit->flip_done potentially earlier\n (bsc#1051510).\n - drm: Block fb changes for async plane updates (bsc#1051510).\n - drm/bridge: tc358767: add defines for DP1_SRCCTRL & PHY_2LANE\n (bsc#1051510).\n - drm/bridge: tc358767: fix initial DP0/1_SRCCTRL value (bsc#1051510).\n - drm/bridge: tc358767: fix output H/V syncs (bsc#1051510).\n - drm/bridge: tc358767: fix single lane configuration (bsc#1051510).\n - drm/bridge: tc358767: reject modes which require too much BW\n (bsc#1051510).\n - drm/bufs: Fix Spectre v1 vulnerability (bsc#1051510).\n - drm: Clear state->acquire_ctx before leaving\n drm_atomic_helper_commit_duplicated_state() (bsc#1051510).\n - drm: disable uncached DMA optimization for ARM and arm64 (bsc#1051510).\n - drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump() (bsc#1113722)\n - drm/etnaviv: potential NULL dereference (bsc#1113722)\n - drm: Fix error handling in drm_legacy_addctx (bsc#1113722)\n - drm/i915/bios: assume eDP is present on port A when there is no VBT\n (bsc#1051510).\n - drm/i915: Block fbdev HPD processing during suspend (bsc#1113722)\n - drm/i915/fbdev: Actually configure untiled displays (bsc#1113722)\n - drm/i915: Flush GPU relocs harder for gen3 (bsc#1113722)\n - drm/i915/gvt: free VFIO region space in vgpu detach (bsc#1113722)\n - drm/i915/gvt: release shadow batch buffer and wa_ctx before destroy one\n workload (bsc#1051510).\n - drm/i915/opregion: fix version check (bsc#1113722)\n - drm/i915/opregion: rvda is relative from opregion base in opregion\n (bsc#1113722)\n - drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set\n (bsc#1113722)\n - drm/i915: Redefine some Whiskey Lake SKUs (bsc#1051510).\n - drm/i915: Relax mmap VMA check (bsc#1051510).\n - drm/i915: Use the correct crtc when sanitizing plane mapping\n (bsc#1113722)\n - drm/imx: ignore plane updates on disabled crtcs (bsc#1051510).\n - drm/imx: imx-ldb: add missing of_node_puts (bsc#1051510).\n - drm/meson: add missing of_node_put (bsc#1051510).\n - drm/modes: Prevent division by zero htotal (bsc#1051510).\n - drm/msm: Fix error return checking (bsc#1051510).\n - drm/msm: Grab a vblank reference when waiting for commit_done\n (bsc#1051510).\n - drm/msm: Unblock writer if reader closes file (bsc#1051510).\n - drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON\n (bsc#1113722)\n - drm/nouveau/debugfs: Fix check of pm_runtime_get_sync failure\n (bsc#1051510).\n - drm/nouveau: Do not spew kernel WARNING for each timeout (bsc#1126480).\n - drm/nouveau: Do not WARN_ON VCPI allocation failures (bsc#1113722)\n - drm/nouveau/falcon: avoid touching registers if engine is off\n (bsc#1051510).\n - drm/nouveau/pmu: do not print reply values if exec is false (bsc#1113722)\n - drm/radeon/evergreen_cs: fix missing break in switch statement\n (bsc#1113722)\n - drm: Reorder set_property_atomic to avoid returning with an active\n ww_ctx (bsc#1051510).\n - drm/rockchip: fix for mailbox read size (bsc#1051510).\n - drm/shmob: Fix return value check in shmob_drm_probe (bsc#1113722)\n - drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init\n (bsc#1051510).\n - drm/vmwgfx: Do not double-free the mode stored in par->set_mode\n (bsc#1103429)\n - earlycon: Initialize port->uartclk based on clock-frequency property\n (bsc#1051510).\n - earlycon: Remove hardcoded port->uartclk initialization in\n of_setup_earlycon (bsc#1051510).\n - Enable CONFIG_RDMA_RXE=m also for ppc64le (bsc#1107665,)\n - Enable livepatch test drivers in lib/ Livepatch kselftests need those.\n - enic: fix build warning without CONFIG_CPUMASK_OFFSTACK (bsc#1051510).\n - enic: fix checksum validation for IPv6 (bsc#1051510).\n - esp6: fix memleak on error path in esp6_input (bsc#1051510).\n - esp: Fix locking on page fragment allocation (bsc#1051510).\n - esp: Fix memleaks on error paths (bsc#1051510).\n - esp: Fix skb tailroom calculation (bsc#1051510).\n - ext4: avoid kernel warning when writing the superblock to a dead device\n (bsc#1124981).\n - ext4: Avoid panic during forced reboot (bsc#1126356).\n - ext4: check for shutdown and r/o file system in ext4_write_inode()\n (bsc#1124978).\n - ext4: fix a potential fiemap/page fault deadlock w/ inline_data\n (bsc#1124980).\n - ext4: force inode writes when nfsd calls commit_metadata() (bsc#1125125).\n - ext4: include terminating u32 in size of xattr entries when expanding\n inodes (bsc#1124976).\n - ext4: make sure enough credits are reserved for dioread_nolock writes\n (bsc#1124979).\n - ext4: track writeback errors using the generic tracking infrastructure\n (bsc#1124982).\n - fbdev: chipsfb: remove set but not used variable 'size' (bsc#1113722)\n - firmware/efi: Add NULL pointer checks in efivars API functions\n (bsc#1051510).\n - floppy: check_events callback should not return a negative number\n (bsc#1051510).\n - fs/dax: deposit pagetable even when installing zero page (bsc#1126740).\n - fs/dcache: Fix incorrect nr_dentry_unused accounting in\n shrink_dcache_sb() (git-fixes).\n - fs/devpts: always delete dcache dentry-s in dput() (git-fixes).\n - fuse: call pipe_buf_release() under pipe lock (bsc#1051510).\n - fuse: continue to send FUSE_RELEASEDIR when FUSE_OPEN returns ENOSYS\n (bsc#1051510).\n - fuse: decrement NR_WRITEBACK_TEMP on the right page (bsc#1051510).\n - fuse: handle zero sized retrieve correctly (bsc#1051510).\n - futex: Fix (possible) missed wakeup (bsc#1050549).\n - gdrom: fix a memory leak bug (bsc#1051510).\n - geneve: cleanup hard coded value for Ethernet header length\n (bsc#1123456).\n - geneve: correctly handle ipv6.disable module parameter (bsc#1051510).\n - geneve, vxlan: Do not check skb_dst() twice (bsc#1123456).\n - geneve, vxlan: Do not set exceptions if skb->len < mtu (bsc#1123456).\n - genwqe: Fix size check (bsc#1051510).\n - gfs2: Revert \"Fix loop in gfs2_rbm_find\" (bsc#1120601).\n - gianfar: fix a flooded alignment reports because of padding issue\n (bsc#1051510).\n - gianfar: Fix Rx byte accounting for ndev stats (bsc#1051510).\n - gianfar: prevent integer wrapping in the rx handler (bsc#1051510).\n - gpu: ipu-v3: Fix CSI offsets for imx53 (bsc#1113722)\n - gpu: ipu-v3: Fix i.MX51 CSI control registers offset (bsc#1113722)\n - gpu: ipu-v3: image-convert: Prevent race between run and unprepare\n (bsc#1051510).\n - gro_cells: make sure device is up in gro_cells_receive() (git-fixes).\n - hid: lenovo: Add checks to fix of_led_classdev_register (bsc#1051510).\n - hpet: Fix missing '=' character in the __setup() code of\n hpet_mmap_enable (git-fixes).\n - hvc_opal: do not set tb_ticks_per_usec in udbg_init_opal_common()\n (bsc#1051510).\n - hv: reduce storvsc_ringbuffer_size from 1M to 128K to simplify booting\n with 1k vcpus ().\n - hv: v4.12 API for hyperv-iommu (bsc#1122822).\n - hwmon: (lm80) fix a missing check of bus read in lm80 probe\n (bsc#1051510).\n - hwmon: (lm80) fix a missing check of the status of SMBus read\n (bsc#1051510).\n - hwmon: (lm80) Fix missing unlock on error in set_fan_div() (bsc#1051510).\n - hwmon: (tmp421) Correct the misspelling of the tmp442 compatible\n attribute in OF device ID table (bsc#1051510).\n - HYPERV/IOMMU: Add Hyper-V stub IOMMU driver (bsc#1122822).\n - i2c-axxia: check for error conditions first (bsc#1051510).\n - i2c: bcm2835: Clear current buffer pointers and counts after a transfer\n (bsc#1051510).\n - i2c: cadence: Fix the hold bit setting (bsc#1051510).\n - i2c: omap: Use noirq system sleep pm ops to idle device for suspend\n (bsc#1051510).\n - i2c: sh_mobile: add support for r8a77990 (R-Car E3) (bsc#1051510).\n - i2c: tegra: fix maximum transfer size (bsc#1051510).\n - ib/core: Destroy QP if XRC QP fails (bsc#1046306).\n - ib/core: Fix potential memory leak while creating MAD agents\n (bsc#1046306).\n - ib/core: Unregister notifier before freeing MAD security (bsc#1046306).\n - ib/hfi1: Close race condition on user context disable and close\n (bsc#1060463).\n - ib/mlx5: Unmap DMA addr from HCA before IOMMU (bsc#1046305 ).\n - ibmvnic: Report actual backing device speed and duplex values\n (bsc#1129923).\n - ibmvscsi: Fix empty event pool access during host removal (bsc#1119019).\n - ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton\n (bsc#1119019).\n - ieee802154: ca8210: fix possible u8 overflow in ca8210_rx_done\n (bsc#1051510).\n - igb: Fix an issue that PME is not enabled during runtime suspend\n (bsc#1051510).\n - iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID (bsc#1051510).\n - iio: adc: exynos-adc: Fix NULL pointer exception on unbind (bsc#1051510).\n - iio: chemical: atlas-ph-sensor: correct IIO_TEMP values to millicelsius\n (bsc#1051510).\n - Input: bma150 - register input device after setting private data\n (bsc#1051510).\n - input: cap11xx - switch to using set_brightness_blocking() (bsc#1051510).\n - Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK\n (bsc#1051510).\n - Input: elan_i2c - add id for touchpad found in Lenovo s21e-20\n (bsc#1051510).\n - Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780\n (bsc#1051510).\n - input: matrix_keypad - use flush_delayed_work() (bsc#1051510).\n - Input: raspberrypi-ts - select CONFIG_INPUT_POLLDEV (git-fixes).\n - input: st-keyscan - fix potential zalloc NULL dereference (bsc#1051510).\n - input: uinput - fix undefined behavior in uinput_validate_absinfo()\n (bsc#1120902).\n - Input: wacom_serial4 - add support for Wacom ArtPad II tablet\n (bsc#1051510).\n - intel_th: Do not reference unassigned outputs (bsc#1051510).\n - intel_th: gth: Fix an off-by-one in output unassigning (bsc#1051510).\n - iomap: fix integer truncation issues in the zeroing and dirtying helpers\n (bsc#1125947).\n - iomap: warn on zero-length mappings (bsc#1127062).\n - iommu/amd: Fix NULL dereference bug in match_hid_uid (bsc#1130336).\n - iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE\n (bsc#1130337).\n - iommu/amd: Reserve exclusion range in iova-domain (bsc#1130425).\n - iommu/dmar: Fix buffer overflow during PCI bus notification\n (bsc#1129181).\n - iommu: Document iommu_ops.is_attach_deferred() (bsc#1129182).\n - iommu: Do not print warning when IOMMU driver only supports unmanaged\n domains (bsc#1130130).\n - iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables (bsc#1129205).\n - iommu/vt-d: Check capability before disabling protected memory\n (bsc#1130338).\n - iommu/vt-d: Check identity map for hot-added devices (bsc#1129183).\n - iommu/vt-d: Fix NULL pointer reference in intel_svm_bind_mm()\n (bsc#1129184).\n - ip6: fix PMTU discovery when using /127 subnets (git-fixes).\n - ip6mr: Do not call __IP6_INC_STATS() from preemptible context\n (git-fixes).\n - ip6_tunnel: get the min mtu properly in ip6_tnl_xmit (bsc#1123456).\n - ip6_tunnel: use the right value for ipv4 min mtu check in ip6_tnl_xmit\n (bsc#1123456).\n - ipsec: check return value of skb_to_sgvec always (bsc#1051510).\n - ipv4/route: fail early when inet dev is missing (git-fixes).\n - ipv4: speedup ipv6 tunnels dismantle (bsc#1122982).\n - ipv6: addrlabel: per netns list (bsc#1122982).\n - ipv6: Consider sk_bound_dev_if when binding a socket to an address\n (networking-stable-19_02_01).\n - ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped\n address (networking-stable-19_01_22).\n - ipv6: fix kernel-infoleak in ipv6_local_error()\n (networking-stable-19_01_20).\n - ipv6: speedup ipv6 tunnels dismantle (bsc#1122982). Refresh\n patches.suse/ip6_vti-fix-a-null-pointer-deference-when-destroy-vt.patch\n - ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses\n (networking-stable-19_01_22).\n - ipvlan, l3mdev: fix broken l3s mode wrt local routes\n (networking-stable-19_02_01).\n - irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size\n (bsc#1051510).\n - irqchip/gic-v3-its: Avoid parsing _indirect_ twice for Device table\n (bsc#1051510).\n - irqchip/gic-v3-its: Do not bind LPI to unavailable NUMA node\n (bsc#1051510).\n - irqchip/gic-v3-its: Fix ITT_entry_size accessor (bsc#1051510).\n - irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable\n (bsc#1051510).\n - iscsi_ibft: Fix missing break in switch statement (bsc#1051510).\n - isdn: avm: Fix string plus integer warning from Clang (bsc#1051510).\n - isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in\n HFCPCI_l1hw() (bsc#1051510).\n - isdn: i4l: isdn_tty: Fix some concurrency double-free bugs (bsc#1051510).\n - iser: set sector for ambiguous mr status errors (bsc#1051510).\n - iwlwifi: mvm: avoid possible access out of array (bsc#1051510).\n - iwlwifi: mvm: fix A-MPDU reference assignment (bsc#1051510).\n - iwlwifi: mvm: fix firmware statistics usage (bsc#1129770).\n - iwlwifi: mvm: fix RSS config command (bsc#1051510).\n - iwlwifi: pcie: fix emergency path (bsc#1051510).\n - iwlwifi: pcie: fix TX while flushing (bsc#1120902).\n - ixgbe: Be more careful when modifying MAC filters (bsc#1051510).\n - ixgbe: check return value of napi_complete_done() (bsc#1051510).\n - ixgbe: recognize 1000BaseLX SFP modules as 1Gbps (bsc#1051510).\n - kabi: cpufreq: keep min_sampling_rate in struct dbs_data (bsc#1127042).\n - kabi: handle addition of ip6addrlbl_table into struct netns_ipv6\n (bsc#1122982).\n - kabi: handle addition of uevent_sock into struct net (bsc#1122982).\n - kabi: Preserve kABI for dma_max_mapping_size() (bsc#1120008).\n - kabi: protect vhost_log_write (kabi).\n - kabi: restore ip_tunnel_delete_net() (bsc#1122982).\n - kabi workaround for ath9k ath_node.ackto type change (bsc#1051510).\n - kABI workaround for bt_accept_enqueue() change (bsc#1051510).\n - kallsyms: Handle too long symbols in kallsyms.c (bsc#1126805).\n - kasan: fix shadow_size calculation error in kasan_module_alloc\n (bsc#1051510).\n - kbuild: fix false positive warning/error about missing libelf\n (bsc#1051510).\n - kconfig: fix file name and line number of warn_ignored_character()\n (bsc#1051510).\n - kconfig: fix line numbers for if-entries in menu tree (bsc#1051510).\n - kconfig: fix memory leak when EOF is encountered in quotation\n (bsc#1051510).\n - kconfig: fix the rule of mainmenu_stmt symbol (bsc#1051510).\n - keys: allow reaching the keys quotas exactly (bsc#1051510).\n - keys: Timestamp new keys (bsc#1051510).\n - kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var()\n (bsc#1051510).\n - kgdboc: Fix restrict error (bsc#1051510).\n - kgdboc: Fix warning with module build (bsc#1051510).\n - kobject: add kobject_uevent_net_broadcast() (bsc#1122982).\n - kobject: copy env blob in one go (bsc#1122982).\n - kobject: factorize skb setup in kobject_uevent_net_broadcast()\n (bsc#1122982).\n - kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()\n (bsc#1051510).\n - kvm: mmu: Fix race in emulated page table writes (bsc#1129284).\n - kvm: nVMX: Free the VMREAD/VMWRITE bitmaps if alloc_kvm_area() fails\n (bsc#1129291).\n - kvm: nVMX: NMI-window and interrupt-window exiting should wake L2 from\n HLT (bsc#1129292).\n - kvm: nVMX: Set VM instruction error for VMPTRLD of unbacked page\n (bsc#1129293).\n - kvm: vmx: Set IA32_TSC_AUX for legacy mode guests (bsc#1129294).\n - kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs (bsc#1127082).\n - kvm: x86: Fix single-step debugging (bsc#1129295).\n - kvm: x86: Use jmp to invoke kvm_spurious_fault() from .fixup\n (bsc#1129296).\n - l2tp: copy 4 more bytes to linear part if necessary\n (networking-stable-19_02_01).\n - l2tp: fix infoleak in l2tp_ip6_recvmsg() (git-fixes).\n - l2tp: fix reading optional fields of L2TPv3 (networking-stable-19_02_01).\n - leds: lp5523: fix a missing check of return value of lp55xx_read\n (bsc#1051510).\n - leds: lp55xx: fix null deref on firmware load failure (bsc#1051510).\n - libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive()\n (bsc#1125800).\n - libceph: handle an empty authorize reply (bsc#1126789).\n - libceph: wait for latest osdmap in ceph_monc_blacklist_add()\n (bsc#1130427).\n - lib/div64.c: off by one in shift (bsc#1051510).\n - libertas_tf: do not set URB_ZERO_PACKET on IN USB transfer (bsc#1051510).\n - libnvdimm: Fix altmap reservation size calculation (bsc#1127682).\n - libnvdimm/label: Clear 'updating' flag after label-set update\n (bsc#1129543).\n - libnvdimm/pmem: Honor force_raw for legacy pmem regions (bsc#1129551).\n - lightnvm: fail fast on passthrough commands (bsc#1125780).\n - livepatch: Change unsigned long old_addr -> void *old_func in struct\n klp_func (bsc#1071995).\n - livepatch: Consolidate klp_free functions (bsc#1071995 ).\n - livepatch: core: Return EOPNOTSUPP instead of ENOSYS (bsc#1071995).\n - livepatch: Define a macro for new API identification (bsc#1071995).\n - livepatch: Do not block the removal of patches loaded after a forced\n transition (bsc#1071995).\n - livepatch: Introduce klp_for_each_patch macro (bsc#1071995 ).\n - livepatch: Module coming and going callbacks can proceed with all listed\n patches (bsc#1071995).\n - livepatch: Proper error handling in the shadow variables selftest\n (bsc#1071995).\n - livepatch: Remove ordering (stacking) of the livepatches (bsc#1071995).\n - livepatch: Remove signal sysfs attribute (bsc#1071995 ).\n - livepatch: return -ENOMEM on ptr_id() allocation failure (bsc#1071995).\n - livepatch: Send a fake signal periodically (bsc#1071995 ).\n - livepatch: Shuffle klp_enable_patch()/klp_disable_patch() code\n (bsc#1071995).\n - livepatch: Simplify API by removing registration step (bsc#1071995).\n - llc: do not use sk_eat_skb() (bsc#1051510).\n - locking/rwsem: Fix (possible) missed wakeup (bsc#1050549).\n - loop: drop caches if offset or block_size are changed (bsc#1124975).\n - loop: Reintroduce lo_ctl_mutex removed by commit 310ca162d (bsc#1124974).\n - mac80211: Add attribute aligned(2) to struct 'action' (bsc#1051510).\n - mac80211: do not initiate TDLS connection if station is not associated\n to AP (bsc#1051510).\n - mac80211: ensure that mgmt tx skbs have tailroom for encryption\n (bsc#1051510).\n - mac80211: fix miscounting of ttl-dropped frames (bsc#1051510).\n - mac80211: fix radiotap vendor presence bitmap handling (bsc#1051510).\n - mac80211: Fix Tx aggregation session tear down with ITXQs (bsc#1051510).\n - mac80211: Free mpath object when rhashtable insertion fails\n (bsc#1051510).\n - mac80211_hwsim: propagate genlmsg_reply return code (bsc#1051510).\n - mac80211: Restore vif beacon interval if start ap fails (bsc#1051510).\n - macvlan: Only deliver one copy of the frame to the macvlan interface\n (bsc#1051510).\n - mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue\n (bsc#1051510).\n - mdio_bus: Fix use-after-free on device_register fails (bsc#1051510).\n - media: adv*/tc358743/ths8200: fill in min width/height/pixelclock\n (bsc#1051510).\n - media: DaVinci-VPBE: fix error handling in vpbe_initialize()\n (bsc#1051510).\n - media: dt-bindings: media: i2c: Fix i2c address for OV5645 camera sensor\n (bsc#1051510).\n - media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm()\n (bsc#1051510).\n - media: rc: mce_kbd decoder: fix stuck keys (bsc#1100132).\n - media: s5k4ecgx: delete a bogus error message (bsc#1051510).\n - media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration\n (bsc#1051510).\n - media: s5p-jpeg: Correct step and max values for\n V4L2_CID_JPEG_RESTART_INTERVAL (bsc#1051510).\n - media: s5p-mfc: fix incorrect bus assignment in virtual child device\n (bsc#1051510).\n - media: uvcvideo: Avoid NULL pointer dereference at the end of streaming\n (bsc#1051510).\n - media: uvcvideo: Fix 'type' check leading to overflow (bsc#1051510).\n - media: v4l2-ctrls.c/uvc: zero v4l2_event (bsc#1051510).\n - media: v4l2: i2c: ov7670: Fix PLL bypass register values (bsc#1051510).\n - media: vb2: do not call __vb2_queue_cancel if vb2_start_streaming failed\n (bsc#1119086).\n - memremap: fix softlockup reports at teardown (bnc#1130154).\n - memstick: Prevent memstick host from getting runtime suspended during\n card detection (bsc#1051510).\n - mfd: db8500-prcmu: Fix some section annotations (bsc#1051510).\n - mfd: mc13xxx: Fix a missing check of a register-read failure\n (bsc#1051510).\n - mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported\n (bsc#1051510).\n - mfd: qcom_rpm: write fw_version to CTRL_REG (bsc#1051510).\n - mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd\n cells (bsc#1051510).\n - mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path in\n probe() (bsc#1051510).\n - mfd: twl-core: Fix section annotations on {,un}protect_pm_master\n (bsc#1051510).\n - mfd: wm5110: Add missing ASRC rate register (bsc#1051510).\n - misc: hpilo: Do not claim unsupported hardware (bsc#1129330).\n - misc: hpilo: Exclude unsupported device via blacklist (bsc#1129330).\n - mISDN: fix a race in dev_expire_timer() (bsc#1051510).\n - mlxsw: __mlxsw_sp_port_headroom_set(): Fix a use of local variable\n (git-fixes).\n - mlxsw: spectrum: Disable lag port TX before removing it\n (networking-stable-19_01_22).\n - mmap: introduce sane default mmap limits (git fixes (mm/mmap)).\n - mmap: relax file size limit for regular files (git fixes (mm/mmap)).\n - mmc: bcm2835: Recover from MMC_SEND_EXT_CSD (bsc#1051510).\n - mmc: Kconfig: Enable CONFIG_MMC_SDHCI_IO_ACCESSORS (bsc#1051510).\n - mmc: omap: fix the maximum timeout setting (bsc#1051510).\n - mmc: pxamci: fix enum type confusion (bsc#1051510).\n - mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe\n (bsc#1051510).\n - mmc: sdhci-esdhc-imx: fix HS400 timing issue (bsc#1051510).\n - mmc: sdhci-of-esdhc: Fix timeout checks (bsc#1051510).\n - mmc: sdhci-xenon: Fix timeout checks (bsc#1051510).\n - mmc: spi: Fix card detection during probe (bsc#1051510).\n - mm: do not drop unused pages when userfaultd is running (git fixes\n (mm/userfaultfd)).\n - mm: Fix modifying of page protection by insert_pfn() (bsc#1126740).\n - mm: Fix warning in insert_pfn() (bsc#1126740).\n - mm/hmm: hmm_pfns_bad() was accessing wrong struct (git fixes (mm/hmm)).\n - mm: hwpoison: use do_send_sig_info() instead of force_sig() (git fixes\n (mm/hwpoison)).\n - mm/ksm.c: ignore STABLE_FLAG of rmap_item->address in rmap_walk_ksm()\n (git fixes (mm/ksm)).\n - mm: madvise(MADV_DODUMP): allow hugetlbfs pages (git fixes (mm/madvise)).\n - mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages\n (bsc#1127731).\n - mm: migrate: do not rely on __PageMovable() of newpage after unlocking\n it (git fixes (mm/migrate)).\n - mm, oom: fix use-after-free in oom_kill_process (git fixes (mm/oom)).\n - mm: use swp_offset as key in shmem_replace_page() (git fixes (mm/shmem)).\n - mm,vmscan: Make unregister_shrinker() no-op if register_shrinker()\n failed (git fixes (mm/vmscan)).\n - Move upstreamed ALSA and BT patches into sorted section\n - Move upstreamed libnvdimm patch into sorted section\n - mtd: cfi_cmdset_0002: Avoid walking all chips when unlocking\n (bsc#1051510).\n - mtd: cfi_cmdset_0002: Change write buffer to check correct value\n (bsc#1051510).\n - mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips (bsc#1051510).\n - mtd: cfi_cmdset_0002: Fix unlocking requests crossing a chip boudary\n (bsc#1051510).\n - mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock() (bsc#1051510).\n - mtdchar: fix overflows in adjustment of `count` (bsc#1051510).\n - mtdchar: fix usage of mtd_ooblayout_ecc() (bsc#1051510).\n - mtd: docg3: do not set conflicting BCH_CONST_PARAMS option (bsc#1051510).\n - mtd/maps: fix solutionengine.c printk format warnings (bsc#1051510).\n - mtd: mtd_oobtest: Handle bitflips during reads (bsc#1051510).\n - mtd: nand: atmel: fix buffer overflow in atmel_pmecc_user (bsc#1051510).\n - mtd: nand: atmel: Fix get_sectorsize() function (bsc#1051510).\n - mtd: nand: atmel: fix of_irq_get() error check (bsc#1051510).\n - mtd: nand: brcmnand: Disable prefetch by default (bsc#1051510).\n - mtd: nand: brcmnand: Zero bitflip is not an error (bsc#1051510).\n - mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE\n (bsc#1051510).\n - mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()\n (bsc#1051510).\n - mtd: nand: Fix nand_do_read_oob() return value (bsc#1051510).\n - mtd: nand: Fix writing mtdoops to nand flash (bsc#1051510).\n - mtd: nand: fsl_ifc: Fix nand waitfunc return value (bsc#1051510).\n - mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM\n (bsc#1051510).\n - mtd: nand: ifc: update bufnum mask for ver >= 2.0.0 (bsc#1051510).\n - mtd: nand: mtk: fix infinite ECC decode IRQ issue (bsc#1051510).\n - mtd: nand: omap2: Fix subpage write (bsc#1051510).\n - mtd: nand: pxa3xx: Fix READOOB implementation (bsc#1051510).\n - mtd: nand: qcom: Add a NULL check for devm_kasprintf() (bsc#1051510).\n - mtd: nandsim: remove debugfs entries in error path (bsc#1051510).\n - mtd: nand: sunxi: Fix ECC strength choice (bsc#1051510).\n - mtd: nand: sunxi: fix potential divide-by-zero error (bsc#1051510).\n - mtd: nand: vf610: set correct ooblayout (bsc#1051510).\n - mtd: spi-nor: cadence-quadspi: Fix page fault kernel panic (bsc#1051510).\n - mtd: spi-nor: Fix Cadence QSPI page fault kernel panic (bsc#1051510).\n - mtd: spi-nor: fsl-quadspi: fix read error for flash size larger than\n 16MB (bsc#1051510).\n - mtd: spi-nor: stm32-quadspi: Fix uninitialized error return code\n (bsc#1051510).\n - mv88e6060: disable hardware level MAC learning (bsc#1051510).\n - nbd: Use set_blocksize() to set device blocksize (bsc#1124984).\n - net: add uevent socket member (bsc#1122982).\n - net: aquantia: driver should correctly declare vlan_features bits\n (bsc#1051510).\n - net: aquantia: fixed instack structure overflow (git-fixes).\n - net: aquantia: Fix hardware DMA stream overload on large MRRS\n (bsc#1051510).\n - net: bcmgenet: abort suspend on error (bsc#1051510).\n - net: bcmgenet: code movement (bsc#1051510).\n - net: bcmgenet: fix OF child-node lookup (bsc#1051510).\n - net: bcmgenet: remove HFB_CTRL access (bsc#1051510).\n - net: bcmgenet: return correct value 'ret' from bcmgenet_power_down\n (bsc#1051510).\n - net: bridge: fix a bug on using a neighbour cache entry without checking\n its state (networking-stable-19_01_20).\n - net: bridge: Fix ethernet header pointer before check skb forwardable\n (networking-stable-19_01_26).\n - net: do not call update_pmtu unconditionally (bsc#1123456).\n - net: Do not default Cavium PTP driver to 'y' (bsc#1110096).\n - net: dp83640: expire old TX-skb (networking-stable-19_02_10).\n - net: dsa: mv88e6xxx: handle unknown duplex modes gracefully in\n mv88e6xxx_port_set_duplex (git-fixes).\n - net: dsa: mv88x6xxx: mv88e6390 errata (networking-stable-19_01_22).\n - net: dsa: slave: Do not propagate flag changes on down slave interfaces\n (networking-stable-19_02_10).\n - net: ena: fix race between link up and device initalization\n (bsc#1083548).\n - net: ena: update driver version from 2.0.2 to 2.0.3 (bsc#1129276\n bsc#1125342).\n - netfilter: check for seqadj ext existence before adding it in\n nf_nat_setup_info (git-fixes).\n - netfilter: nf_tables: check the result of dereferencing\n base_chain->stats (git-fixes).\n - net: Fix usage of pskb_trim_rcsum (networking-stable-19_01_26).\n - net: ipv4: Fix memory leak in network namespace dismantle\n (networking-stable-19_01_26).\n - net/mlx4_core: Add masking for a few queries on HCA caps\n (networking-stable-19_02_01).\n - net/mlx4_core: Fix locking in SRIOV mode when switching between events\n and polling (git-fixes).\n - net/mlx4_core: Fix qp mtt size calculation (git-fixes).\n - net/mlx4_core: Fix reset flow when in command polling mode (git-fixes).\n - net/mlx5e: Allow MAC invalidation while spoofchk is ON\n (networking-stable-19_02_01).\n - net/mlx5e: IPoIB, Fix RX checksum statistics update (git-fixes).\n - net/mlx5e: RX, Fix wrong early return in receive queue poll\n (bsc#1046305).\n - net/mlx5: fix uaccess beyond \"count\" in debugfs read/write handlers\n (git-fixes).\n - net/mlx5: Release resource on error flow (git-fixes).\n - net/mlx5: Return success for PAGE_FAULT_RESUME in internal error state\n (git-fixes).\n - net/mlx5: Use multi threaded workqueue for page fault handling\n (git-fixes).\n - net/ncsi: Fix AEN HNCDSC packet length (git-fixes).\n - net/ncsi: Stop monitor if channel times out or is inactive (git-fixes).\n - net: netem: fix skb length BUG_ON in __skb_to_sgvec (git-fixes).\n - netns: restrict uevents (bsc#1122982).\n - net: phy: marvell: Errata for mv88e6390 internal PHYs\n (networking-stable-19_01_26).\n - net: phy: mdio_bus: add missing device_del() in mdiobus_register() error\n handling (networking-stable-19_01_26).\n - net: phy: Micrel KSZ8061: link failure after cable connect (git-fixes).\n - netrom: switch to sock timer API (bsc#1051510).\n - net/rose: fix NULL ax25_cb kernel panic (networking-stable-19_02_01).\n - net/sched: act_tunnel_key: fix memory leak in case of action replace\n (networking-stable-19_01_26).\n - net_sched: refetch skb protocol for each filter\n (networking-stable-19_01_26).\n - net: set default network namespace in init_dummy_netdev()\n (networking-stable-19_02_01).\n - net: stmmac: Fix a race in EEE enable callback (git-fixes).\n - net: stmmac: fix broken dma_interrupt handling for multi-queues\n (git-fixes).\n - net: stmmac: handle endianness in dwmac4_get_timestamp (git-fixes).\n - net: stmmac: Use mutex instead of spinlock (git-fixes).\n - net-sysfs: Fix mem leak in netdev_register_kobject (git-fixes).\n - net: systemport: Fix WoL with password after deep sleep\n (networking-stable-19_02_10).\n - net: thunderx: fix NULL pointer dereference in nic_remove (git-fixes).\n - nfit: acpi_nfit_ctl(): Check out_obj->type in the right place\n (bsc#1129547).\n - nfit/ars: Attempt a short-ARS whenever the ARS state is idle at boot\n (bsc#1051510).\n - nfit/ars: Attempt short-ARS even in the no_init_ars case (bsc#1051510).\n - nfp: bpf: fix ALU32 high bits clearance bug (git-fixes).\n - nfsd: fix memory corruption caused by readdir (bsc#1127445).\n - niu: fix missing checks of niu_pci_eeprom_read (bsc#1051510).\n - ntb_transport: Fix bug with max_mw_size parameter (bsc#1051510).\n - nvme-fc: reject reconnect if io queue count is reduced to zero\n (bsc#1128351).\n - nvme: flush namespace scanning work just before removing namespaces\n (bsc#1108101).\n - nvme: kABI fix for scan_lock (bsc#1123882).\n - nvme: lock NS list changes while handling command effects (bsc#1123882).\n - nvme-loop: fix kernel oops in case of unhandled command (bsc#1126807).\n - nvme-multipath: drop optimization for static ANA group IDs (bsc#1113939).\n - nvme-pci: fix out of bounds access in nvme_cqe_pending (bsc#1127595).\n - nvme: schedule requeue whenever a LIVE state is entered (bsc#1123105).\n - of, numa: Validate some distance map rules (bsc#1051510).\n - of: unittest: Disable interrupt node tests for old world MAC systems\n (bsc#1051510).\n - openvswitch: Avoid OOB read when parsing flow nlattrs (bsc#1051510).\n - openvswitch: fix the incorrect flow action alloc size (bsc#1051510).\n - openvswitch: Remove padding from packet before L3+ conntrack processing\n (bsc#1051510).\n - parport_pc: fix find_superio io compare code, should use equal test\n (bsc#1051510).\n - Partially revert \"block: fail op_is_write() requests to (bsc#1125252).\n - pci: add USR vendor id and use it in r8169 and w6692 driver\n (networking-stable-19_01_22).\n - pci: designware-ep: dw_pcie_ep_set_msi() should only set MMC bits\n (bsc#1051510).\n - pci: endpoint: functions: Use memcpy_fromio()/memcpy_toio()\n (bsc#1051510).\n - pci-hyperv: increase HV_VP_SET_BANK_COUNT_MAX to handle 1792 vcpus\n (bsc#1122822).\n - pci/pme: Fix hotplug/sysfs remove deadlock in pcie_pme_remove()\n (bsc#1051510).\n - pci: qcom: Do not deassert reset GPIO during probe (bsc#1129281).\n - pcrypt: use format specifier in kobject_add (bsc#1051510).\n - perf/x86: Add sysfs entry to freeze counters on SMI (bsc#1121805).\n - perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu()\n (bsc#1121805).\n - perf/x86/intel: Do not enable freeze-on-smi for PerfMon V1 (bsc#1121805).\n - perf/x86/intel: Fix memory corruption (bsc#1121805).\n - perf/x86/intel: Generalize dynamic constraint creation (bsc#1121805).\n - perf/x86/intel: Implement support for TSX Force Abort (bsc#1121805).\n - perf/x86/intel: Make cpuc allocations consistent (bsc#1121805).\n - phy: allwinner: sun4i-usb: poll vbus changes on A23/A33 when driving\n VBUS (bsc#1051510).\n - phy: qcom-qmp: Fix failure path in phy_init functions (bsc#1051510).\n - phy: qcom-qmp: Fix phy pipe clock gating (bsc#1051510).\n - phy: renesas: rcar-gen3-usb2: fix vbus_ctrl for role sysfs (bsc#1051510).\n - phy: rockchip-emmc: retry calpad busy trimming (bsc#1051510).\n - phy: sun4i-usb: add support for missing USB PHY index (bsc#1051510).\n - phy: tegra: remove redundant self assignment of 'map' (bsc#1051510).\n - phy: work around 'phys' references to usb-nop-xceiv devices\n (bsc#1051510).\n - pinctrl: max77620: Use define directive for max77620_pinconf_param\n values (bsc#1051510).\n - pinctrl: meson: fix pull enable register calculation (bsc#1051510).\n - pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins\n (bsc#1051510).\n - pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins (bsc#1051510).\n - pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins\n (bsc#1051510).\n - pinctrl: msm: fix gpio-hog related boot issues (bsc#1051510).\n - pinctrl: sh-pfc: emev2: Add missing pinmux functions (bsc#1051510).\n - pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group\n (bsc#1051510).\n - pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group\n (bsc#1051510).\n - pinctrl: sh-pfc: r8a7778: Fix HSPI pin numbers and names (bsc#1051510).\n - pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group (bsc#1051510).\n - pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b\n group (bsc#1051510).\n - pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group\n (bsc#1051510).\n - pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group (bsc#1051510).\n - pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field (bsc#1051510).\n - pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration\n (bsc#1051510).\n - pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field (bsc#1051510).\n - pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group\n (bsc#1051510).\n - pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups (bsc#1051510).\n - pinctrl: sh-pfc: sh7734: Add missing IPSR11 field (bsc#1051510).\n - pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10 (bsc#1051510).\n - pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value (bsc#1051510).\n - pinctrl: sunxi: a64: Rename function csi0 to csi (bsc#1051510).\n - pinctrl: sunxi: a64: Rename function ts0 to ts (bsc#1051510).\n - pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11 (bsc#1051510).\n - pinctrl: sx150x: handle failure case of devm_kstrdup (bsc#1051510).\n - pktcdvd: Fix possible Spectre-v1 for pkt_devs (bsc#1051510).\n - platform/x86: Fix unmet dependency warning for SAMSUNG_Q10 (bsc#1051510).\n - pm / wakeup: Rework wakeup source timer cancellation (bsc#1051510).\n - powercap: intel_rapl: add support for Jacobsville ().\n - powerpc/64s: Clear on-stack exception marker upon exception return\n (bsc#1071995).\n - powerpc/livepatch: relax reliable stack tracer checks for first-frame\n (bsc#1071995).\n - powerpc/livepatch: small cleanups in save_stack_trace_tsk_reliable()\n (bsc#1071995).\n - powerpc/pseries: export timebase register sample in lparcfg\n (bsc#1127750).\n - powerpc/pseries/mce: Fix misleading print for TLB mutlihit (bsc#1094244,\n git-fixes).\n - powerpc/pseries: Perform full re-add of CPU for topology update\n post-migration (bsc#1125728).\n - power: supply: charger-manager: Fix incorrect return value (bsc#1051510).\n - pptp: dst_release sk_dst_cache in pptp_sock_destruct (git-fixes).\n - proc/sysctl: do not return ENOMEM on lookup when a table is\n unregistering (git-fixes).\n - pseries/energy: Use OF accessor function to read ibm,drc-indexes\n (bsc#1129080).\n - ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl (bsc#1051510).\n - ptp: Fix pass zero to ERR_PTR() in ptp_clock_register (bsc#1051510).\n - pwm-backlight: Enable/disable the PWM before/after LCD enable toggle\n (bsc#1051510).\n - qmi_wwan: add MTU default to qmap network interface\n (networking-stable-19_01_22).\n - qmi_wwan: apply SET_DTR quirk to Sierra WP7607 (bsc#1051510).\n - qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup (bsc#1051510).\n - r8169: Add support for new Realtek Ethernet (networking-stable-19_01_22).\n - r8169: use PCI_VDEVICE macro (networking-stable-19_01_22).\n - rbd: do not return 0 on unmap if RBD_DEV_FLAG_REMOVING is set\n (bsc#1125797).\n - rcu: Fix up pending cbs check in rcu_prepare_for_idle (git fixes\n (kernel/rcu)).\n - rcu: Make need_resched() respond to urgent RCU-QS needs (git fixes\n (kernel/rcu)).\n - rdma/vmw_pvrdma: Support upto 64-bit PFNs (bsc#1127285).\n - Refresh\n patches.suse/scsi-do-not-print-reservation-conflict-for-TEST-UNIT.patch\n (bsc#1119843)\n - regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting\n (bsc#1051510).\n - regulator: max77620: Initialize values for DT properties (bsc#1051510).\n - regulator: pv88060: Fix array out-of-bounds access (bsc#1051510).\n - regulator: pv88080: Fix array out-of-bounds access (bsc#1051510).\n - regulator: pv88090: Fix array out-of-bounds access (bsc#1051510).\n - regulator: s2mpa01: Fix step values for some LDOs (bsc#1051510).\n - regulator: s2mps11: Fix steps for buck7, buck8 and LDO35 (bsc#1051510).\n - regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA\n (bsc#1051510).\n - Remove blacklist of virtio patch so we can install it (bsc#1114585)\n - Remove patches rejected upstream ().\n - Revert drm/i915 patches that caused regressions (bsc#1131062)\n - Revert \"drm/rockchip: Allow driver to be shutdown on reboot/kexec\"\n (bsc#1051510).\n - Revert \"Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire\n F5-573G\" (bsc#1051510).\n - Revert \"ipv4: keep skb->dst around in presence of IP options\"\n (git-fixes).\n - Revert \"openvswitch: Fix template leak in error cases.\" (bsc#1051510).\n - Revert \"scsi: qla2xxx: Fix NVMe Target discovery\" (bsc#1125252).\n - Revert \"sd: disable logical block provisioning if 'lbpme' is not set\"\n This reverts commit e365f138cb9c9c48b710864a9f37a91b4b93381d. Patch not\n accepted upstream.\n - Revert the previous merge of drm fixes The branch was merged mistakenly\n and breaks the build. Revert it.\n - Revert \"xhci: Reset Renesas uPD72020x USB controller for 32-bit DMA\n issue\" (bsc#1120854).\n - rhashtable: Still do rehash when we get EEXIST (bsc#1051510).\n - rocker: fix rocker_tlv_put_* functions for KASAN (bsc#1051510).\n - rpm/kernel-source.changes.old: Really drop old changelogs (bsc#1098995)\n - rt2800: enable TX_PIN_CFG_RFRX_EN only for MT7620 (bsc#1120902).\n - rtc: 88pm80x: fix unintended sign extension (bsc#1051510).\n - rtc: 88pm860x: fix unintended sign extension (bsc#1051510).\n - rtc: cmos: ignore bogus century byte (bsc#1051510).\n - rtc: ds1672: fix unintended sign extension (bsc#1051510).\n - rtc: Fix overflow when converting time64_t to rtc_time (bsc#1051510).\n - rtc: pm8xxx: fix unintended sign extension (bsc#1051510).\n - rtnetlink: bring NETDEV_CHANGE_TX_QUEUE_LEN event process back in\n rtnetlink_event (git-fixes).\n - rtnetlink: bring NETDEV_CHANGEUPPER event process back in\n rtnetlink_event (git-fixes).\n - rtnetlink: bring NETDEV_POST_TYPE_CHANGE event process back in\n rtnetlink_event (git-fixes).\n - rtnetlink: check DO_SETLINK_NOTIFY correctly in do_setlink (git-fixes).\n - rxrpc: bad unlock balance in rxrpc_recvmsg (networking-stable-19_02_10).\n - s390/cio: Fix how vfio-ccw checks pinned pages (git-fixes).\n - s390/cpum_cf: Reject request for sampling in event initialization\n (git-fixes).\n - s390/early: improve machine detection (git-fixes).\n - s390/mm: always force a load of the primary ASCE on context switch\n (git-fixes).\n - s390/mm: fix addressing exception after suspend/resume (bsc#1125252).\n - s390/qeth: cancel close_dev work before removing a card (LTC#175898,\n bsc#1127561).\n - s390/qeth: conclude all event processing before offlining a card\n (LTC#175901, bsc#1127567).\n - s390/qeth: fix use-after-free in error path (bsc#1127534).\n - s390/qeth: invoke softirqs after napi_schedule() (git-fixes).\n - s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU (git-fixes).\n - s390/smp: fix CPU hotplug deadlock with CPU rescan (git-fixes).\n - s390/sthyi: Fix machine name validity indication (git-fixes).\n - sata_rcar: fix deferred probing (bsc#1051510).\n - sc16is7xx: Fix for multi-channel stall (bsc#1051510).\n - sched: Do not re-read h_load_next during hierarchical load calculation\n (bnc#1120909).\n - sched/wake_q: Document wake_q_add() (bsc#1050549).\n - sched/wake_q: Fix wakeup ordering for wake_q (bsc#1050549).\n - sched/wake_q: Reduce reference counting for special users (bsc#1050549).\n - sch_multiq: fix double free on init failure (bsc#1051510).\n - scripts/git_sort/git_sort.py: add vfs \"fixes\" branch\n - scsi: core: reset host byte in DID_NEXUS_FAILURE case (bsc#1122764).\n - scsi: csiostor: remove flush_scheduled_work() (bsc#1127363).\n - scsi: fix queue cleanup race before queue initialization is done\n (bsc#1125252).\n - scsi: ibmvscsi: Fix empty event pool access during host removal\n (bsc#1119019).\n - scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton\n (bsc#1119019).\n - scsi: libiscsi: fix possible NULL pointer dereference in case of TMF\n (bsc#1127378).\n - scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task\n (bsc#1122192).\n - scsi: lpfc: Add log messages to aid in debugging fc4type discovery\n issues (bsc#1121317).\n - scsi: lpfc: Correct MDS loopback diagnostics support (bsc#1121317).\n - scsi: lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt\n is invalid (bsc#1121317).\n - scsi: lpfc: Fix discovery failure when PLOGI is defered (bsc#1121317).\n - scsi: lpfc: Fix link state reporting for trunking when adapter is\n offline (bsc#1121317).\n - scsi: lpfc: fix remoteport access (bsc#1125252).\n - scsi: lpfc: remove an unnecessary NULL check (bsc#1121317).\n - scsi: lpfc: update fault value on successful trunk events (bsc#1121317).\n - scsi: lpfc: Update lpfc version to 12.0.0.10 (bsc#1121317).\n - scsi: mpt3sas: Add ioc_<level> logging macros (bsc#1117108).\n - scsi: mpt3sas: Annotate switch/case fall-through (bsc#1117108).\n - scsi: mpt3sas: Convert logging uses with MPT3SAS_FMT and reply_q_name to\n %s: (bsc#1117108).\n - scsi: mpt3sas: Convert logging uses with MPT3SAS_FMT without logging\n levels (bsc#1117108).\n - scsi: mpt3sas: Convert mlsleading uses of pr_<level> with MPT3SAS_FMT\n (bsc#1117108).\n - scsi: mpt3sas: Convert uses of pr_<level> with MPT3SAS_FMT to\n ioc_<level> (bsc#1117108).\n - scsi: mpt3sas: Fix a race condition in mpt3sas_base_hard_reset_handler()\n (bsc#1117108).\n - scsi: mpt3sas: Fix indentation (bsc#1117108).\n - scsi: mpt3sas: Improve kernel-doc headers (bsc#1117108).\n - scsi: mpt3sas: Introduce struct mpt3sas_nvme_cmd (bsc#1117108).\n - scsi: mpt3sas: Remove KERN_WARNING from panic uses (bsc#1117108).\n - scsi: mpt3sas: Remove set-but-not-used variables (bsc#1117108).\n - scsi: mpt3sas: Remove unnecessary parentheses and simplify null checks\n (bsc#1117108).\n - scsi: mpt3sas: Remove unused macro MPT3SAS_FMT (bsc#1117108).\n - scsi: mpt3sas: Split _base_reset_handler(),\n mpt3sas_scsih_reset_handler() and mpt3sas_ctl_reset_handler()\n (bsc#1117108).\n - scsi: mpt3sas: Swap I/O memory read value back to cpu endianness\n (bsc#1117108).\n - scsi: mpt3sas: switch to generic DMA API (bsc#1117108).\n - scsi: mpt3sas: Use dma_pool_zalloc (bsc#1117108).\n - scsi: mptsas: Fixup device hotplug for VMWare ESXi (bsc#1129046).\n - scsi: qla2xxx: Enable FC-NVME on NPIV ports (bsc#1094555).\n - scsi: qla2xxx: Fix a typo in MODULE_PARM_DESC (bsc#1094555).\n - scsi: qla2xxx: Fix for FC-NVMe discovery for NPIV port (bsc#1094555).\n - scsi: qla2xxx: Fix NPIV handling for FC-NVMe (bsc#1094555).\n - scsi: qla2xxx: Initialize port speed to avoid setting lower speed\n (bsc#1094555).\n - scsi: qla2xxx: Modify fall-through annotations (bsc#1094555).\n - scsi: qla2xxx: Remove unnecessary self assignment (bsc#1094555).\n - scsi: qla2xxx: Simplify conditional check (bsc#1094555).\n - scsi: qla2xxx: Update driver version to 10.00.00.12-k (bsc#1094555).\n - scsi: storvsc: Fix a race in sub-channel creation that can cause panic\n ().\n - scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir()\n (bsc#1125315).\n - scsi: virtio_scsi: fix pi_bytes{out,in} on 4 KiB block size devices\n (bsc#1114585).\n - sctp: add a ceiling to optlen in some sockopts (bnc#1129163).\n - sctp: improve the events for sctp stream adding\n (networking-stable-19_02_01).\n - sctp: improve the events for sctp stream reset\n (networking-stable-19_02_01).\n - sd: disable logical block provisioning if 'lbpme' is not set\n (bsc#1086095 bsc#1078355).\n - selftests/livepatch: add DYNAMIC_DEBUG config dependency (bsc#1071995).\n - selftests/livepatch: introduce tests (bsc#1071995).\n - selinux: always allow mounting submounts (bsc#1051510).\n - seq_buf: Make seq_buf_puts() null-terminate the buffer (bsc#1051510).\n - serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart (bsc#1051510).\n - serial: 8250_pci: Fix number of ports for ACCES serial cards\n (bsc#1051510).\n - serial: 8250_pci: Have ACCES cards that use the four port Pericom\n PI7C9X7954 chip use the pci_pericom_setup() (bsc#1051510).\n - serial: fix race between flush_to_ldisc and tty_open (bsc#1051510).\n - serial: fsl_lpuart: clear parity enable bit when disable parity\n (bsc#1051510).\n - serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling\n (bsc#1051510).\n - serial: imx: Update cached mctrl value when changing RTS (bsc#1051510).\n - serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO\n (bsc#1051510).\n - skge: potential memory corruption in skge_get_regs() (bsc#1051510).\n - sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79 (bsc#1051510).\n - sky2: Increase D3 delay again (bsc#1051510).\n - smb311: Improve checking of negotiate security contexts (bsc#1051510).\n - smb3: Enable encryption for SMB3.1.1 (bsc#1051510).\n - smb3: Fix 3.11 encryption to Windows and handle encrypted smb3 tcon\n (bsc#1051510).\n - smb3: Fix SMB3.1.1 guest mounts to Samba (bsc#1051510).\n - smb3: remove noisy warning message on mount (bsc#1129664).\n - soc: bcm: brcmstb: Do not leak device tree node reference (bsc#1051510).\n - soc: fsl: qbman: avoid race in clearing QMan interrupt (bsc#1051510).\n - soc/tegra: Do not leak device tree node reference (bsc#1051510).\n - spi: pxa2xx: Setup maximum supported DMA transfer length (bsc#1051510).\n - spi: ti-qspi: Fix mmap read when more than one CS in use (bsc#1051510).\n - spi/topcliff_pch: Fix potential NULL dereference on allocation error\n (bsc#1051510).\n - splice: do not merge into linked buffers (git-fixes).\n - staging: comedi: ni_660x: fix missing break in switch statement\n (bsc#1051510).\n - staging:iio:ad2s90: Make probe handle spi_setup failure (bsc#1051510).\n - staging: iio: ad7780: update voltage on read (bsc#1051510).\n - staging: iio: adc: ad7280a: handle error from __ad7280_read32()\n (bsc#1051510).\n - staging: iio: adt7316: allow adt751x to use internal vref for all dacs\n (bsc#1051510).\n - staging: iio: adt7316: fix register and bit definitions (bsc#1051510).\n - staging: iio: adt7316: fix the dac read calculation (bsc#1051510).\n - staging: iio: adt7316: fix the dac write calculation (bsc#1051510).\n - staging: rtl8723bs: Fix build error with Clang when inlining is disabled\n (bsc#1051510).\n - staging: speakup: Replace strncpy with memcpy (bsc#1051510).\n - staging: wilc1000: fix to set correct value for 'vif_num' (bsc#1051510).\n - supported.conf\n - svm: Add mutex_lock to protect apic_access_page_done on AMD systems\n (bsc#1129285).\n - svm: Fix improper check when deactivate AVIC (bsc#1130335).\n - swiotlb: Add is_swiotlb_active() function (bsc#1120008).\n - swiotlb: Introduce swiotlb_max_mapping_size() (bsc#1120008).\n - switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite\n (bsc#1051510).\n - switchtec: Remove immediate status check after submitting MRPC command\n (bsc#1051510).\n - sysfs: Disable lockdep for driver bind/unbind files (bsc#1051510).\n - tcp: batch tcp_net_metrics_exit (bsc#1122982).\n - tcp: change txhash on SYN-data timeout (networking-stable-19_01_20).\n - tcp: handle inet_csk_reqsk_queue_add() failures (git-fixes).\n - team: avoid complex list operations in team_nl_cmd_options_set()\n (bsc#1051510).\n - team: Free BPF filter when unregistering netdev (bsc#1051510).\n - thermal: bcm2835: Fix crash in bcm2835_thermal_debugfs (bsc#1051510).\n - thermal: do not clear passive state during system sleep (bsc#1051510).\n - thermal/drivers/hisi: Encapsulate register writes into helpers\n (bsc#1051510).\n - thermal/drivers/hisi: Fix configuration register setting (bsc#1051510).\n - thermal: generic-adc: Fix adc to temp interpolation (bsc#1051510).\n - thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set\n (bsc#1051510).\n - thermal/intel_powerclamp: fix truncated kthread name ().\n - thermal: mediatek: fix register index error (bsc#1051510).\n - timekeeping: Use proper seqcount initializer (bsc#1051510).\n - tipc: eliminate KMSAN uninit-value in strcmp complaint (bsc#1051510).\n - tipc: error path leak fixes in tipc_enable_bearer() (bsc#1051510).\n - tipc: fix a race condition of releasing subscriber object (bsc#1051510).\n - tipc: fix bug in function tipc_nl_node_dump_monitor (bsc#1051510).\n - tipc: fix infinite loop when dumping link monitor summary (bsc#1051510).\n - tipc: fix RDM/DGRAM connect() regression (bsc#1051510).\n - tipc: fix uninit-value in tipc_nl_compat_bearer_enable (bsc#1051510).\n - tipc: fix uninit-value in tipc_nl_compat_doit (bsc#1051510).\n - tipc: fix uninit-value in tipc_nl_compat_link_reset_stats (bsc#1051510).\n - tipc: fix uninit-value in tipc_nl_compat_link_set (bsc#1051510).\n - tipc: fix uninit-value in tipc_nl_compat_name_table_dump (bsc#1051510).\n - tpm: fix kdoc for tpm2_flush_context_cmd() (bsc#1051510).\n - tpm: Fix some name collisions with drivers/char/tpm.h (bsc#1051510).\n - tpm: return a TPM_RC_COMMAND_CODE response if command is not implemented\n (bsc#1051510).\n - tpm: Return the actual size when receiving an unsupported command\n (bsc#1051510).\n - tpm: suppress transmit cmd error logs when TPM 1.2 is\n disabled/deactivated (bsc#1051510).\n - tpm_tis_spi: Pass the SPI IRQ down to the driver (bsc#1051510).\n - tpm/tpm_crb: Avoid unaligned reads in crb_recv() (bsc#1051510).\n - tpm/tpm_i2c_infineon: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT)\n (bsc#1051510).\n - tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x\n (bsc#1051510).\n - tpm: tpm_try_transmit() refactor error flow (bsc#1051510).\n - tracing: Do not free iter->trace in fail path of tracing_open_pipe()\n (bsc#1129581).\n - tracing/uprobes: Fix output for multiple string arguments (bsc#1126495).\n - tracing: Use strncpy instead of memcpy for string keys in hist triggers\n (bsc#1129625).\n - Tree connect for SMB3.1.1 must be signed for non-encrypted shares\n (bsc#1051510).\n - tty: ipwireless: Fix potential NULL pointer dereference (bsc#1051510).\n - tty: serial: samsung: Properly set flags in autoCTS mode (bsc#1051510).\n - ucc_geth: Reset BQL queue when stopping device\n (networking-stable-19_02_01).\n - ucma: fix a use-after-free in ucma_resolve_ip() (bsc#1051510).\n - uevent: add alloc_uevent_skb() helper (bsc#1122982).\n - uio: Reduce return paths from uio_write() (bsc#1051510).\n - Update config files. Remove conditional support for SMB2 and SMB3:\n - Update patches.arch/s390-sles15-zcrypt-fix-specification-exception.patch\n (LTC#174936, bsc#1123060, bsc#1123061).\n - Update patches.fixes/acpi-nfit-Block-function-zero-DSMs.patch\n (bsc#1051510, bsc#1121789).\n - Update patches.fixes/acpi-nfit-Fix-command-supported-detection.patch\n (bsc#1051510, bsc#1121789). Add more detailed bugzilla reference.\n - uprobes: Fix handle_swbp() vs. unregister() + register() race once more\n (bsc#1051510).\n - usb: Add new USB LPM helpers (bsc#1120902).\n - usb: cdc-acm: fix race during wakeup blocking TX traffic (bsc#1129770).\n - usb: common: Consider only available nodes for dr_mode (bsc#1129770).\n - usb: Consolidate LPM checks to avoid enabling LPM twice (bsc#1120902).\n - usb: core: only clean up what we allocated (bsc#1051510).\n - usb: dwc3: Correct the logic for checking TRB full in\n __dwc3_prepare_one_trb() (bsc#1051510).\n - usb: dwc3: gadget: Disable CSP for stream OUT ep (bsc#1051510).\n - usb: dwc3: gadget: Fix the uninitialized link_state when udc starts\n (bsc#1051510).\n - usb: dwc3: gadget: Handle 0 xfer length for OUT EP (bsc#1051510).\n - usb: dwc3: gadget: synchronize_irq dwc irq in suspend (bsc#1051510).\n - usb: gadget: f_hid: fix deadlock in f_hidg_write() (bsc#1129770).\n - usb: gadget: musb: fix short isoc packets with inventra dma\n (bsc#1051510).\n - usb: gadget: Potential NULL dereference on allocation error\n (bsc#1051510).\n - usb: gadget: udc: net2272: Fix bitwise and boolean operations\n (bsc#1051510).\n - usb: hub: delay hub autosuspend if USB3 port is still link training\n (bsc#1051510).\n - usb: mtu3: fix the issue about SetFeature(U1/U2_Enable) (bsc#1051510).\n - usb: musb: dsps: fix otg state machine (bsc#1051510).\n - usb: musb: dsps: fix runtime pm for peripheral mode (bsc#1120902).\n - usbnet: smsc95xx: fix rx packet alignment (bsc#1051510).\n - usb: phy: am335x: fix race condition in _probe (bsc#1051510).\n - usb: phy: fix link errors (bsc#1051510).\n - usb: phy: twl6030-usb: fix possible use-after-free on remove\n (bsc#1051510).\n - usb: serial: cp210x: add ID for Ingenico 3070 (bsc#1129770).\n - usb: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485\n (bsc#1129770).\n - usb: serial: mos7720: fix mos_parport refcount imbalance on error path\n (bsc#1129770).\n - usb: serial: option: add Telit ME910 ECM composition (bsc#1129770).\n - usb: serial: option: set driver_info for SIM5218 and compatibles\n (bsc#1129770).\n - usb: serial: pl2303: add new PID to support PL2303TB (bsc#1051510).\n - usb: serial: simple: add Motorola Tetra TPG2200 device id (bsc#1051510).\n - veth: set peer GSO values (bsc#1051510).\n - vfio: ccw: fix cleanup if cp_prefetch fails (git-fixes).\n - vfio: ccw: process ssch with interrupts disabled (git-fixes).\n - vfs: Add iomap_seek_hole and iomap_seek_data helpers (bsc#1070995).\n - vfs: Add page_cache_seek_hole_data helper (bsc#1070995).\n - vfs: in iomap seek_{hole,data}, return -ENXIO for negative offsets\n (bsc#1070995).\n - vhost: correctly check the return value of translate_desc() in\n log_used() (bsc#1051510).\n - vhost: log dirty page correctly (networking-stable-19_01_26).\n - vhost/vsock: fix uninitialized vhost_vsock->guest_cid (bsc#1051510).\n - video: clps711x-fb: release disp device node in probe() (bsc#1051510).\n - virtio-blk: Consider virtio_max_dma_size() for maximum segment size\n (bsc#1120008).\n - virtio: Introduce virtio_max_dma_size() (bsc#1120008).\n - virtio_net: Do not call free_old_xmit_skbs for xdp_frames\n (networking-stable-19_02_01).\n - virtio/s390: avoid race on vcdev->config (git-fixes).\n - virtio/s390: fix race in ccw_io_helper() (git-fixes).\n - vmci: Support upto 64-bit PPNs (bsc#1127286).\n - vsock: cope with memory allocation failure at socket creation time\n (bsc#1051510).\n - vxge: ensure data0 is initialized in when fetching firmware version\n information (bsc#1051510).\n - vxlan: Fix GRO cells race condition between receive and link delete\n (git-fixes).\n - vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()\n (git-fixes).\n - vxlan: update skb dst pmtu on tx path (bsc#1123456).\n - w90p910_ether: remove incorrect __init annotation (bsc#1051510).\n - watchdog: docs: kernel-api: do not reference removed functions\n (bsc#1051510).\n - x86: Add TSX Force Abort CPUID/MSR (bsc#1121805).\n - x86/a.out: Clear the dump structure initially (bsc#1114279).\n - x86/apic: Provide apic_ack_irq() (bsc#1122822).\n - x86/boot/e820: Avoid overwriting e820_table_firmware (bsc#1127154).\n - x86/boot/e820: Introduce the bootloader provided e820_table_firmware[]\n table (bsc#1127154).\n - x86/boot/e820: Rename the e820_table_firmware to e820_table_kexec\n (bsc#1127154).\n - x86/cpu: Add Atom Tremont (Jacobsville) ().\n - x86/CPU/AMD: Set the CPB bit unconditionally on F17h (bsc#1114279).\n - x86/efi: Allocate e820 buffer before calling efi_exit_boot_service\n (bsc#1127307).\n - x86/Hyper-V: Set x2apic destination mode to physical when x2apic is\n available (bsc#1122822).\n - x86/kaslr: Fix incorrect i8254 outb() parameters (bsc#1114279).\n - x86/mce: Improve error message when kernel cannot recover, p2\n (bsc#1114279).\n - x86/mtrr: Do not copy uninitialized gentry fields back to userspace\n (bsc#1114279).\n - x86/pkeys: Properly copy pkey state at fork() (bsc#1129366).\n - x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls\n (bsc#1125614).\n - x86: respect memory size limiting via mem= parameter (bsc#1117645).\n - x86/vdso: Remove obsolete \"fake section table\" reservation (bsc#1114279).\n - x86/xen: dont add memory above max allowed allocation (bsc#1117645).\n - xen, cpu_hotplug: Prevent an out of bounds access (bsc#1065600).\n - xen: fix dom0 boot on huge systems (bsc#1127836).\n - xen/manage: do not complain about an empty value in control/sysrq node\n (bsc#1065600).\n - xen: remove pre-xen3 fallback handlers (bsc#1065600).\n - xfs: add option to mount with barrier=0 or barrier=1 (bsc#1088133).\n - xfs: fix contiguous dquot chunk iteration livelock (bsc#1070995).\n - xfs: remove filestream item xfs_inode reference (bsc#1127961).\n - xfs: rewrite xfs_dq_get_next_id using xfs_iext_lookup_extent\n (bsc#1070995).\n - xfs: Switch to iomap for SEEK_HOLE / SEEK_DATA (bsc#1070995).\n - yama: Check for pid death before checking ancestry (bsc#1051510).\n - yam: fix a missing-check bug (bsc#1051510).\n - zswap: re-check zswap_is_full() after do zswap_shrink() (bsc#1051510).\n - x86/uaccess: Do not leak the AC flag into __put_user() value evaluation\n (bsc#1114279).\n\n\nSpecial Instructions and Notes:\n\n Please reboot the system after installing this update.\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.0:\n\n zypper in -t patch openSUSE-2019-1193=1", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-04-12T00:00:00", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-2024", "CVE-2019-3819", "CVE-2019-7308", "CVE-2019-8912", "CVE-2019-8980", "CVE-2019-9213"], "modified": "2019-04-12T00:00:00", "id": "OPENSUSE-SU-2019:1193-1", "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KB6SDNTTTOZR257SKNDSIEN2KHPJ3OSB/", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "openvas": [{"lastseen": "2020-01-31T16:53:14", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-04-13T00:00:00", "type": "openvas", "title": "openSUSE: Security Advisory for the Linux Kernel (openSUSE-SU-2019:1193-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8980", "CVE-2019-8912", "CVE-2019-2024", "CVE-2019-9213", "CVE-2019-7308", "CVE-2019-3819"], "modified": "2020-01-31T00:00:00", "id": "OPENVAS:1361412562310852420", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852420", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852420\");\n script_version(\"2020-01-31T08:04:39+0000\");\n script_cve_id(\"CVE-2019-2024\", \"CVE-2019-3819\", \"CVE-2019-7308\", \"CVE-2019-8912\", \"CVE-2019-8980\", \"CVE-2019-9213\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:04:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-04-13 02:00:56 +0000 (Sat, 13 Apr 2019)\");\n script_name(\"openSUSE: Security Advisory for the Linux Kernel (openSUSE-SU-2019:1193-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.0\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2019:1193-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2019-04/msg00052.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'Linux Kernel'\n package(s) announced via the openSUSE-SU-2019:1193-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The openSUSE Leap 15.0 was updated to receive various security and\n bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2019-2024: A use-after-free when disconnecting a source was fixed\n which could lead to crashes. bnc#1129179).\n\n - CVE-2019-3819: A flaw was found in the Linux kernel in the function\n hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter\n an infinite loop with certain parameters passed from a userspace. A\n local privileged user ('root') can cause a system lock up and a denial\n of service. Versions from v4.18 and newer are vulnerable (bnc#1123161).\n\n - CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds\n speculation on pointer arithmetic in various cases, including cases of\n different branches with different state or limits to sanitize, leading\n to side-channel attacks (bnc#1124055).\n\n - CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a\n NULL value for a certain structure member, which leads to a\n use-after-free in sockfs_setattr (bnc#1125907).\n\n - CVE-2019-8980: A memory leak in the kernel_read_file function in\n fs/exec.c allowed attackers to cause a denial of service (memory\n consumption) by triggering vfs_read failures (bnc#1126209).\n\n - CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap\n minimum address, which made it easier for attackers to exploit kernel\n NULL pointer dereferences on non-SMAP platforms. This is related to a\n capability check for the wrong task (bnc#1128166).\n\n The following non-security bugs were fixed:\n\n - 9p/net: fix memory leak in p9_client_create (bsc#1051510).\n\n - 9p: use inode->i_lock to protect i_size_write() under 32-bit\n (bsc#1051510).\n\n - acpi: acpi_pad: Do not launch acpi_pad threads on idle cpus\n (bsc#1113399).\n\n - acpi/APEI: Clear GHES block_status before panic() (bsc#1051510).\n\n - acpi/device_sysfs: Avoid OF modalias creation for removed device\n (bsc#1051510).\n\n - acpi/nfit: Fix bus command validation (bsc#1051510).\n\n - acpi: NUMA: Use correct type for printing addresses on i386-PAE\n (bsc#1051510).\n\n - acpi / video: Extend chassis-type detection with a 'Lunch Box' check\n (bsc#1051510).\n\n - acpi / video: Refactor and fix dmi_is_desktop() (bsc#1051510).\n\n - alsa: bebob: use more identical mod_alias for Saffire Pro 10 I/O against\n Liquid Saffire 56 (bsc#1051510).\n\n - alsa: compress: prevent potential divide by zero bugs (bsc#1051510).\n\n - alsa: echoaudio: add a check for ioremap_nocache (bsc#1051510).\n\n - alsa: firewire: add const qualifier to identifiers for read-only symbols\n (bsc#1051510).\n\n - alsa: firewire-motu: add a flag ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'the' package(s) on openSUSE Leap 15.0.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap15.0\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-docs\", rpm:\"kernel-docs~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-docs-html\", rpm:\"kernel-docs-html~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-macros\", rpm:\"kernel-macros~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-source\", rpm:\"kernel-source~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-source-vanilla\", rpm:\"kernel-source-vanilla~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug\", rpm:\"kernel-debug~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug-base\", rpm:\"kernel-debug-base~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug-base-debuginfo\", rpm:\"kernel-debug-base-debuginfo~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug-debuginfo\", rpm:\"kernel-debug-debuginfo~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug-debugsource\", rpm:\"kernel-debug-debugsource~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug-devel\", rpm:\"kernel-debug-devel~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug-devel-debuginfo\", rpm:\"kernel-debug-devel-debuginfo~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default\", rpm:\"kernel-default~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default-base\", rpm:\"kernel-default-base~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default-base-debuginfo\", rpm:\"kernel-default-base-debuginfo~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default-debuginfo\", rpm:\"kernel-default-debuginfo~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default-debugsource\", rpm:\"kernel-default-debugsource~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default-devel\", rpm:\"kernel-default-devel~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default-devel-debuginfo\", rpm:\"kernel-default-devel-debuginfo~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall\", rpm:\"kernel-kvmsmall~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall-base\", rpm:\"kernel-kvmsmall-base~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall-base-debuginfo\", rpm:\"kernel-kvmsmall-base-debuginfo~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall-debuginfo\", rpm:\"kernel-kvmsmall-debuginfo~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall-debugsource\", rpm:\"kernel-kvmsmall-debugsource~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall-devel\", rpm:\"kernel-kvmsmall-devel~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall-devel-debuginfo\", rpm:\"kernel-kvmsmall-devel-debuginfo~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-obs-build\", rpm:\"kernel-obs-build~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-obs-build-debugsource\", rpm:\"kernel-obs-build-debugsource~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-obs-qa\", rpm:\"kernel-obs-qa~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-syms\", rpm:\"kernel-syms~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla\", rpm:\"kernel-vanilla~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla-base\", rpm:\"kernel-vanilla-base~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla-base-debuginfo\", rpm:\"kernel-vanilla-base-debuginfo~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla-debuginfo\", rpm:\"kernel-vanilla-debuginfo~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla-debugsource\", rpm:\"kernel-vanilla-debugsource~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla-devel\", rpm:\"kernel-vanilla-devel~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla-devel-debuginfo\", rpm:\"kernel-vanilla-devel-debuginfo~4.12.14~lp150.12.58.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-01-27T18:38:46", "description": "The remote host is missing an update for the Huawei EulerOS\n ", "cvss3": {}, "published": "2020-01-23T00:00:00", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1259)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-5848", "CVE-2018-16862", "CVE-2019-3701", "CVE-2019-9213", "CVE-2018-9516", "CVE-2018-10902", "CVE-2019-3819"], "modified": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191259", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191259", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1259\");\n script_version(\"2020-01-23T11:36:40+0000\");\n script_cve_id(\"CVE-2018-10902\", \"CVE-2018-16862\", \"CVE-2018-5848\", \"CVE-2018-9516\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-9213\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:36:40 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:36:40 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1259)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROSVIRT-2\\.5\\.3\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1259\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1259\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'kernel' package(s) announced via the EulerOS-SA-2019-1259 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames. This is related to cgw_csum_xor_rel. An unprivileged user can trigger a system crash (general protection fault).(CVE-2019-3701)\n\nA flaw was found in mmap in the Linux kernel allowing the process to map a null page. This allows attackers to abuse this mechanism to turn null pointer dereferences into workable exploits.(CVE-2019-9213)\n\nA security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.CVE-2018-16862\n\nIt was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation.CVE-2018-10902\n\nIn the function wmi_set_ie() in the Linux kernel the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the ie_len argument can cause a buffer overflow and thus a memory corruption leading to a system crash or other or unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.CVE-2018-5848\n\nA flaw was found in the Linux kernel in the function hid_debug_events_read() in the drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a user space. A local privileged user ('root') can cause a system lock up and a denial of service.CVE-2019-3819\n\nA flaw was found in the Linux kernel in the hid_debug_events_read() function in the drivers/hid/hid-debug.c file. A lack of the certain checks may allow a privileged user ('root') to achieve an out-of-bounds write and thus receiving user space buffer corruption.CVE-2018-9516\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Huawei EulerOS Virtualization 2.5.3.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROSVIRT-2.5.3\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~3.10.0~514.44.5.10_136\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~3.10.0~514.44.5.10_136\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~3.10.0~514.44.5.10_136\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~3.10.0~514.44.5.10_136\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs\", rpm:\"kernel-tools-libs~3.10.0~514.44.5.10_136\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs-devel\", rpm:\"kernel-tools-libs-devel~3.10.0~514.44.5.10_136\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-27T18:34:04", "description": "The remote host is missing an update for the Huawei EulerOS\n ", "cvss3": {}, "published": "2020-01-23T00:00:00", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1636)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-3837", "CVE-2019-3900", "CVE-2019-3460", "CVE-2018-19406", "CVE-2019-8956", "CVE-2019-3901", "CVE-2019-3459", "CVE-2019-9213", "CVE-2019-11815", "CVE-2018-16880", "CVE-2019-3819", "CVE-2013-7470", "CVE-2019-3882", "CVE-2018-19985"], "modified": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191636", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191636", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1636\");\n script_version(\"2020-01-23T14:23:06+0000\");\n script_cve_id(\"CVE-2013-7470\", \"CVE-2018-16880\", \"CVE-2018-19406\", \"CVE-2018-19985\", \"CVE-2019-11815\", \"CVE-2019-3459\", \"CVE-2019-3460\", \"CVE-2019-3819\", \"CVE-2019-3837\", \"CVE-2019-3882\", \"CVE-2019-3900\", \"CVE-2019-3901\", \"CVE-2019-8956\", \"CVE-2019-9213\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 14:23:06 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 12:18:09 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1636)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROSVIRTARM64-3\\.0\\.2\\.0\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1636\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1636\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'kernel' package(s) announced via the EulerOS-SA-2019-1636 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.(CVE-2019-11815)\n\nA flaw was found in the Linux kernel's handle_rx() function in the vhost_net driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.(CVE-2018-16880)\n\nA NULL pointer dereference security flaw was found in the Linux kernel in kvm_pv_send_ipi() in arch/x86/kvm/lapic.c. This allows local users with certain privileges to cause a denial of service via a crafted system call to the KVM subsystem.(CVE-2018-19406)\n\nThe function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space.(CVE-2018-19985)\n\nA heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1.(CVE-2019-3459)\n\nA heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.(CVE-2019-3460)\n\nA flaw was found in the Linux kernel in the function hid_debug_events_read() in the drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service.(CVE-2019-3819)\n\nIn the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.(CVE-2019-9213)\n\nA flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable.(CVE-2019-3882)\n\nAn inf ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Huawei EulerOS Virtualization for ARM 64 3.0.2.0.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROSVIRTARM64-3.0.2.0\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~4.19.36~1.2.159\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~4.19.36~1.2.159\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~4.19.36~1.2.159\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~4.19.36~1.2.159\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs\", rpm:\"kernel-tools-libs~4.19.36~1.2.159\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs-devel\", rpm:\"kernel-tools-libs-devel~4.19.36~1.2.159\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"perf\", rpm:\"perf~4.19.36~1.2.159\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python-perf\", rpm:\"python-perf~4.19.36~1.2.159\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-29T19:24:58", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-05-04T00:00:00", "type": "openvas", "title": "Debian LTS: Security Advisory for linux-4.9 (DLA-1771-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-7222", "CVE-2019-3460", "CVE-2018-19824", "CVE-2019-8980", "CVE-2018-14625", "CVE-2019-7221", "CVE-2018-16884", "CVE-2019-3701", "CVE-2019-6974", "CVE-2019-3459", "CVE-2019-9213", "CVE-2018-20169", "CVE-2018-1000026", "CVE-2019-3819", "CVE-2018-19985"], "modified": "2020-01-29T00:00:00", "id": "OPENVAS:1361412562310891771", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310891771", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.891771\");\n script_version(\"2020-01-29T08:22:52+0000\");\n script_cve_id(\"CVE-2018-1000026\", \"CVE-2018-14625\", \"CVE-2018-16884\", \"CVE-2018-19824\", \"CVE-2018-19985\", \"CVE-2018-20169\", \"CVE-2019-3459\", \"CVE-2019-3460\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-6974\", \"CVE-2019-7221\", \"CVE-2019-7222\", \"CVE-2019-8980\", \"CVE-2019-9213\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-29 08:22:52 +0000 (Wed, 29 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-05-04 02:00:21 +0000 (Sat, 04 May 2019)\");\n script_name(\"Debian LTS: Security Advisory for linux-4.9 (DLA-1771-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB8\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DLA-1771-1\");\n script_xref(name:\"URL\", value:\"https://bugs.debian.org/904385\");\n script_xref(name:\"URL\", value:\"https://bugs.debian.org/918103\");\n script_xref(name:\"URL\", value:\"https://bugs.debian.org/922306\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux-4.9'\n package(s) announced via the DLA-1771-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Several vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2018-14625\n\nA use-after-free bug was found in the vhost driver for the Virtual\nSocket protocol. If this driver is used to communicate with a\nmalicious virtual machine guest, the guest could read sensitive\ninformation from the host kernel.\n\nCVE-2018-16884\n\nA flaw was found in the NFS 4.1 client implementation. Mounting\nNFS shares in multiple network namespaces at the same time could\nlead to a user-after-free. Local users might be able to use this\nfor denial of service (memory corruption or crash) or possibly\nfor privilege escalation.\n\nThis can be mitigated by disabling unprivileged users from\ncreating user namespaces, which is the default in Debian.\n\nCVE-2018-19824\n\nHui Peng and Mathias Payer discovered a use-after-free bug in the\nUSB audio driver. A physically present attacker able to attach a\nspecially designed USB device could use this for privilege\nescalation.\n\nCVE-2018-19985\n\nHui Peng and Mathias Payer discovered a missing bounds check in the\nhso USB serial driver. A physically present user able to attach a\nspecially designed USB device could use this to read sensitive\ninformation from the kernel or to cause a denial of service\n(crash).\n\nCVE-2018-20169\n\nHui Peng and Mathias Payer discovered missing bounds checks in the\nUSB core. A physically present attacker able to attach a specially\ndesigned USB device could use this to cause a denial of service\n(crash) or possibly for privilege escalation.\n\nCVE-2018-1000026\n\nIt was discovered that Linux could forward aggregated network\npackets with a segmentation size too large for the output device.\nIn the specific case of Broadcom NetXtremeII 10Gb adapters, this\nwould result in a denial of service (firmware crash). This update\nadds a mitigation to the bnx2x driver for this hardware.\n\nCVE-2019-3459, CVE-2019-3460\n\nShlomi Oberman, Yuli Shapiro and Karamba Security Ltd. research\nteam discovered missing range checks in the Bluetooth L2CAP\nimplementation. If Bluetooth is enabled, a nearby attacker\ncould use these to read sensitive information from the kernel.\n\nCVE-2019-3701\n\nMuyu Yu and Marcus Meissner reported that the CAN gateway\nimplementation allowed the frame length to be modified, typically\nresulting in out-of-bounds memory-mapped I/O writes. On a system\nwith CAN devices present, a local user with CAP_NET_ADMIN\ncapability in the initial net namespace could use this to cause a\ncrash (oops) or other hardware-dependent impact.\n\nCVE-2019-3819\n\nA potential infinite loop was discovered in the HID debugfs\ninterface exposed under ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux-4.9' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For Debian 8 'Jessie', these problems have been fixed in version\n4.9.168-1~deb8u1. This version also includes fixes for Debian bugs\n#904385, #918103, and #922306, and other fixes included in upstream\nstable updates.\n\nWe recommend that you upgrade your linux-4.9 and linux-latest-4.9\npackages. You will need to use 'apt-get upgrade --with-new-pkgs'\nor 'apt upgrade' as the binary package names have changed.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"linux-compiler-gcc-4.9-arm\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-doc-4.9\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-686\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-686-pae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-all\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-all-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-all-armel\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-all-armhf\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-all-i386\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-armmp\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-armmp-lpae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-common\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-common-rt\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-marvell\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-rt-686-pae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.7-rt-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-686\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-686-pae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-all\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-all-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-all-armel\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-all-armhf\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-all-i386\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-armmp\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-armmp-lpae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-common\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-common-rt\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-marvell\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-rt-686-pae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.8-rt-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-686\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-686-pae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-all\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-all-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-all-armel\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-all-armhf\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-all-i386\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-armmp\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-armmp-lpae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-common\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-common-rt\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-marvell\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-rt-686-pae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.9-rt-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.7-686\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.7-686-pae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.7-686-pae-dbg\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.7-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.7-amd64-dbg\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.7-armmp\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.7-armmp-lpae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.7-marvell\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.7-rt-686-pae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.7-rt-686-pae-dbg\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.7-rt-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.7-rt-amd64-dbg\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.8-686\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.8-686-pae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.8-686-pae-dbg\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.8-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.8-amd64-dbg\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.8-armmp\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.8-armmp-lpae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.8-marvell\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.8-rt-686-pae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.8-rt-686-pae-dbg\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.8-rt-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.8-rt-amd64-dbg\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.9-686\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.9-686-pae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.9-686-pae-dbg\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.9-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.9-amd64-dbg\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.9-armmp\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.9-armmp-lpae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.9-marvell\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.9-rt-686-pae\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.9-rt-686-pae-dbg\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.9-rt-amd64\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.9-rt-amd64-dbg\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-kbuild-4.9\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-manual-4.9\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-perf-4.9\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-source-4.9\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-4.9.0-0.bpo.7\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-4.9.0-0.bpo.8\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-4.9.0-0.bpo.9\", ver:\"4.9.168-1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:32:23", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-04-03T00:00:00", "type": "openvas", "title": "Ubuntu Update for linux USN-3932-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-9517", "CVE-2019-7222", "CVE-2018-14610", "CVE-2019-3460", "CVE-2018-13100", "CVE-2017-18249", "CVE-2018-13099", "CVE-2018-14614", "CVE-2019-7221", "CVE-2018-16884", "CVE-2019-3701", "CVE-2019-6974", "CVE-2018-14612", "CVE-2019-3459", "CVE-2019-9213", "CVE-2018-14611", "CVE-2018-13097", "CVE-2019-3819", "CVE-2018-14616", "CVE-2018-14613"], "modified": "2019-04-26T00:00:00", "id": "OPENVAS:1361412562310843957", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843957", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.843957\");\n script_version(\"2019-04-26T08:24:31+0000\");\n script_cve_id(\"CVE-2017-18249\", \"CVE-2018-13097\", \"CVE-2018-13099\", \"CVE-2018-13100\",\n \"CVE-2018-14614\", \"CVE-2018-14616\", \"CVE-2018-14610\", \"CVE-2018-14611\",\n \"CVE-2018-14612\", \"CVE-2018-14613\", \"CVE-2018-16884\", \"CVE-2018-9517\",\n \"CVE-2019-3459\", \"CVE-2019-3460\", \"CVE-2019-6974\", \"CVE-2019-7221\",\n \"CVE-2019-7222\", \"CVE-2019-9213\", \"CVE-2019-3701\", \"CVE-2019-3819\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-04-26 08:24:31 +0000 (Fri, 26 Apr 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-04-03 06:40:15 +0000 (Wed, 03 Apr 2019)\");\n script_name(\"Ubuntu Update for linux USN-3932-1\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU16\\.04 LTS\");\n\n script_xref(name:\"USN\", value:\"3932-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-3932-1/\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux'\n package(s) announced via the USN-3932-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was discovered that a race condition\nexisted in the f2fs file system implementation in the Linux kernel. A local\nattacker could use this to cause a denial of service. (CVE-2017-18249)\n\nWen Xu discovered that the f2fs file system implementation in the Linux\nkernel did not properly validate metadata. An attacker could use this to\nconstruct a malicious f2fs image that, when mounted, could cause a denial\nof service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100,\nCVE-2018-14614, CVE-2018-14616)\n\nWen Xu and Po-Ning Tseng discovered that btrfs file system implementation\nin the Linux kernel did not properly validate metadata. An attacker could\nuse this to construct a malicious btrfs image that, when mounted, could\ncause a denial of service (system crash). (CVE-2018-14610, CVE-2018-14611,\nCVE-2018-14612, CVE-2018-14613)\n\nVasily Averin and Evgenii Shatokhin discovered that a use-after-free\nvulnerability existed in the NFS41+ subsystem when multiple network\nnamespaces are in use. A local attacker in a container could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2018-16884)\n\nIt was discovered that a use-after-free vulnerability existed in the PPP\nover L2TP implementation in the Linux kernel. A privileged local attacker\ncould use this to possibly execute arbitrary code. (CVE-2018-9517)\n\nShlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information\nleak in the Bluetooth implementation of the Linux kernel. An attacker\nwithin Bluetooth range could use this to expose sensitive information\n(kernel memory). (CVE-2019-3459, CVE-2019-3460)\n\nJann Horn discovered that the KVM implementation in the Linux kernel\ncontained a use-after-free vulnerability. An attacker in a guest VM with\naccess to /dev/kvm could use this to cause a denial of service (guest VM\ncrash). (CVE-2019-6974)\n\nJim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in\nthe KVM subsystem of the Linux kernel, when using nested virtual machines.\nA local attacker in a guest VM could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code in the host system.\n(CVE-2019-7221)\n\nFelix Wilhelm discovered that an information leak vulnerability existed in\nthe KVM subsystem of the Linux kernel, when nested virtualization is used.\nA local attacker could use this to expose sensitive information (host\nsystem memory to a guest VM). (CVE-2019-7222)\n\nJann Horn discovered that the mmap implementation in the Linux kernel did\nnot properly check for the mmap minimum address in some situations. A local\nattacker could use this to assist exploiti ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux' package(s) on Ubuntu 16.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU16.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-1043-kvm\", ver:\"4.4.0-1043.49\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-1079-aws\", ver:\"4.4.0-1079.89\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-1106-raspi2\", ver:\"4.4.0-1106.114\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-1110-snapdragon\", ver:\"4.4.0-1110.115\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-145-generic\", ver:\"4.4.0-145.171\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-145-generic-lpae\", ver:\"4.4.0-145.171\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-145-lowlatency\", ver:\"4.4.0-145.171\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-145-powerpc-e500mc\", ver:\"4.4.0-145.171\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-145-powerpc-smp\", ver:\"4.4.0-145.171\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-145-powerpc64-emb\", ver:\"4.4.0-145.171\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-145-powerpc64-smp\", ver:\"4.4.0-145.171\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-aws\", ver:\"4.4.0.1079.82\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic\", ver:\"4.4.0.145.153\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic-lpae\", ver:\"4.4.0.145.153\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-kvm\", ver:\"4.4.0.1043.43\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-lowlatency\", ver:\"4.4.0.145.153\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc-e500mc\", ver:\"4.4.0.145.153\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc-smp\", ver:\"4.4.0.145.153\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc64-emb\", ver:\"4.4.0.145.153\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc64-smp\", ver:\"4.4.0.145.153\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-raspi2\", ver:\"4.4.0.1106.106\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-snapdragon\", ver:\"4.4.0.1110.102\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-virtual\", ver:\"4.4.0.145.153\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:32:24", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-04-03T00:00:00", "type": "openvas", "title": "Ubuntu Update for linux-aws USN-3932-2", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-9517", "CVE-2019-7222", "CVE-2018-14610", "CVE-2019-3460", "CVE-2018-13100", "CVE-2017-18249", "CVE-2018-13099", "CVE-2018-14614", "CVE-2019-7221", "CVE-2018-16884", "CVE-2019-3701", "CVE-2019-6974", "CVE-2018-14612", "CVE-2019-3459", "CVE-2019-9213", "CVE-2018-14611", "CVE-2018-13097", "CVE-2019-3819", "CVE-2018-14616", "CVE-2018-14613"], "modified": "2019-04-26T00:00:00", "id": "OPENVAS:1361412562310843951", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843951", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.843951\");\n script_version(\"2019-04-26T08:24:31+0000\");\n script_cve_id(\"CVE-2017-18249\", \"CVE-2018-13097\", \"CVE-2018-13099\", \"CVE-2018-13100\",\n \"CVE-2018-14614\", \"CVE-2018-14616\", \"CVE-2018-14610\", \"CVE-2018-14611\",\n \"CVE-2018-14612\", \"CVE-2018-14613\", \"CVE-2018-16884\", \"CVE-2018-9517\",\n \"CVE-2019-3459\", \"CVE-2019-3460\", \"CVE-2019-6974\", \"CVE-2019-7221\",\n \"CVE-2019-7222\", \"CVE-2019-9213\", \"CVE-2019-3701\", \"CVE-2019-3819\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-04-26 08:24:31 +0000 (Fri, 26 Apr 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-04-03 06:39:18 +0000 (Wed, 03 Apr 2019)\");\n script_name(\"Ubuntu Update for linux-aws USN-3932-2\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU14\\.04 LTS\");\n\n script_xref(name:\"USN\", value:\"3932-2\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-3932-2/\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux-aws'\n package(s) announced via the USN-3932-2 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"USN-3932-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu\n14.04 LTS.\n\nIt was discovered that a race condition existed in the f2fs file system\nimplementation in the Linux kernel. A local attacker could use this to\ncause a denial of service. (CVE-2017-18249)\n\nWen Xu discovered that the f2fs file system implementation in the Linux\nkernel did not properly validate metadata. An attacker could use this to\nconstruct a malicious f2fs image that, when mounted, could cause a denial\nof service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100,\nCVE-2018-14614, CVE-2018-14616)\n\nWen Xu and Po-Ning Tseng discovered that btrfs file system implementation\nin the Linux kernel did not properly validate metadata. An attacker could\nuse this to construct a malicious btrfs image that, when mounted, could\ncause a denial of service (system crash). (CVE-2018-14610, CVE-2018-14611,\nCVE-2018-14612, CVE-2018-14613)\n\nVasily Averin and Evgenii Shatokhin discovered that a use-after-free\nvulnerability existed in the NFS41+ subsystem when multiple network\nnamespaces are in use. A local attacker in a container could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2018-16884)\n\nIt was discovered that a use-after-free vulnerability existed in the PPP\nover L2TP implementation in the Linux kernel. A privileged local attacker\ncould use this to possibly execute arbitrary code. (CVE-2018-9517)\n\nShlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information\nleak in the Bluetooth implementation of the Linux kernel. An attacker\nwithin Bluetooth range could use this to expose sensitive information\n(kernel memory). (CVE-2019-3459, CVE-2019-3460)\n\nJann Horn discovered that the KVM implementation in the Linux kernel\ncontained a use-after-free vulnerability. An attacker in a guest VM with\naccess to /dev/kvm could use this to cause a denial of service (guest VM\ncrash). (CVE-2019-6974)\n\nJim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in\nthe KVM subsystem of the Linux kernel, when using nested virtual machines.\nA local attacker in a guest VM could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code in the host system.\n(CVE-2019-7221)\n\nFelix Wilhelm discovered that an information leak vulnerability existed in\nthe KVM subsystem of the Linux kernel, when nested virtualization is used.\nA local attacker could use this to expose sensitive information (host\nsystem memory to a gu ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux-aws' package(s) on Ubuntu 14.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU14.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-1040-aws\", ver:\"4.4.0-1040.43\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-144-generic\", ver:\"4.4.0-144.170~14.04.1\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-144-generic-lpae\", ver:\"4.4.0-144.170~14.04.1\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-144-lowlatency\", ver:\"4.4.0-144.170~14.04.1\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-144-powerpc-e500mc\", ver:\"4.4.0-144.170~14.04.1\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-144-powerpc-smp\", ver:\"4.4.0-144.170~14.04.1\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-144-powerpc64-emb\", ver:\"4.4.0-144.170~14.04.1\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-144-powerpc64-smp\", ver:\"4.4.0-144.170~14.04.1\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-aws\", ver:\"4.4.0.1040.41\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic-lpae-lts-xenial\", ver:\"4.4.0.144.127\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic-lts-xenial\", ver:\"4.4.0.144.127\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-lowlatency-lts-xenial\", ver:\"4.4.0.144.127\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc-e500mc-lts-xenial\", ver:\"4.4.0.144.127\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc-smp-lts-xenial\", ver:\"4.4.0.144.127\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc64-emb-lts-xenial\", ver:\"4.4.0.144.127\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc64-smp-lts-xenial\", ver:\"4.4.0.144.127\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-virtual-lts-xenial\", ver:\"4.4.0.144.127\", rls:\"UBUNTU14.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-29T19:30:14", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-03-27T00:00:00", "type": "openvas", "title": "Debian LTS: Security Advisory for linux (DLA-1731-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-7222", "CVE-2017-5753", "CVE-2018-13053", "CVE-2018-19824", "CVE-2018-18690", "CVE-2016-10741", "CVE-2018-5848", "CVE-2018-5953", "CVE-2018-16862", "CVE-2017-13305", "CVE-2018-18710", "CVE-2018-18281", "CVE-2019-7221", "CVE-2018-16884", "CVE-2019-3701", "CVE-2018-17972", "CVE-2019-6974", "CVE-2019-9213", "CVE-2018-20169", "CVE-2018-3639", "CVE-2019-3819", "CVE-2018-19985", "CVE-2018-12896", "CVE-2018-20511"], "modified": "2020-01-29T00:00:00", "id": "OPENVAS:1361412562310891731", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310891731", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.891731\");\n script_version(\"2020-01-29T08:22:52+0000\");\n script_cve_id(\"CVE-2016-10741\", \"CVE-2017-13305\", \"CVE-2017-5753\", \"CVE-2018-12896\", \"CVE-2018-13053\", \"CVE-2018-16862\", \"CVE-2018-16884\", \"CVE-2018-17972\", \"CVE-2018-18281\", \"CVE-2018-18690\", \"CVE-2018-18710\", \"CVE-2018-19824\", \"CVE-2018-19985\", \"CVE-2018-20169\", \"CVE-2018-20511\", \"CVE-2018-3639\", \"CVE-2018-5848\", \"CVE-2018-5953\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-6974\", \"CVE-2019-7221\", \"CVE-2019-7222\", \"CVE-2019-9213\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-29 08:22:52 +0000 (Wed, 29 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-03-27 23:00:00 +0100 (Wed, 27 Mar 2019)\");\n script_name(\"Debian LTS: Security Advisory for linux (DLA-1731-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB8\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DLA-1731-1\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux'\n package(s) announced via the DLA-1731-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Several vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2016-10741\n\nA race condition was discovered in XFS that would result in a\ncrash (BUG). A local user permitted to write to an XFS volume\ncould use this for denial of service.\n\nCVE-2017-5753\n\nFurther instances of code that was vulnerable to Spectre variant 1\n(bounds-check bypass) have been mitigated.\n\nCVE-2017-13305\n\nA memory over-read was discovered in the keys subsystem's\nencrypted key type. A local user could use this for denial of\nservice or possibly to read sensitive information.\n\nCVE-2018-3639 (SSB)\n\nMultiple researchers have discovered that Speculative Store Bypass\n(SSB), a feature implemented in many processors, could be used to\nread sensitive information from another context. In particular,\ncode in a software sandbox may be able to read sensitive\ninformation from outside the sandbox. This issue is also known as\nSpectre variant 4.\n\nThis update fixes bugs in the mitigations for SSB for AMD\nprocessors.\n\nCVE-2018-5848\n\nThe wil6210 wifi driver did not properly validate lengths in scan\nand connection requests, leading to a possible buffer overflow.\nOn systems using this driver, a local user with the CAP_NET_ADMIN\ncapability could use this for denial of service (memory corruption\nor crash) or potentially for privilege escalation.\n\nCVE-2018-5953\n\nThe swiotlb subsystem printed kernel memory addresses to the\nsystem log, which could help a local attacker to exploit other\nvulnerabilities.\n\nCVE-2018-12896, CVE-2018-13053\n\nTeam OWL337 reported possible integer overflows in the POSIX\ntimer implementation. These might have some security impact.\n\nCVE-2018-16862\n\nVasily Averin and Pavel Tikhomirov from Virtuozzo Kernel Team\ndiscovered that the cleancache memory management feature did not\ninvalidate cached data for deleted files. On Xen guests using the\ntmem driver, local users could potentially read data from other\nusers' deleted files if they were able to create new files on the\nsame volume.\n\nCVE-2018-16884\n\nA flaw was found in the NFS 4.1 client implementation. Mounting\nNFS shares in multiple network namespaces at the same time could\nlead to a user-after-free. Local users might be able to use this\nfor denial of service (memory corruption or crash) or possibly\nfor privilege escalation.\n\nThis can be mitigated by disabling unprivileged users from\ncreating user namespaces, which is the default in Debian.\n\nCVE-2018-17972\n\nJann Horn reported that the /proc/*/stack files in procfs leaked\nsensitive data from the kernel. These files are now only readable\nby users with the CAP_SYS_AD ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For Debian 8 'Jessie', these problems have been fixed in version\n3.16.64-1.\n\nWe recommend that you upgrade your linux packages.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"linux-compiler-gcc-4.8-arm\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-compiler-gcc-4.8-x86\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-compiler-gcc-4.9-x86\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-doc-3.16\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-586\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-686-pae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-all\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-all-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-all-armel\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-all-armhf\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-all-i386\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-armmp\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-armmp-lpae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-common\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-ixp4xx\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-kirkwood\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-orion5x\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-4-versatile\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-586\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-686-pae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-all\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-all-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-all-armel\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-all-armhf\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-all-i386\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-armmp\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-armmp-lpae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-common\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-ixp4xx\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-kirkwood\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-orion5x\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-5-versatile\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-586\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-686-pae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-all\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-all-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-all-armel\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-all-armhf\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-all-i386\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-armmp\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-armmp-lpae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-common\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-ixp4xx\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-kirkwood\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-orion5x\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-6-versatile\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-586\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-686-pae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-all\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-all-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-all-armel\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-all-armhf\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-all-i386\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-armmp\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-armmp-lpae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-common\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-ixp4xx\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-kirkwood\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-orion5x\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-7-versatile\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-586\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-686-pae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-all\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-all-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-all-armel\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-all-armhf\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-all-i386\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-armmp\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-armmp-lpae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-common\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-ixp4xx\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-kirkwood\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-orion5x\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-8-versatile\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-4-586\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-4-686-pae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-4-686-pae-dbg\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-4-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-4-amd64-dbg\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-4-armmp\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-4-armmp-lpae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-4-ixp4xx\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-4-kirkwood\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-4-orion5x\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-4-versatile\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-5-586\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-5-686-pae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-5-686-pae-dbg\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-5-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-5-amd64-dbg\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-5-armmp\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-5-armmp-lpae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-5-ixp4xx\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-5-kirkwood\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-5-orion5x\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-5-versatile\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-6-586\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-6-686-pae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-6-686-pae-dbg\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-6-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-6-amd64-dbg\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-6-armmp\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-6-armmp-lpae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-6-ixp4xx\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-6-kirkwood\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-6-orion5x\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-6-versatile\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-7-586\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-7-686-pae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-7-686-pae-dbg\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-7-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-7-amd64-dbg\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-7-armmp\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-7-armmp-lpae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-7-ixp4xx\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-7-kirkwood\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-7-orion5x\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-7-versatile\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-8-586\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-8-686-pae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-8-686-pae-dbg\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-8-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-8-amd64-dbg\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-8-armmp\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-8-armmp-lpae\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-8-ixp4xx\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-8-kirkwood\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-8-orion5x\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-8-versatile\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-libc-dev\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-manual-3.16\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-source-3.16\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-3.16.0-4\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-3.16.0-6\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-3.16.0-7\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-3.16.0-8\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"xen-linux-system-3.16.0-4-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"xen-linux-system-3.16.0-5-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"xen-linux-system-3.16.0-6-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"xen-linux-system-3.16.0-7-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"xen-linux-system-3.16.0-8-amd64\", ver:\"3.16.64-1\", rls:\"DEB8\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-09-06T18:54:00", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-09-03T00:00:00", "type": "openvas", "title": "Ubuntu Update for linux USN-4115-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-14763", "CVE-2019-15218", "CVE-2019-15090", "CVE-2019-3900", "CVE-2019-0136", "CVE-2019-14284", "CVE-2019-10639", "CVE-2018-20784", "CVE-2019-15216", "CVE-2019-15211", "CVE-2019-13648", "CVE-2019-9506", "CVE-2019-15215", "CVE-2019-13631", "CVE-2019-10207", "CVE-2019-15220", "CVE-2019-11810", "CVE-2019-15212", "CVE-2019-11599", "CVE-2019-15221", "CVE-2019-10638", "CVE-2019-3701", "CVE-2019-15292", "CVE-2019-11487", "CVE-2019-15214", "CVE-2019-3819", "CVE-2018-19985", "CVE-2019-14283"], "modified": "2019-09-05T00:00:00", "id": "OPENVAS:1361412562310844156", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844156", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844156\");\n script_version(\"2019-09-05T09:53:24+0000\");\n script_cve_id(\"CVE-2018-19985\", \"CVE-2018-20784\", \"CVE-2019-0136\", \"CVE-2019-10207\", \"CVE-2019-10638\", \"CVE-2019-10639\", \"CVE-2019-11487\", \"CVE-2019-11599\", \"CVE-2019-11810\", \"CVE-2019-13631\", \"CVE-2019-13648\", \"CVE-2019-14283\", \"CVE-2019-14284\", \"CVE-2019-14763\", \"CVE-2019-15090\", \"CVE-2019-15211\", \"CVE-2019-15212\", \"CVE-2019-15214\", \"CVE-2019-15215\", \"CVE-2019-15220\", \"CVE-2019-15292\", \"CVE-2019-3900\", \"CVE-2019-9506\", \"CVE-2019-15216\", \"CVE-2019-15218\", \"CVE-2019-15221\", \"CVE-2019-3701\", \"CVE-2019-3819\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-09-05 09:53:24 +0000 (Thu, 05 Sep 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-09-03 02:01:18 +0000 (Tue, 03 Sep 2019)\");\n script_name(\"Ubuntu Update for linux USN-4115-1\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=(UBUNTU18\\.04 LTS|UBUNTU16\\.04 LTS)\");\n\n script_xref(name:\"USN\", value:\"4115-1\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2019-September/005093.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux'\n package(s) announced via the USN-4115-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Hui Peng and Mathias Payer discovered that the Option USB High Speed driver\nin the Linux kernel did not properly validate metadata received from the\ndevice. A physically proximate attacker could use this to cause a denial of\nservice (system crash). (CVE-2018-19985)\n\nZhipeng Xie discovered that an infinite loop could triggered in the CFS\nLinux kernel process scheduler. A local attacker could possibly use this to\ncause a denial of service. (CVE-2018-20784)\n\nIt was discovered that the Intel wifi device driver in the Linux kernel did\nnot properly validate certain Tunneled Direct Link Setup (TDLS). A\nphysically proximate attacker could use this to cause a denial of service\n(wifi disconnect). (CVE-2019-0136)\n\nIt was discovered that the Bluetooth UART implementation in the Linux\nkernel did not properly check for missing tty operations. A local attacker\ncould use this to cause a denial of service. (CVE-2019-10207)\n\nAmit Klein and Benny Pinkas discovered that the Linux kernel did not\nsufficiently randomize IP ID values generated for connectionless networking\nprotocols. A remote attacker could use this to track particular Linux\ndevices. (CVE-2019-10638)\n\nAmit Klein and Benny Pinkas discovered that the location of kernel\naddresses could exposed by the implementation of connection-less network\nprotocols in the Linux kernel. A remote attacker could possibly use this to\nassist in the exploitation of another vulnerability in the Linux kernel.\n(CVE-2019-10639)\n\nIt was discovered that an integer overflow existed in the Linux kernel when\nreference counting pages, leading to potential use-after-free issues. A\nlocal attacker could use this to cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2019-11487)\n\nJann Horn discovered that a race condition existed in the Linux kernel when\nperforming core dumps. A local attacker could use this to cause a denial of\nservice (system crash) or expose sensitive information. (CVE-2019-11599)\n\nIt was discovered that a null pointer dereference vulnerability existed in\nthe LSI Logic MegaRAID driver in the Linux kernel. A local attacker could\nuse this to cause a denial of service (system crash). (CVE-2019-11810)\n\nIt was discovered that the GTCO tablet input driver in the Linux kernel did\nnot properly bounds check the initial HID report sent by the device. A\nphysically proximate attacker could use to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2019-13631)\n\nPraveen Pandey discovered that the Linux kernel did not properly validate\nsent signals in some situations on PowerPC systems with transaction ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux' package(s) on Ubuntu 18.04 LTS, Ubuntu 16.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU18.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1022-oracle\", ver:\"4.15.0-1022.25\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1041-gke\", ver:\"4.15.0-1041.43\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1043-kvm\", ver:\"4.15.0-1043.43\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1044-raspi2\", ver:\"4.15.0-1044.47\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-60-generic\", ver:\"4.15.0-60.67\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-60-generic-lpae\", ver:\"4.15.0-60.67\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-60-lowlatency\", ver:\"4.15.0-60.67\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic\", ver:\"4.15.0.60.62\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic-lpae\", ver:\"4.15.0.60.62\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gke\", ver:\"4.15.0.1041.44\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gke-4.15\", ver:\"4.15.0.1041.44\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-kvm\", ver:\"4.15.0.1043.43\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-lowlatency\", ver:\"4.15.0.60.62\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-oracle\", ver:\"4.15.0.1022.25\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc-e500mc\", ver:\"4.15.0.60.62\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc-smp\", ver:\"4.15.0.60.62\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc64-emb\", ver:\"4.15.0.60.62\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc64-smp\", ver:\"4.15.0.60.62\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-raspi2\", ver:\"4.15.0.1044.42\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-virtual\", ver:\"4.15.0.60.62\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU16.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1022-oracle\", ver:\"4.15.0-1022.25~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1041-gcp\", ver:\"4.15.0-1041.43\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1056-azure\", ver:\"4.15.0-1056.61\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-60-generic\", ver:\"4.15.0-60.67~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-60-generic-lpae\", ver:\"4.15.0-60.67~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-60-lowlatency\", ver:\"4.15.0-60.67~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-azure\", ver:\"4.15.0.1056.59\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gcp\", ver:\"4.15.0.1041.55\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic-hwe-16.04\", ver:\"4.15.0.60.81\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic-lpae-hwe-16.04\", ver:\"4.15.0.60.81\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gke\", ver:\"4.15.0.1041.55\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-lowlatency-hwe-16.04\", ver:\"4.15.0.60.81\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-oem\", ver:\"4.15.0.60.81\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-oracle\", ver:\"4.15.0.1022.16\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-virtual-hwe-16.04\", ver:\"4.15.0.60.81\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-09-17T00:36:24", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-09-12T00:00:00", "type": "openvas", "title": "Ubuntu Update for linux USN-4115-2", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-14763", "CVE-2019-15218", "CVE-2019-15090", "CVE-2019-3900", "CVE-2019-0136", "CVE-2019-14284", "CVE-2019-10639", "CVE-2018-20784", "CVE-2019-15216", "CVE-2019-15211", "CVE-2019-13648", "CVE-2019-9506", "CVE-2019-15215", "CVE-2019-13631", "CVE-2019-10207", "CVE-2019-15220", "CVE-2019-11810", "CVE-2019-15212", "CVE-2019-11599", "CVE-2019-15221", "CVE-2019-10638", "CVE-2019-3701", "CVE-2019-15292", "CVE-2019-11487", "CVE-2019-15214", "CVE-2019-3819", "CVE-2018-19985", "CVE-2019-14283"], "modified": "2019-09-16T00:00:00", "id": "OPENVAS:1361412562310844174", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844174", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844174\");\n script_version(\"2019-09-16T07:48:47+0000\");\n script_cve_id(\"CVE-2018-19985\", \"CVE-2018-20784\", \"CVE-2019-0136\", \"CVE-2019-10207\", \"CVE-2019-10638\", \"CVE-2019-10639\", \"CVE-2019-11487\", \"CVE-2019-11599\", \"CVE-2019-11810\", \"CVE-2019-13631\", \"CVE-2019-13648\", \"CVE-2019-14283\", \"CVE-2019-14284\", \"CVE-2019-14763\", \"CVE-2019-15090\", \"CVE-2019-15211\", \"CVE-2019-15212\", \"CVE-2019-15214\", \"CVE-2019-15215\", \"CVE-2019-15220\", \"CVE-2019-15292\", \"CVE-2019-3900\", \"CVE-2019-9506\", \"CVE-2019-15216\", \"CVE-2019-15218\", \"CVE-2019-15221\", \"CVE-2019-3701\", \"CVE-2019-3819\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-09-16 07:48:47 +0000 (Mon, 16 Sep 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-09-12 02:01:51 +0000 (Thu, 12 Sep 2019)\");\n script_name(\"Ubuntu Update for linux USN-4115-2\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=(UBUNTU18\\.04 LTS|UBUNTU16\\.04 LTS)\");\n\n script_xref(name:\"USN\", value:\"4115-2\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2019-September/005111.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux'\n package(s) announced via the USN-4115-2 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"USN 4115-1 fixed vulnerabilities in the Linux 4.15 kernel for Ubuntu\n18.04 LTS and Ubuntu 16.04 LTS. Unfortunately, as part of the update,\na regression was introduced that caused a kernel crash when handling\nfragmented packets in some situations. This update addresses the issue.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\nHui Peng and Mathias Payer discovered that the Option USB High Speed driver\nin the Linux kernel did not properly validate metadata received from the\ndevice. A physically proximate attacker could use this to cause a denial of\nservice (system crash). (CVE-2018-19985)\n\nZhipeng Xie discovered that an infinite loop could triggered in the CFS\nLinux kernel process scheduler. A local attacker could possibly use this to\ncause a denial of service. (CVE-2018-20784)\n\nIt was discovered that the Intel Wi-Fi device driver in the Linux kernel did\nnot properly validate certain Tunneled Direct Link Setup (TDLS). A\nphysically proximate attacker could use this to cause a denial of service\n(Wi-Fi disconnect). (CVE-2019-0136)\n\nIt was discovered that the Bluetooth UART implementation in the Linux\nkernel did not properly check for missing tty operations. A local attacker\ncould use this to cause a denial of service. (CVE-2019-10207)\n\nAmit Klein and Benny Pinkas discovered that the Linux kernel did not\nsufficiently randomize IP ID values generated for connectionless networking\nprotocols. A remote attacker could use this to track particular Linux\ndevices. (CVE-2019-10638)\n\nAmit Klein and Benny Pinkas discovered that the location of kernel\naddresses could be exposed by the implementation of connection-less network\nprotocols in the Linux kernel. A remote attacker could possibly use this to\nassist in the exploitation of another vulnerability in the Linux kernel.\n(CVE-2019-10639)\n\nIt was discovered that an integer overflow existed in the Linux kernel when\nreference counting pages, leading to potential use-after-free issues. A\nlocal attacker could use this to cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2019-11487)\n\nJann Horn discovered that a race condition existed in the Linux kernel when\nperforming core dumps. A local attacker could use this to cause a denial of\nservice (system crash) or expose sensitive information. (CVE-2019-11599)\n\nIt was discovered that a null pointer dereference vulnerability existed in\nthe LSI Logic MegaRAID driver in the Linux kernel. A local attacker could\nuse this to cause a denial of service (system crash). (CVE-2019-11810)\n\nIt was discovered that the GTCO tablet input driver in the Linux kernel did ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux' package(s) on Ubuntu 18.04 LTS, Ubuntu 16.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU18.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1023-oracle\", ver:\"4.15.0-1023.26\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1042-gke\", ver:\"4.15.0-1042.44\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1044-kvm\", ver:\"4.15.0-1044.44\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1045-raspi2\", ver:\"4.15.0-1045.49\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1048-aws\", ver:\"4.15.0-1048.50\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-62-generic\", ver:\"4.15.0-62.69\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-62-generic-lpae\", ver:\"4.15.0-62.69\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-62-lowlatency\", ver:\"4.15.0-62.69\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-aws\", ver:\"4.15.0.1048.47\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic\", ver:\"4.15.0.62.64\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic-lpae\", ver:\"4.15.0.62.64\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gke\", ver:\"4.15.0.1042.45\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gke-4.15\", ver:\"4.15.0.1042.45\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-kvm\", ver:\"4.15.0.1044.44\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-lowlatency\", ver:\"4.15.0.62.64\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-oracle\", ver:\"4.15.0.1023.26\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc-e500mc\", ver:\"4.15.0.62.64\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc-smp\", ver:\"4.15.0.62.64\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc64-emb\", ver:\"4.15.0.62.64\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc64-smp\", ver:\"4.15.0.62.64\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-raspi2\", ver:\"4.15.0.1045.43\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-virtual\", ver:\"4.15.0.62.64\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU16.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1023-oracle\", ver:\"4.15.0-1023.26~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1042-gcp\", ver:\"4.15.0-1042.44\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1048-aws\", ver:\"4.15.0-1048.50~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1057-azure\", ver:\"4.15.0-1057.62\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-62-generic\", ver:\"4.15.0-62.69~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-62-generic-lpae\", ver:\"4.15.0-62.69~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-62-lowlatency\", ver:\"4.15.0-62.69~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-aws-hwe\", ver:\"4.15.0.1048.48\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-azure\", ver:\"4.15.0.1057.60\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gcp\", ver:\"4.15.0.1042.56\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic-hwe-16.04\", ver:\"4.15.0.62.82\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic-lpae-hwe-16.04\", ver:\"4.15.0.62.82\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gke\", ver:\"4.15.0.1042.56\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-lowlatency-hwe-16.04\", ver:\"4.15.0.62.82\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-oem\", ver:\"4.15.0.62.82\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-oracle\", ver:\"4.15.0.1023.17\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-virtual-hwe-16.04\", ver:\"4.15.0.62.82\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-03-30T16:58:49", "description": "The remote host is missing an update for the Huawei EulerOS\n ", "cvss3": {}, "published": "2020-03-12T00:00:00", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2020-1186)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-15219", "CVE-2019-15218", "CVE-2019-3900", "CVE-2019-15538", "CVE-2013-2206", "CVE-2019-15807", "CVE-2019-15666", "CVE-2019-15211", "CVE-2019-12378", "CVE-2019-15118", "CVE-2019-12380", "CVE-2019-13272", "CVE-2019-12455", "CVE-2019-13631", "CVE-2019-15220", "CVE-2019-15920", "CVE-2019-12381", "CVE-2019-11810", "CVE-2019-11833", "CVE-2019-12456", "CVE-2019-11599", "CVE-2019-18805", "CVE-2019-9455", "CVE-2019-8956", "CVE-2019-15221", "CVE-2019-12614", "CVE-2019-3701", "CVE-2019-15292", "CVE-2019-11487", "CVE-2019-11486", "CVE-2019-11811", "CVE-2019-11815", "CVE-2019-15214", "CVE-2019-12382", "CVE-2019-15925", "CVE-2018-16880", "CVE-2019-3846", "CVE-2013-6282", "CVE-2019-5489", "CVE-2019-15919", "CVE-2012-3400", "CVE-2019-13233", "CVE-2019-12615", "CVE-2019-3819", "CVE-2019-3882", "CVE-2013-2164", "CVE-2019-16413", "CVE-2018-20836", "CVE-2019-15917", "CVE-2019-14283"], "modified": "2020-03-26T00:00:00", "id": "OPENVAS:1361412562311220201186", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220201186", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2020.1186\");\n script_version(\"2020-03-26T11:51:34+0000\");\n script_cve_id(\"CVE-2012-3400\", \"CVE-2013-2164\", \"CVE-2013-2206\", \"CVE-2013-6282\", \"CVE-2018-16880\", \"CVE-2018-20836\", \"CVE-2019-11486\", \"CVE-2019-11487\", \"CVE-2019-11599\", \"CVE-2019-11810\", \"CVE-2019-11811\", \"CVE-2019-11815\", \"CVE-2019-11833\", \"CVE-2019-12378\", \"CVE-2019-12380\", \"CVE-2019-12381\", \"CVE-2019-12382\", \"CVE-2019-12455\", \"CVE-2019-12456\", \"CVE-2019-12614\", \"CVE-2019-12615\", \"CVE-2019-13233\", \"CVE-2019-13272\", \"CVE-2019-13631\", \"CVE-2019-14283\", \"CVE-2019-15118\", \"CVE-2019-15211\", \"CVE-2019-15214\", \"CVE-2019-15218\", \"CVE-2019-15219\", \"CVE-2019-15220\", \"CVE-2019-15221\", \"CVE-2019-15292\", \"CVE-2019-15538\", \"CVE-2019-15666\", \"CVE-2019-15807\", \"CVE-2019-15917\", \"CVE-2019-15919\", \"CVE-2019-15920\", \"CVE-2019-15925\", \"CVE-2019-16413\", \"CVE-2019-18805\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-3846\", \"CVE-2019-3882\", \"CVE-2019-3900\", \"CVE-2019-5489\", \"CVE-2019-8956\", \"CVE-2019-9455\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-03-26 11:51:34 +0000 (Thu, 26 Mar 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-03-12 10:47:45 +0000 (Thu, 12 Mar 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2020-1186)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP8\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2020-1186\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1186\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'kernel' package(s) announced via the EulerOS-SA-2020-1186 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.(CVE-2012-3400)\n\nThe mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning CD-ROM drive.(CVE-2013-2164)\n\nThe sctp_sf_do_5_2_4_dupcook function in net/sctp/sm_statefuns.c in the SCTP implementation in the Linux kernel before 3.8.5 does not properly handle associations during the processing of a duplicate COOKIE ECHO chunk, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted SCTP traffic.(CVE-2013-2206)\n\nThe (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.(CVE-2013-6282)\n\nAn issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free.(CVE-2018-20836)\n\nThe Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions.(CVE-2019-11486)\n\nThe Linux kernel before 5.1-rc5 allows page-_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests.(CVE-2019-11487)\n\nThe coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.(CVE-2019-11599)\n\nAn issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Huawei EulerOS V2.0SP8.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP8\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"bpftool\", rpm:\"bpftool~4.19.36~vhulk1907.1.0.h361.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~4.19.36~vhulk1907.1.0.h361.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~4.19.36~vhulk1907.1.0.h361.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~4.19.36~vhulk1907.1.0.h361.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-source\", rpm:\"kernel-source~4.19.36~vhulk1907.1.0.h361.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~4.19.36~vhulk1907.1.0.h361.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs\", rpm:\"kernel-tools-libs~4.19.36~vhulk1907.1.0.h361.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"perf\", rpm:\"perf~4.19.36~vhulk1907.1.0.h361.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python-perf\", rpm:\"python-perf~4.19.36~vhulk1907.1.0.h361.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python3-perf\", rpm:\"python3-perf~4.19.36~vhulk1907.1.0.h361.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-09-06T18:52:42", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-09-03T00:00:00", "type": "openvas", "title": "Ubuntu Update for linux-aws USN-4118-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-14609", "CVE-2019-14763", "CVE-2019-15218", "CVE-2018-13053", "CVE-2019-15090", "CVE-2019-3900", "CVE-2018-14610", "CVE-2018-13096", "CVE-2019-0136", "CVE-2018-13098", "CVE-2019-14284", "CVE-2019-12984", "CVE-2019-10639", "CVE-2018-20784", "CVE-2019-15216", "CVE-2018-13100", "CVE-2019-15211", "CVE-2018-14615", "CVE-2019-12819", "CVE-2018-13093", "CVE-2019-11085", "CVE-2018-13099", "CVE-2019-13272", "CVE-2019-9506", "CVE-2019-15215", "CVE-2019-13631", "CVE-2018-16862", "CVE-2019-11884", "CVE-2019-10207", "CVE-2019-15220", "CVE-2019-11810", "CVE-2019-11833", "CVE-2019-15212", "CVE-2019-11599", "CVE-2019-15221", "CVE-2018-14614", "CVE-2019-10638", "CVE-2018-14617", "CVE-2018-20856", "CVE-2019-12818", "CVE-2019-3701", "CVE-2019-15292", "CVE-2019-11487", "CVE-2018-14612", "CVE-2019-2024", "CVE-2019-11815", "CVE-2018-14611", "CVE-2018-13097", "CVE-2019-15214", "CVE-2019-3846", "CVE-2018-20169", "CVE-2018-5383", "CVE-2019-2101", "CVE-2019-10126", "CVE-2019-13233", "CVE-2019-3819", "CVE-2018-19985", "CVE-2018-14616", "CVE-2018-20511", "CVE-2018-14613", "CVE-2019-14283"], "modified": "2019-09-05T00:00:00", "id": "OPENVAS:1361412562310844159", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844159", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844159\");\n script_version(\"2019-09-05T09:53:24+0000\");\n script_cve_id(\"CVE-2018-13053\", \"CVE-2018-13093\", \"CVE-2018-13096\", \"CVE-2018-13097\", \"CVE-2018-13098\", \"CVE-2018-13099\", \"CVE-2018-13100\", \"CVE-2018-14614\", \"CVE-2018-14615\", \"CVE-2018-14616\", \"CVE-2018-14609\", \"CVE-2018-14610\", \"CVE-2018-14611\", \"CVE-2018-14612\", \"CVE-2018-14613\", \"CVE-2018-14617\", \"CVE-2018-16862\", \"CVE-2018-19985\", \"CVE-2018-20169\", \"CVE-2018-20784\", \"CVE-2018-20856\", \"CVE-2018-5383\", \"CVE-2019-0136\", \"CVE-2019-10126\", \"CVE-2019-10207\", \"CVE-2019-10638\", \"CVE-2019-10639\", \"CVE-2019-11085\", \"CVE-2019-11487\", \"CVE-2019-11599\", \"CVE-2019-11810\", \"CVE-2019-11815\", \"CVE-2019-11833\", \"CVE-2019-11884\", \"CVE-2019-12818\", \"CVE-2019-12819\", \"CVE-2019-12984\", \"CVE-2019-13233\", \"CVE-2019-13272\", \"CVE-2019-13631\", \"CVE-2019-14283\", \"CVE-2019-14284\", \"CVE-2019-14763\", \"CVE-2019-15090\", \"CVE-2019-15211\", \"CVE-2019-15212\", \"CVE-2019-15214\", \"CVE-2019-15215\", \"CVE-2019-15220\", \"CVE-2019-15292\", \"CVE-2019-2024\", \"CVE-2019-2101\", \"CVE-2019-3846\", \"CVE-2019-3900\", \"CVE-2019-9506\", \"CVE-2018-20511\", \"CVE-2019-15216\", \"CVE-2019-15218\", \"CVE-2019-15221\", \"CVE-2019-3701\", \"CVE-2019-3819\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-09-05 09:53:24 +0000 (Thu, 05 Sep 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-09-03 02:02:11 +0000 (Tue, 03 Sep 2019)\");\n script_name(\"Ubuntu Update for linux-aws USN-4118-1\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=(UBUNTU18\\.04 LTS|UBUNTU16\\.04 LTS)\");\n\n script_xref(name:\"USN\", value:\"4118-1\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2019-September/005096.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux-aws'\n package(s) announced via the USN-4118-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was discovered that the alarmtimer implementation in the Linux kernel\ncontained an integer overflow vulnerability. A local attacker could use\nthis to cause a denial of service. (CVE-2018-13053)\n\nWen Xu discovered that the XFS filesystem implementation in the Linux\nkernel did not properly track inode validations. An attacker could use this\nto construct a malicious XFS image that, when mounted, could cause a denial\nof service (system crash). (CVE-2018-13093)\n\nWen Xu discovered that the f2fs file system implementation in the Linux\nkernel did not properly validate metadata. An attacker could use this to\nconstruct a malicious f2fs image that, when mounted, could cause a denial\nof service (system crash). (CVE-2018-13096, CVE-2018-13097, CVE-2018-13098,\nCVE-2018-13099, CVE-2018-13100, CVE-2018-14614, CVE-2018-14615,\nCVE-2018-14616)\n\nWen Xu and Po-Ning Tseng discovered that btrfs file system implementation\nin the Linux kernel did not properly validate metadata. An attacker could\nuse this to construct a malicious btrfs image that, when mounted, could\ncause a denial of service (system crash). (CVE-2018-14609, CVE-2018-14610,\nCVE-2018-14611, CVE-2018-14612, CVE-2018-14613)\n\nWen Xu discovered that the HFS+ filesystem implementation in the Linux\nkernel did not properly handle malformed catalog data in some situations.\nAn attacker could use this to construct a malicious HFS+ image that, when\nmounted, could cause a denial of service (system crash). (CVE-2018-14617)\n\nVasily Averin and Pavel Tikhomirov discovered that the cleancache subsystem\nof the Linux kernel did not properly initialize new files in some\nsituations. A local attacker could use this to expose sensitive\ninformation. (CVE-2018-16862)\n\nHui Peng and Mathias Payer discovered that the Option USB High Speed driver\nin the Linux kernel did not properly validate metadata received from the\ndevice. A physically proximate attacker could use this to cause a denial of\nservice (system crash). (CVE-2018-19985)\n\nHui Peng and Mathias Payer discovered that the USB subsystem in the Linux\nkernel did not properly handle size checks when handling an extra USB\ndescriptor. A physically proximate attacker could use this to cause a\ndenial of service (system crash). (CVE-2018-20169)\n\nZhipeng Xie discovered that an infinite loop could triggered in the CFS\nLinux kernel process scheduler. A local attacker could possibly use this to\ncause a denial of service. (CVE-2018-20784)\n\nIt was discovered that a use-after-free error existed in the block layer\nsubsystem of the Linux kernel when certain failure conditions occurred. A\nlocal attacker could possi ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux-aws' package(s) on Ubuntu 18.04 LTS, Ubuntu 16.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU18.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1047-aws\", ver:\"4.15.0-1047.49\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-aws\", ver:\"4.15.0.1047.46\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU16.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1047-aws\", ver:\"4.15.0-1047.49~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-aws-hwe\", ver:\"4.15.0.1047.47\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2022-08-11T15:22:59", "description": "The openSUSE Leap 15.0 was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes.\n bnc#1129179).\n\n - CVE-2019-3819: A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable (bnc#1123161).\n\n - CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).\n\n - CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).\n\n - CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).\n\n - CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).\n\nThe following non-security bugs were fixed :\n\n - 9p/net: fix memory leak in p9_client_create (bsc#1051510).\n\n - 9p: use inode->i_lock to protect i_size_write() under 32-bit (bsc#1051510).\n\n - acpi: acpi_pad: Do not launch acpi_pad threads on idle cpus (bsc#1113399).\n\n - acpi/APEI: Clear GHES block_status before panic() (bsc#1051510).\n\n - acpi/device_sysfs: Avoid OF modalias creation for removed device (bsc#1051510).\n\n - acpi/nfit: Fix bus command validation (bsc#1051510).\n\n - acpi: NUMA: Use correct type for printing addresses on i386-PAE (bsc#1051510).\n\n - acpi / video: Extend chassis-type detection with a 'Lunch Box' check (bsc#1051510).\n\n - acpi / video: Refactor and fix dmi_is_desktop() (bsc#1051510).\n\n - alsa: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56 (bsc#1051510).\n\n - alsa: compress: prevent potential divide by zero bugs (bsc#1051510).\n\n - alsa: echoaudio: add a check for ioremap_nocache (bsc#1051510).\n\n - alsa: firewire: add const qualifier to identifiers for read-only symbols (bsc#1051510).\n\n - alsa: firewire-motu: add a flag for AES/EBU on XLR interface (bsc#1051510).\n\n - alsa: firewire-motu: add specification flag for position of flag for MIDI messages (bsc#1051510).\n\n - alsa: firewire-motu: add support for MOTU Audio Express (bsc#1051510).\n\n - alsa: firewire-motu: add support for Motu Traveler (bsc#1051510).\n\n - alsa: firewire-motu: fix construction of PCM frame for capture direction (bsc#1051510).\n\n - alsa: firewire-motu: use 'version' field of unit directory to identify model (bsc#1051510).\n\n - alsa: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist (bsc#1051510).\n\n - alsa: hda - Add quirk for HP EliteBook 840 G5 (bsc#1051510).\n\n - alsa: hda - Enforces runtime_resume after S3 and S4 for each codec (bsc#1051510).\n\n - alsa: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic (bsc#1051510).\n\n - alsa: hda/realtek: Disable PC beep in passthrough on alc285 (bsc#1051510).\n\n - alsa: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256 (bsc#1051510).\n\n - alsa: hda/realtek: Enable audio jacks of ASUS UX362FA with ALC294 (bsc#1051510).\n\n - alsa: hda/realtek: Enable headset MIC of Acer AIO with ALC286 (bsc#1051510).\n\n - alsa: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with ALC286 (bsc#1051510).\n\n - alsa: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256 (bsc#1051510).\n\n - alsa: hda/realtek - Headset microphone and internal speaker support for System76 oryp5 (bsc#1051510).\n\n - alsa: hda/realtek - Headset microphone support for System76 darp5 (bsc#1051510).\n\n - alsa: hda/realtek - Reduce click noise on Dell Precision 5820 headphone (bsc#1126131).\n\n - alsa: hda - Record the current power state before suspend/resume calls (bsc#1051510).\n\n - alsa: opl3: fix mismatch between snd_opl3_drum_switch definition and declaration (bsc#1051510).\n\n - alsa: pcm: Do not suspend stream in unrecoverable PCM state (bsc#1051510).\n\n - alsa: pcm: Fix possible OOB access in PCM oss plugins (bsc#1051510).\n\n - alsa: rawmidi: Fix potential Spectre v1 vulnerability (bsc#1051510).\n\n - alsa: sb8: add a check for request_region (bsc#1051510).\n\n - alsa: seq: oss: Fix Spectre v1 vulnerability (bsc#1051510).\n\n - alsa: usb-audio: Fix implicit fb endpoint setup by quirk (bsc#1051510).\n\n - altera-stapl: check for a null key before strcasecmp'ing it (bsc#1051510).\n\n - apparmor: Fix aa_label_build() error handling for failed merges (bsc#1051510).\n\n - applicom: Fix potential Spectre v1 vulnerabilities (bsc#1051510).\n\n - aquantia: Setup max_mtu in ndev to enable jumbo frames (bsc#1051510).\n\n - arm64: fault: avoid send SIGBUS two times (bsc#1126393).\n\n - arm: 8808/1: kexec:offline panic_smp_self_stop CPU (bsc#1051510).\n\n - arm/arm64: KVM: Rename function kvm_arch_dev_ioctl_check_extension() (bsc#1126393).\n\n - arm: iop32x/n2100: fix PCI IRQ mapping (bsc#1051510).\n\n - arm: OMAP2+: hwmod: Fix some section annotations (bsc#1051510).\n\n - arm: pxa: avoid section mismatch warning (bsc#1051510).\n\n - arm: tango: Improve ARCH_MULTIPLATFORM compatibility (bsc#1051510).\n\n - ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages (bsc#1051510).\n\n - ASoC: dapm: change snprintf to scnprintf for possible overflow (bsc#1051510).\n\n - ASoC: fsl_esai: fix register setting issue in RIGHT_J mode (bsc#1051510).\n\n - ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M (bsc#1051510).\n\n - ASoC: imx-audmux: change snprintf to scnprintf for possible overflow (bsc#1051510).\n\n - ASoC: imx-sgtl5000: put of nodes if finding codec fails (bsc#1051510).\n\n - ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field (bsc#1051510).\n\n - ASoC: msm8916-wcd-analog: add missing license information (bsc#1051510).\n\n - ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of() (bsc#1051510).\n\n - ASoC: rsnd: fixup rsnd_ssi_master_clk_start() user count check (bsc#1051510).\n\n - assoc_array: Fix shortcut creation (bsc#1051510).\n\n - ata: ahci: mvebu: remove stale comment (bsc#1051510).\n\n - ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom (bsc#1051510).\n\n - ath9k: dynack: check da->enabled first in sampling routines (bsc#1051510).\n\n - ath9k: dynack: make ewma estimation faster (bsc#1051510).\n\n - ath9k: dynack: use authentication messages for 'late' ack (bsc#1051510).\n\n - atm: he: fix sign-extension overflow on large shift (bsc#1051510).\n\n - auxdisplay: hd44780: Fix memory leak on ->remove() (bsc#1051510).\n\n - auxdisplay: ht16k33: fix potential user-after-free on module unload (bsc#1051510).\n\n - ax25: fix possible use-after-free (bsc#1051510).\n\n - backlight: pwm_bl: Use gpiod_get_value_cansleep() to get initial (bsc#1113722)\n\n - batman-adv: Avoid WARN on net_device without parent in netns (bsc#1051510).\n\n - batman-adv: fix uninit-value in batadv_interface_tx() (bsc#1051510).\n\n - batman-adv: Force mac header to start of data on xmit (bsc#1051510).\n\n - bio: Introduce BIO_ALLOCED flag and check it in bio_free (bsc#1128094).\n\n - blk-mq: fix a hung issue when fsync (bsc#1125252).\n\n - block_dev: fix crash on chained bios with O_DIRECT (bsc#1128094).\n\n - block_dev: fix crash on chained bios with O_DIRECT (bsc#1128094).\n\n - blockdev: Fix livelocks on loop device (bsc#1124984).\n\n - block: do not use bio->bi_vcnt to figure out segment number (bsc#1128895).\n\n - block: do not warn when doing fsync on read-only devices (bsc#1125252).\n\n - block/loop: Use global lock for ioctl() operation (bsc#1124974).\n\n - block: move bio_integrity_(intervals,bytes) into blkdev.h (bsc#1114585).\n\n - bluetooth: Fix decrementing reference count twice in releasing socket (bsc#1051510).\n\n - bluetooth: Fix locking in bt_accept_enqueue() for BH context (bsc#1051510).\n\n - bluetooth: Fix unnecessary error message for HCI request completion (bsc#1051510).\n\n - bluetooth: hci_ldisc: Initialize hci_dev before open() (bsc#1051510).\n\n - bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto() (bsc#1051510).\n\n - bnxt_en: Fix typo in firmware message timeout logic (bsc#1086282 ).\n\n - bnxt_en: Wait longer for the firmware message response to complete (bsc#1086282).\n\n - bpf: decrease usercnt if bpf_map_new_fd() fails in bpf_map_get_fd_by_id() (bsc#1083647).\n\n - bpf: drop refcount if bpf_map_new_fd() fails in map_create() (bsc#1083647).\n\n - bpf: fix lockdep false positive in percpu_freelist (bsc#1083647).\n\n - bpf: fix replace_map_fd_with_map_ptr's ldimm64 second imm field (bsc#1083647).\n\n - bpf: fix sanitation rewrite in case of non-pointers (bsc#1083647).\n\n - bpf: Fix syscall's stackmap lookup potential deadlock (bsc#1083647).\n\n - bpf, lpm: fix lookup bug in map_delete_elem (bsc#1083647).\n\n - bpf/verifier: fix verifier instability (bsc#1056787).\n\n - bsg: Do not copy sense if no response buffer is allocated (bsc#1106811,bsc#1126555).\n\n - btrfs: dedupe_file_range ioctl: remove 16MiB restriction (bsc#1127494).\n\n - btrfs: do not unnecessarily pass write_lock_level when processing leaf (bsc#1126802).\n\n - btrfs: ensure that a DUP or RAID1 block group has exactly two stripes (bsc#1128451).\n\n - btrfs: fix clone vs chattr NODATASUM race (bsc#1127497).\n\n - btrfs: fix corruption reading shared and compressed extents after hole punching (bsc#1126476).\n\n - btrfs: fix deadlock between clone/dedupe and rename (bsc#1130518).\n\n - btrfs: fix deadlock when allocating tree block during leaf/node split (bsc#1126806).\n\n - btrfs: fix deadlock when using free space tree due to block group creation (bsc#1126804).\n\n - btrfs: fix fsync after succession of renames and unlink/rmdir (bsc#1126488).\n\n - btrfs: fix fsync after succession of renames of different files (bsc#1126481).\n\n - btrfs: fix invalid-free in btrfs_extent_same (bsc#1127498).\n\n - btrfs: fix reading stale metadata blocks after degraded raid1 mounts (bsc#1126803).\n\n - btrfs: fix use-after-free of cmp workspace pages (bsc#1127603).\n\n - btrfs: grab write lock directly if write_lock_level is the max level (bsc#1126802).\n\n - btrfs: Improve btrfs_search_slot description (bsc#1126802).\n\n - btrfs: move get root out of btrfs_search_slot to a helper (bsc#1126802).\n\n - btrfs: qgroup: Cleanup old subtree swap code (bsc#1063638).\n\n - btrfs: qgroup: Do not trace subtree if we're dropping reloc tree (bsc#1063638).\n\n - btrfs: qgroup: Finish rescan when hit the last leaf of extent tree (bsc#1129327).\n\n - btrfs: qgroup: Introduce function to find all new tree blocks of reloc tree (bsc#1063638).\n\n - btrfs: qgroup: Introduce function to trace two swaped extents (bsc#1063638).\n\n - btrfs: qgroup: Introduce per-root swapped blocks infrastructure (bsc#1063638).\n\n - btrfs: qgroup: Introduce trace event to analyse the number of dirty extents accounted (bsc#1063638 dependency).\n\n - btrfs: qgroup: Make qgroup async transaction commit more aggressive (bsc#1113042).\n\n - btrfs: qgroup: Only trace data extents in leaves if we're relocating data block group (bsc#1063638).\n\n - btrfs: qgroup: Refactor btrfs_qgroup_trace_subtree_swap (bsc#1063638).\n\n - btrfs: qgroup: Search commit root for rescan to avoid missing extent (bsc#1129326).\n\n - btrfs: qgroup: Use delayed subtree rescan for balance (bsc#1063638).\n\n - btrfs: qgroup: Use generation-aware subtree swap to mark dirty extents (bsc#1063638).\n\n - btrfs: quota: Set rescan progress to (u64)-1 if we hit last leaf (bsc#1129327).\n\n - btrfs: relocation: Delay reloc tree deletion after merge_reloc_roots (bsc#1063638).\n\n - btrfs: reloc: Fix NULL pointer dereference due to expanded reloc_root lifespan (bsc#1129497).\n\n - btrfs: remove always true check in unlock_up (bsc#1126802).\n\n - btrfs: remove superfluous free_extent_buffer in read_block_for_search (bsc#1126802).\n\n - btrfs: remove unnecessary level check in balance_level (bsc#1126802).\n\n - btrfs: remove unused check of skip_locking (bsc#1126802).\n\n - btrfs: reuse cmp workspace in EXTENT_SAME ioctl (bsc#1127495).\n\n - btrfs: send, fix race with transaction commits that create snapshots (bsc#1126802).\n\n - btrfs: simplify IS_ERR/PTR_ERR checks (bsc#1126481).\n\n - btrfs: split btrfs_extent_same (bsc#1127493).\n\n - btrfs: use kvzalloc for EXTENT_SAME temporary data (bsc#1127496).\n\n - btrfs: use more straightforward extent_buffer_uptodate check (bsc#1126802).\n\n - cdc-wdm: pass return value of recover_from_urb_loss (bsc#1051510).\n\n - ceph: avoid repeatedly adding inode to mdsc->snap_flush_list (bsc#1126790).\n\n - ceph: clear inode pointer when snap realm gets dropped by its inode (bsc#1125799).\n\n - cfg80211: extend range deviation for DMG (bsc#1051510).\n\n - ch: add missing mutex_lock()/mutex_unlock() in ch_release() (bsc#1124235).\n\n - ch: fixup refcounting imbalance for SCSI devices (bsc#1124235).\n\n - cifs: allow guest mounts to work for smb3.11 (bsc#1051510).\n\n - cifs: Always resolve hostname before reconnecting (bsc#1051510).\n\n - cifs: connect to servername instead of IP for IPC$ share (bsc#1051510).\n\n - cifs: Fix NULL pointer dereference of devname (bnc#1129519).\n\n - cifs: invalidate cache when we truncate a file (bsc#1051510).\n\n - cifs: OFD locks do not conflict with eachothers (bsc#1051510).\n\n - clk: armada-370: fix refcount leak in a370_clk_init() (bsc#1051510).\n\n - clk: armada-xp: fix refcount leak in axp_clk_init() (bsc#1051510).\n\n - clk: clk-twl6040: Fix imprecise external abort for pdmclk (bsc#1051510).\n\n - clk: dove: fix refcount leak in dove_clk_init() (bsc#1051510).\n\n - clk: highbank: fix refcount leak in hb_clk_init() (bsc#1051510).\n\n - clk: imx6q: fix refcount leak in imx6q_clocks_init() (bsc#1051510).\n\n - clk: imx6sl: ensure MMDC CH0 handshake is bypassed (bsc#1051510).\n\n - clk: imx6sx: fix refcount leak in imx6sx_clocks_init() (bsc#1051510).\n\n - clk: imx7d: fix refcount leak in imx7d_clocks_init() (bsc#1051510).\n\n - clk: ingenic: Fix doc of ingenic_cgu_div_info (bsc#1051510).\n\n - clk: ingenic: Fix round_rate misbehaving with non-integer dividers (bsc#1051510).\n\n - clk: kirkwood: fix refcount leak in kirkwood_clk_init() (bsc#1051510).\n\n - clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init() (bsc#1051510).\n\n - clk: qoriq: fix refcount leak in clockgen_init() (bsc#1051510).\n\n - clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() (bsc#1051510).\n\n - clk: socfpga: fix refcount leak (bsc#1051510).\n\n - clk: sunxi: A31: Fix wrong AHB gate number (bsc#1051510).\n\n - clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks (bsc#1051510).\n\n - clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it (bsc#1051510).\n\n - clk: sunxi-ng: v3s: Fix TCON reset de-assert bit (bsc#1051510).\n\n - clk: uniphier: Fix update register for CPU-gear (bsc#1051510).\n\n - clk: vc5: Abort clock configuration without upstream clock (bsc#1051510).\n\n - clk: vf610: fix refcount leak in vf610_clocks_init() (bsc#1051510).\n\n - clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown (bsc#1051510).\n\n - clocksource/drivers/exynos_mct: Fix error path in timer resources initialization (bsc#1051510).\n\n - clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR (bsc#1051510).\n\n - clocksource/drivers/integrator-ap: Add missing of_node_put() (bsc#1051510).\n\n - clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable (bsc#1051510).\n\n - configfs: fix registered group removal (bsc#1051510).\n\n - copy_mount_string: Limit string length to PATH_MAX (bsc#1082943).\n\n - cpcap-charger: generate events for userspace (bsc#1051510).\n\n - cpufreq: Cap the default transition delay value to 10 ms (bsc#1127042).\n\n - cpufreq: conservative: Take limits changes into account properly (bsc#1051510).\n\n - cpufreq: governor: Avoid accessing invalid governor_data (bsc#1051510).\n\n - cpufreq: governor: Drop min_sampling_rate (bsc#1127042).\n\n - cpufreq: governor: Ensure sufficiently large sampling intervals (bsc#1127042).\n\n - cpufreq: pxa2xx: remove incorrect __init annotation (bsc#1051510).\n\n - cpufreq: tegra124: add missing of_node_put() (bsc#1051510).\n\n - cpufreq: Use transition_delay_us for legacy governors as well (bsc#1127042).\n\n - cpuidle: big.LITTLE: fix refcount leak (bsc#1051510).\n\n - crypto: aes_ti - disable interrupts while accessing S-box (bsc#1051510).\n\n - crypto: ahash - fix another early termination in hash walk (bsc#1051510).\n\n - crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling (bsc#1051510).\n\n - crypto: arm/crct10dif - revert to C code for short inputs (bsc#1051510).\n\n - crypto: brcm - Fix some set-but-not-used warning (bsc#1051510).\n\n - crypto: caam - fixed handling of sg list (bsc#1051510).\n\n - crypto: cavium/zip - fix collision with generic cra_driver_name (bsc#1051510).\n\n - crypto: crypto4xx - add missing of_node_put after of_device_is_available (bsc#1051510).\n\n - crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments (bsc#1051510).\n\n - crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails (bsc#1051510).\n\n - crypto: testmgr - skip crc32c context test for ahash algorithms (bsc#1051510).\n\n - crypto: tgr192 - fix unaligned memory access (bsc#1051510).\n\n - crypto: ux500 - Use proper enum in cryp_set_dma_transfer (bsc#1051510).\n\n - crypto: ux500 - Use proper enum in hash_set_dma_transfer (bsc#1051510).\n\n - cw1200: drop useless LIST_HEAD (bsc#1051510).\n\n - cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan() (bsc#1051510).\n\n - cw1200: fix missing unlock on error in cw1200_hw_scan() (bsc#1051510).\n\n - dccp: fool proof ccid_hc_[rt]x_parse_options() (bsc#1051510).\n\n - debugfs: fix debugfs_rename parameter checking (bsc#1051510).\n\n - device property: Fix the length used in PROPERTY_ENTRY_STRING() (bsc#1051510).\n\n - dlm: Do not swamp the CPU with callbacks queued during recovery (bsc#1051510).\n\n - dmaengine: at_hdmac: drop useless LIST_HEAD (bsc#1051510).\n\n - dmaengine: at_xdmac: Fix wrongfull report of a channel as in use (bsc#1051510).\n\n - dmaengine: bcm2835: Fix abort of transactions (bsc#1051510).\n\n - dmaengine: bcm2835: Fix interrupt race on RT (bsc#1051510).\n\n - dmaengine: dmatest: Abort test in case of mapping error (bsc#1051510).\n\n - dmaengine: dw: drop useless LIST_HEAD (bsc#1051510).\n\n - dmaengine: imx-dma: fix wrong callback invoke (bsc#1051510).\n\n - dmaengine: mv_xor: Use correct device for DMA API (bsc#1051510).\n\n - dmaengine: pl330: drop useless LIST_HEAD (bsc#1051510).\n\n - dmaengine: sa11x0: drop useless LIST_HEAD (bsc#1051510).\n\n - dmaengine: st_fdma: drop useless LIST_HEAD (bsc#1051510).\n\n - dmaengine: stm32-dma: fix incomplete configuration in cyclic mode (bsc#1051510).\n\n - dma: Introduce dma_max_mapping_size() (bsc#1120008).\n\n - doc: rcu: Suspicious RCU usage is a warning (bsc#1051510).\n\n - Do not log confusing message on reconnect by default (bsc#1129664).\n\n - driver core: Do not resume suppliers under device_links_write_lock() (bsc#1051510).\n\n - drivers: hv: vmbus: Check for ring when getting debug info (bsc#1126389, bsc#1126579).\n\n - drivers: hv: vmbus: preserve hv_ringbuffer_get_debuginfo kABI (bsc#1126389, bsc#1126579).\n\n - drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels (bsc#1126389, bsc#1126579).\n\n - drm/amdgpu: Add delay after enable RLC ucode (bsc#1051510).\n\n - drm/ast: Fix connector leak during driver unload (bsc#1051510).\n\n - drm/ast: fixed reading monitor EDID not stable issue (bsc#1051510).\n\n - drm/atomic-helper: Complete fake_commit->flip_done potentially earlier (bsc#1051510).\n\n - drm: Block fb changes for async plane updates (bsc#1051510).\n\n - drm/bridge: tc358767: add defines for DP1_SRCCTRL & PHY_2LANE (bsc#1051510).\n\n - drm/bridge: tc358767: fix initial DP0/1_SRCCTRL value (bsc#1051510).\n\n - drm/bridge: tc358767: fix output H/V syncs (bsc#1051510).\n\n - drm/bridge: tc358767: fix single lane configuration (bsc#1051510).\n\n - drm/bridge: tc358767: reject modes which require too much BW (bsc#1051510).\n\n - drm/bufs: Fix Spectre v1 vulnerability (bsc#1051510).\n\n - drm: Clear state->acquire_ctx before leaving drm_atomic_helper_commit_duplicated_state() (bsc#1051510).\n\n - drm: disable uncached DMA optimization for ARM and arm64 (bsc#1051510).\n\n - drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump() (bsc#1113722)\n\n - drm/etnaviv: potential NULL dereference (bsc#1113722)\n\n - drm: Fix error handling in drm_legacy_addctx (bsc#1113722)\n\n - drm/i915/bios: assume eDP is present on port A when there is no VBT (bsc#1051510).\n\n - drm/i915: Block fbdev HPD processing during suspend (bsc#1113722)\n\n - drm/i915/fbdev: Actually configure untiled displays (bsc#1113722)\n\n - drm/i915: Flush GPU relocs harder for gen3 (bsc#1113722)\n\n - drm/i915/gvt: free VFIO region space in vgpu detach (bsc#1113722)\n\n - drm/i915/gvt: release shadow batch buffer and wa_ctx before destroy one workload (bsc#1051510).\n\n - drm/i915/opregion: fix version check (bsc#1113722)\n\n - drm/i915/opregion: rvda is relative from opregion base in opregion (bsc#1113722)\n\n - drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set (bsc#1113722)\n\n - drm/i915: Redefine some Whiskey Lake SKUs (bsc#1051510).\n\n - drm/i915: Relax mmap VMA check (bsc#1051510).\n\n - drm/i915: Use the correct crtc when sanitizing plane mapping (bsc#1113722)\n\n - drm/imx: ignore plane updates on disabled crtcs (bsc#1051510).\n\n - drm/imx: imx-ldb: add missing of_node_puts (bsc#1051510).\n\n - drm/meson: add missing of_node_put (bsc#1051510).\n\n - drm/modes: Prevent division by zero htotal (bsc#1051510).\n\n - drm/msm: Fix error return checking (bsc#1051510).\n\n - drm/msm: Grab a vblank reference when waiting for commit_done (bsc#1051510).\n\n - drm/msm: Unblock writer if reader closes file (bsc#1051510).\n\n - drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON (bsc#1113722)\n\n - drm/nouveau/debugfs: Fix check of pm_runtime_get_sync failure (bsc#1051510).\n\n - drm/nouveau: Do not spew kernel WARNING for each timeout (bsc#1126480).\n\n - drm/nouveau: Do not WARN_ON VCPI allocation failures (bsc#1113722)\n\n - drm/nouveau/falcon: avoid touching registers if engine is off (bsc#1051510).\n\n - drm/nouveau/pmu: do not print reply values if exec is false (bsc#1113722)\n\n - drm/radeon/evergreen_cs: fix missing break in switch statement (bsc#1113722)\n\n - drm: Reorder set_property_atomic to avoid returning with an active ww_ctx (bsc#1051510).\n\n - drm/rockchip: fix for mailbox read size (bsc#1051510).\n\n - drm/shmob: Fix return value check in shmob_drm_probe (bsc#1113722)\n\n - drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init (bsc#1051510).\n\n - drm/vmwgfx: Do not double-free the mode stored in par->set_mode (bsc#1103429)\n\n - earlycon: Initialize port->uartclk based on clock-frequency property (bsc#1051510).\n\n - earlycon: Remove hardcoded port->uartclk initialization in of_setup_earlycon (bsc#1051510).\n\n - Enable CONFIG_RDMA_RXE=m also for ppc64le (bsc#1107665,)\n\n - Enable livepatch test drivers in lib/ Livepatch kselftests need those.\n\n - enic: fix build warning without CONFIG_CPUMASK_OFFSTACK (bsc#1051510).\n\n - enic: fix checksum validation for IPv6 (bsc#1051510).\n\n - esp6: fix memleak on error path in esp6_input (bsc#1051510).\n\n - esp: Fix locking on page fragment allocation (bsc#1051510).\n\n - esp: Fix memleaks on error paths (bsc#1051510).\n\n - esp: Fix skb tailroom calculation (bsc#1051510).\n\n - ext4: avoid kernel warning when writing the superblock to a dead device (bsc#1124981).\n\n - ext4: Avoid panic during forced reboot (bsc#1126356).\n\n - ext4: check for shutdown and r/o file system in ext4_write_inode() (bsc#1124978).\n\n - ext4: fix a potential fiemap/page fault deadlock w/ inline_data (bsc#1124980).\n\n - ext4: force inode writes when nfsd calls commit_metadata() (bsc#1125125).\n\n - ext4: include terminating u32 in size of xattr entries when expanding inodes (bsc#1124976).\n\n - ext4: make sure enough credits are reserved for dioread_nolock writes (bsc#1124979).\n\n - ext4: track writeback errors using the generic tracking infrastructure (bsc#1124982).\n\n - fbdev: chipsfb: remove set but not used variable 'size' (bsc#1113722)\n\n - firmware/efi: Add NULL pointer checks in efivars API functions (bsc#1051510).\n\n - floppy: check_events callback should not return a negative number (bsc#1051510).\n\n - fs/dax: deposit pagetable even when installing zero page (bsc#1126740).\n\n - fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb() (git-fixes).\n\n - fs/devpts: always delete dcache dentry-s in dput() (git-fixes).\n\n - fuse: call pipe_buf_release() under pipe lock (bsc#1051510).\n\n - fuse: continue to send FUSE_RELEASEDIR when FUSE_OPEN returns ENOSYS (bsc#1051510).\n\n - fuse: decrement NR_WRITEBACK_TEMP on the right page (bsc#1051510).\n\n - fuse: handle zero sized retrieve correctly (bsc#1051510).\n\n - futex: Fix (possible) missed wakeup (bsc#1050549).\n\n - gdrom: fix a memory leak bug (bsc#1051510).\n\n - geneve: cleanup hard coded value for Ethernet header length (bsc#1123456).\n\n - geneve: correctly handle ipv6.disable module parameter (bsc#1051510).\n\n - geneve, vxlan: Do not check skb_dst() twice (bsc#1123456).\n\n - geneve, vxlan: Do not set exceptions if skb->len < mtu (bsc#1123456).\n\n - genwqe: Fix size check (bsc#1051510).\n\n - gfs2: Revert 'Fix loop in gfs2_rbm_find' (bsc#1120601).\n\n - gianfar: fix a flooded alignment reports because of padding issue (bsc#1051510).\n\n - gianfar: Fix Rx byte accounting for ndev stats (bsc#1051510).\n\n - gianfar: prevent integer wrapping in the rx handler (bsc#1051510).\n\n - gpu: ipu-v3: Fix CSI offsets for imx53 (bsc#1113722)\n\n - gpu: ipu-v3: Fix i.MX51 CSI control registers offset (bsc#1113722)\n\n - gpu: ipu-v3: image-convert: Prevent race between run and unprepare (bsc#1051510).\n\n - gro_cells: make sure device is up in gro_cells_receive() (git-fixes).\n\n - hid: lenovo: Add checks to fix of_led_classdev_register (bsc#1051510).\n\n - hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable (git-fixes).\n\n - hvc_opal: do not set tb_ticks_per_usec in udbg_init_opal_common() (bsc#1051510).\n\n - hv: reduce storvsc_ringbuffer_size from 1M to 128K to simplify booting with 1k vcpus ().\n\n - hv: v4.12 API for hyperv-iommu (bsc#1122822).\n\n - hwmon: (lm80) fix a missing check of bus read in lm80 probe (bsc#1051510).\n\n - hwmon: (lm80) fix a missing check of the status of SMBus read (bsc#1051510).\n\n - hwmon: (lm80) Fix missing unlock on error in set_fan_div() (bsc#1051510).\n\n - hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID table (bsc#1051510).\n\n - HYPERV/IOMMU: Add Hyper-V stub IOMMU driver (bsc#1122822).\n\n - i2c-axxia: check for error conditions first (bsc#1051510).\n\n - i2c: bcm2835: Clear current buffer pointers and counts after a transfer (bsc#1051510).\n\n - i2c: cadence: Fix the hold bit setting (bsc#1051510).\n\n - i2c: omap: Use noirq system sleep pm ops to idle device for suspend (bsc#1051510).\n\n - i2c: sh_mobile: add support for r8a77990 (R-Car E3) (bsc#1051510).\n\n - i2c: tegra: fix maximum transfer size (bsc#1051510).\n\n - ib/core: Destroy QP if XRC QP fails (bsc#1046306).\n\n - ib/core: Fix potential memory leak while creating MAD agents (bsc#1046306).\n\n - ib/core: Unregister notifier before freeing MAD security (bsc#1046306).\n\n - ib/hfi1: Close race condition on user context disable and close (bsc#1060463).\n\n - ib/mlx5: Unmap DMA addr from HCA before IOMMU (bsc#1046305 ).\n\n - ibmvnic: Report actual backing device speed and duplex values (bsc#1129923).\n\n - ibmvscsi: Fix empty event pool access during host removal (bsc#1119019).\n\n - ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton (bsc#1119019).\n\n - ieee802154: ca8210: fix possible u8 overflow in ca8210_rx_done (bsc#1051510).\n\n - igb: Fix an issue that PME is not enabled during runtime suspend (bsc#1051510).\n\n - iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID (bsc#1051510).\n\n - iio: adc: exynos-adc: Fix NULL pointer exception on unbind (bsc#1051510).\n\n - iio: chemical: atlas-ph-sensor: correct IIO_TEMP values to millicelsius (bsc#1051510).\n\n - Input: bma150 - register input device after setting private data (bsc#1051510).\n\n - input: cap11xx - switch to using set_brightness_blocking() (bsc#1051510).\n\n - Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK (bsc#1051510).\n\n - Input: elan_i2c - add id for touchpad found in Lenovo s21e-20 (bsc#1051510).\n\n - Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 (bsc#1051510).\n\n - input: matrix_keypad - use flush_delayed_work() (bsc#1051510).\n\n - Input: raspberrypi-ts - select CONFIG_INPUT_POLLDEV (git-fixes).\n\n - input: st-keyscan - fix potential zalloc NULL dereference (bsc#1051510).\n\n - input: uinput - fix undefined behavior in uinput_validate_absinfo() (bsc#1120902).\n\n - Input: wacom_serial4 - add support for Wacom ArtPad II tablet (bsc#1051510).\n\n - intel_th: Do not reference unassigned outputs (bsc#1051510).\n\n - intel_th: gth: Fix an off-by-one in output unassigning (bsc#1051510).\n\n - iomap: fix integer truncation issues in the zeroing and dirtying helpers (bsc#1125947).\n\n - iomap: warn on zero-length mappings (bsc#1127062).\n\n - iommu/amd: Fix NULL dereference bug in match_hid_uid (bsc#1130336).\n\n - iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE (bsc#1130337).\n\n - iommu/amd: Reserve exclusion range in iova-domain (bsc#1130425).\n\n - iommu/dmar: Fix buffer overflow during PCI bus notification (bsc#1129181).\n\n - iommu: Document iommu_ops.is_attach_deferred() (bsc#1129182).\n\n - iommu: Do not print warning when IOMMU driver only supports unmanaged domains (bsc#1130130).\n\n - iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables (bsc#1129205).\n\n - iommu/vt-d: Check capability before disabling protected memory (bsc#1130338).\n\n - iommu/vt-d: Check identity map for hot-added devices (bsc#1129183).\n\n - iommu/vt-d: Fix NULL pointer reference in intel_svm_bind_mm() (bsc#1129184).\n\n - ip6: fix PMTU discovery when using /127 subnets (git-fixes).\n\n - ip6mr: Do not call __IP6_INC_STATS() from preemptible context (git-fixes).\n\n - ip6_tunnel: get the min mtu properly in ip6_tnl_xmit (bsc#1123456).\n\n - ip6_tunnel: use the right value for ipv4 min mtu check in ip6_tnl_xmit (bsc#1123456).\n\n - ipsec: check return value of skb_to_sgvec always (bsc#1051510).\n\n - ipv4/route: fail early when inet dev is missing (git-fixes).\n\n - ipv4: speedup ipv6 tunnels dismantle (bsc#1122982).\n\n - ipv6: addrlabel: per netns list (bsc#1122982).\n\n - ipv6: Consider sk_bound_dev_if when binding a socket to an address (networking-stable-19_02_01).\n\n - ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address (networking-stable-19_01_22).\n\n - ipv6: fix kernel-infoleak in ipv6_local_error() (networking-stable-19_01_20).\n\n - ipv6: speedup ipv6 tunnels dismantle (bsc#1122982).\n Refresh patches.suse/ip6_vti-fix-a-null-pointer-deference-when-d estroy-vt.patch\n\n - ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses (networking-stable-19_01_22).\n\n - ipvlan, l3mdev: fix broken l3s mode wrt local routes (networking-stable-19_02_01).\n\n - irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size (bsc#1051510).\n\n - irqchip/gic-v3-its: Avoid parsing _indirect_ twice for Device table (bsc#1051510).\n\n - irqchip/gic-v3-its: Do not bind LPI to unavailable NUMA node (bsc#1051510).\n\n - irqchip/gic-v3-its: Fix ITT_entry_size accessor (bsc#1051510).\n\n - irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable (bsc#1051510).\n\n - iscsi_ibft: Fix missing break in switch statement (bsc#1051510).\n\n - isdn: avm: Fix string plus integer warning from Clang (bsc#1051510).\n\n - isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() (bsc#1051510).\n\n - isdn: i4l: isdn_tty: Fix some concurrency double-free bugs (bsc#1051510).\n\n - iser: set sector for ambiguous mr status errors (bsc#1051510).\n\n - iwlwifi: mvm: avoid possible access out of array (bsc#1051510).\n\n - iwlwifi: mvm: fix A-MPDU reference assignment (bsc#1051510).\n\n - iwlwifi: mvm: fix firmware statistics usage (bsc#1129770).\n\n - iwlwifi: mvm: fix RSS config command (bsc#1051510).\n\n - iwlwifi: pcie: fix emergency path (bsc#1051510).\n\n - iwlwifi: pcie: fix TX while flushing (bsc#1120902).\n\n - ixgbe: Be more careful when modifying MAC filters (bsc#1051510).\n\n - ixgbe: check return value of napi_complete_done() (bsc#1051510).\n\n - ixgbe: recognize 1000BaseLX SFP modules as 1Gbps (bsc#1051510).\n\n - kabi: cpufreq: keep min_sampling_rate in struct dbs_data (bsc#1127042).\n\n - kabi: handle addition of ip6addrlbl_table into struct netns_ipv6 (bsc#1122982).\n\n - kabi: handle addition of uevent_sock into struct net (bsc#1122982).\n\n - kabi: Preserve kABI for dma_max_mapping_size() (bsc#1120008).\n\n - kabi: protect vhost_log_write (kabi).\n\n - kabi: restore ip_tunnel_delete_net() (bsc#1122982).\n\n - kabi workaround for ath9k ath_node.ackto type change (bsc#1051510).\n\n - kABI workaround for bt_accept_enqueue() change (bsc#1051510).\n\n - kallsyms: Handle too long symbols in kallsyms.c (bsc#1126805).\n\n - kasan: fix shadow_size calculation error in kasan_module_alloc (bsc#1051510).\n\n - kbuild: fix false positive warning/error about missing libelf (bsc#1051510).\n\n - kconfig: fix file name and line number of warn_ignored_character() (bsc#1051510).\n\n - kconfig: fix line numbers for if-entries in menu tree (bsc#1051510).\n\n - kconfig: fix memory leak when EOF is encountered in quotation (bsc#1051510).\n\n - kconfig: fix the rule of mainmenu_stmt symbol (bsc#1051510).\n\n - keys: allow reaching the keys quotas exactly (bsc#1051510).\n\n - keys: Timestamp new keys (bsc#1051510).\n\n - kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var() (bsc#1051510).\n\n - kgdboc: Fix restrict error (bsc#1051510).\n\n - kgdboc: Fix warning with module build (bsc#1051510).\n\n - kobject: add kobject_uevent_net_broadcast() (bsc#1122982).\n\n - kobject: copy env blob in one go (bsc#1122982).\n\n - kobject: factorize skb setup in kobject_uevent_net_broadcast() (bsc#1122982).\n\n - kprobes: Return error if we fail to reuse kprobe instead of BUG_ON() (bsc#1051510).\n\n - kvm: mmu: Fix race in emulated page table writes (bsc#1129284).\n\n - kvm: nVMX: Free the VMREAD/VMWRITE bitmaps if alloc_kvm_area() fails (bsc#1129291).\n\n - kvm: nVMX: NMI-window and interrupt-window exiting should wake L2 from HLT (bsc#1129292).\n\n - kvm: nVMX: Set VM instruction error for VMPTRLD of unbacked page (bsc#1129293).\n\n - kvm: vmx: Set IA32_TSC_AUX for legacy mode guests (bsc#1129294).\n\n - kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs (bsc#1127082).\n\n - kvm: x86: Fix single-step debugging (bsc#1129295).\n\n - kvm: x86: Use jmp to invoke kvm_spurious_fault() from .fixup (bsc#1129296).\n\n - l2tp: copy 4 more bytes to linear part if necessary (networking-stable-19_02_01).\n\n - l2tp: fix infoleak in l2tp_ip6_recvmsg() (git-fixes).\n\n - l2tp: fix reading optional fields of L2TPv3 (networking-stable-19_02_01).\n\n - leds: lp5523: fix a missing check of return value of lp55xx_read (bsc#1051510).\n\n - leds: lp55xx: fix null deref on firmware load failure (bsc#1051510).\n\n - libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive() (bsc#1125800).\n\n - libceph: handle an empty authorize reply (bsc#1126789).\n\n - libceph: wait for latest osdmap in ceph_monc_blacklist_add() (bsc#1130427).\n\n - lib/div64.c: off by one in shift (bsc#1051510).\n\n - libertas_tf: do not set URB_ZERO_PACKET on IN USB transfer (bsc#1051510).\n\n - libnvdimm: Fix altmap reservation size calculation (bsc#1127682).\n\n - libnvdimm/label: Clear 'updating' flag after label-set update (bsc#1129543).\n\n - libnvdimm/pmem: Honor force_raw for legacy pmem regions (bsc#1129551).\n\n - lightnvm: fail fast on passthrough commands (bsc#1125780).\n\n - livepatch: Change unsigned long old_addr -> void\n *old_func in struct klp_func (bsc#1071995).\n\n - livepatch: Consolidate klp_free functions (bsc#1071995 ).\n\n - livepatch: core: Return EOPNOTSUPP instead of ENOSYS (bsc#1071995).\n\n - livepatch: Define a macro for new API identification (bsc#1071995).\n\n - livepatch: Do not block the removal of patches loaded after a forced transition (bsc#1071995).\n\n - livepatch: Introduce klp_for_each_patch macro (bsc#1071995 ).\n\n - livepatch: Module coming and going callbacks can proceed with all listed patches (bsc#1071995).\n\n - livepatch: Proper error handling in the shadow variables selftest (bsc#1071995).\n\n - livepatch: Remove ordering (stacking) of the livepatches (bsc#1071995).\n\n - livepatch: Remove signal sysfs attribute (bsc#1071995 ).\n\n - livepatch: return -ENOMEM on ptr_id() allocation failure (bsc#1071995).\n\n - livepatch: Send a fake signal periodically (bsc#1071995 ).\n\n - livepatch: Shuffle klp_enable_patch()/klp_disable_patch() code (bsc#1071995).\n\n - livepatch: Simplify API by removing registration step (bsc#1071995).\n\n - llc: do not use sk_eat_skb() (bsc#1051510).\n\n - locking/rwsem: Fix (possible) missed wakeup (bsc#1050549).\n\n - loop: drop caches if offset or block_size are changed (bsc#1124975).\n\n - loop: Reintroduce lo_ctl_mutex removed by commit 310ca162d (bsc#1124974).\n\n - mac80211: Add attribute aligned(2) to struct 'action' (bsc#1051510).\n\n - mac80211: do not initiate TDLS connection if station is not associated to AP (bsc#1051510).\n\n - mac80211: ensure that mgmt tx skbs have tailroom for encryption (bsc#1051510).\n\n - mac80211: fix miscounting of ttl-dropped frames (bsc#1051510).\n\n - mac80211: fix radiotap vendor presence bitmap handling (bsc#1051510).\n\n - mac80211: Fix Tx aggregation session tear down with ITXQs (bsc#1051510).\n\n - mac80211: Free mpath object when rhashtable insertion fails (bsc#1051510).\n\n - mac80211_hwsim: propagate genlmsg_reply return code (bsc#1051510).\n\n - mac80211: Restore vif beacon interval if start ap fails (bsc#1051510).\n\n - macvlan: Only deliver one copy of the frame to the macvlan interface (bsc#1051510).\n\n - mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue (bsc#1051510).\n\n - mdio_bus: Fix use-after-free on device_register fails (bsc#1051510).\n\n - media: adv*/tc358743/ths8200: fill in min width/height/pixelclock (bsc#1051510).\n\n - media: DaVinci-VPBE: fix error handling in vpbe_initialize() (bsc#1051510).\n\n - media: dt-bindings: media: i2c: Fix i2c address for OV5645 camera sensor (bsc#1051510).\n\n - media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm() (bsc#1051510).\n\n - media: rc: mce_kbd decoder: fix stuck keys (bsc#1100132).\n\n - media: s5k4ecgx: delete a bogus error message (bsc#1051510).\n\n - media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration (bsc#1051510).\n\n - media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL (bsc#1051510).\n\n - media: s5p-mfc: fix incorrect bus assignment in virtual child device (bsc#1051510).\n\n - media: uvcvideo: Avoid NULL pointer dereference at the end of streaming (bsc#1051510).\n\n - media: uvcvideo: Fix 'type' check leading to overflow (bsc#1051510).\n\n - media: v4l2-ctrls.c/uvc: zero v4l2_event (bsc#1051510).\n\n - media: v4l2: i2c: ov7670: Fix PLL bypass register values (bsc#1051510).\n\n - media: vb2: do not call __vb2_queue_cancel if vb2_start_streaming failed (bsc#1119086).\n\n - memremap: fix softlockup reports at teardown (bnc#1130154).\n\n - memstick: Prevent memstick host from getting runtime suspended during card detection (bsc#1051510).\n\n - mfd: db8500-prcmu: Fix some section annotations (bsc#1051510).\n\n - mfd: mc13xxx: Fix a missing check of a register-read failure (bsc#1051510).\n\n - mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported (bsc#1051510).\n\n - mfd: qcom_rpm: write fw_version to CTRL_REG (bsc#1051510).\n\n - mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells (bsc#1051510).\n\n - mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path in probe() (bsc#1051510).\n\n - mfd: twl-core: Fix section annotations on (,un)protect_pm_master (bsc#1051510).\n\n - mfd: wm5110: Add missing ASRC rate register (bsc#1051510).\n\n - misc: hpilo: Do not claim unsupported hardware (bsc#1129330).\n\n - misc: hpilo: Exclude unsupported device via blacklist (bsc#1129330).\n\n - mISDN: fix a race in dev_expire_timer() (bsc#1051510).\n\n - mlxsw: __mlxsw_sp_port_headroom_set(): Fix a use of local variable (git-fixes).\n\n - mlxsw: spectrum: Disable lag port TX before removing it (networking-stable-19_01_22).\n\n - mmap: introduce sane default mmap limits (git fixes (mm/mmap)).\n\n - mmap: relax file size limit for regular files (git fixes (mm/mmap)).\n\n - mmc: bcm2835: Recover from MMC_SEND_EXT_CSD (bsc#1051510).\n\n - mmc: Kconfig: Enable CONFIG_MMC_SDHCI_IO_ACCESSORS (bsc#1051510).\n\n - mmc: omap: fix the maximum timeout setting (bsc#1051510).\n\n - mmc: pxamci: fix enum type confusion (bsc#1051510).\n\n - mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe (bsc#1051510).\n\n - mmc: sdhci-esdhc-imx: fix HS400 timing issue (bsc#1051510).\n\n - mmc: sdhci-of-esdhc: Fix timeout checks (bsc#1051510).\n\n - mmc: sdhci-xenon: Fix timeout checks (bsc#1051510).\n\n - mmc: spi: Fix card detection during probe (bsc#1051510).\n\n - mm: do not drop unused pages when userfaultd is running (git fixes (mm/userfaultfd)).\n\n - mm: Fix modifying of page protection by insert_pfn() (bsc#1126740).\n\n - mm: Fix warning in insert_pfn() (bsc#1126740).\n\n - mm/hmm: hmm_pfns_bad() was accessing wrong struct (git fixes (mm/hmm)).\n\n - mm: hwpoison: use do_send_sig_info() instead of force_sig() (git fixes (mm/hwpoison)).\n\n - mm/ksm.c: ignore STABLE_FLAG of rmap_item->address in rmap_walk_ksm() (git fixes (mm/ksm)).\n\n - mm: madvise(MADV_DODUMP): allow hugetlbfs pages (git fixes (mm/madvise)).\n\n - mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages (bsc#1127731).\n\n - mm: migrate: do not rely on __PageMovable() of newpage after unlocking it (git fixes (mm/migrate)).\n\n - mm, oom: fix use-after-free in oom_kill_process (git fixes (mm/oom)).\n\n - mm: use swp_offset as key in shmem_replace_page() (git fixes (mm/shmem)).\n\n - mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed (git fixes (mm/vmscan)).\n\n - Move upstreamed ALSA and BT patches into sorted section\n\n - Move upstreamed libnvdimm patch into sorted section\n\n - mtd: cfi_cmdset_0002: Avoid walking all chips when unlocking (bsc#1051510).\n\n - mtd: cfi_cmdset_0002: Change write buffer to check correct value (bsc#1051510).\n\n - mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips (bsc#1051510).\n\n - mtd: cfi_cmdset_0002: Fix unlocking requests crossing a chip boudary (bsc#1051510).\n\n - mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock() (bsc#1051510).\n\n - mtdchar: fix overflows in adjustment of `count` (bsc#1051510).\n\n - mtdchar: fix usage of mtd_ooblayout_ecc() (bsc#1051510).\n\n - mtd: docg3: do not set conflicting BCH_CONST_PARAMS option (bsc#1051510).\n\n - mtd/maps: fix solutionengine.c printk format warnings (bsc#1051510).\n\n - mtd: mtd_oobtest: Handle bitflips during reads (bsc#1051510).\n\n - mtd: nand: atmel: fix buffer overflow in atmel_pmecc_user (bsc#1051510).\n\n - mtd: nand: atmel: Fix get_sectorsize() function (bsc#1051510).\n\n - mtd: nand: atmel: fix of_irq_get() error check (bsc#1051510).\n\n - mtd: nand: brcmnand: Disable prefetch by default (bsc#1051510).\n\n - mtd: nand: brcmnand: Zero bitflip is not an error (bsc#1051510).\n\n - mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE (bsc#1051510).\n\n - mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]() (bsc#1051510).\n\n - mtd: nand: Fix nand_do_read_oob() return value (bsc#1051510).\n\n - mtd: nand: Fix writing mtdoops to nand flash (bsc#1051510).\n\n - mtd: nand: fsl_ifc: Fix nand waitfunc return value (bsc#1051510).\n\n - mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM (bsc#1051510).\n\n - mtd: nand: ifc: update bufnum mask for ver >= 2.0.0 (bsc#1051510).\n\n - mtd: nand: mtk: fix infinite ECC decode IRQ issue (bsc#1051510).\n\n - mtd: nand: omap2: Fix subpage write (bsc#1051510).\n\n - mtd: nand: pxa3xx: Fix READOOB implementation (bsc#1051510).\n\n - mtd: nand: qcom: Add a NULL check for devm_kasprintf() (bsc#1051510).\n\n - mtd: nandsim: remove debugfs entries in error path (bsc#1051510).\n\n - mtd: nand: sunxi: Fix ECC strength choice (bsc#1051510).\n\n - mtd: nand: sunxi: fix potential divide-by-zero error (bsc#1051510).\n\n - mtd: nand: vf610: set correct ooblayout (bsc#1051510).\n\n - mtd: spi-nor: cadence-quadspi: Fix page fault kernel panic (bsc#1051510).\n\n - mtd: spi-nor: Fix Cadence QSPI page fault kernel panic (bsc#1051510).\n\n - mtd: spi-nor: fsl-quadspi: fix read error for flash size larger than 16MB (bsc#1051510).\n\n - mtd: spi-nor: stm32-quadspi: Fix uninitialized error return code (bsc#1051510).\n\n - mv88e6060: disable hardware level MAC learning (bsc#1051510).\n\n - nbd: Use set_blocksize() to set device blocksize (bsc#1124984).\n\n - net: add uevent socket member (bsc#1122982).\n\n - net: aquantia: driver should correctly declare vlan_features bits (bsc#1051510).\n\n - net: aquantia: fixed instack structure overflow (git-fixes).\n\n - net: aquantia: Fix hardware DMA stream overload on large MRRS (bsc#1051510).\n\n - net: bcmgenet: abort suspend on error (bsc#1051510).\n\n - net: bcmgenet: code movement (bsc#1051510).\n\n - net: bcmgenet: fix OF child-node lookup (bsc#1051510).\n\n - net: bcmgenet: remove HFB_CTRL access (bsc#1051510).\n\n - net: bcmgenet: return correct value 'ret' from bcmgenet_power_down (bsc#1051510).\n\n - net: bridge: fix a bug on using a neighbour cache entry without checking its state (networking-stable-19_01_20).\n\n - net: bridge: Fix ethernet header pointer before check skb forwardable (networking-stable-19_01_26).\n\n - net: do not call update_pmtu unconditionally (bsc#1123456).\n\n - net: Do not default Cavium PTP driver to 'y' (bsc#1110096).\n\n - net: dp83640: expire old TX-skb (networking-stable-19_02_10).\n\n - net: dsa: mv88e6xxx: handle unknown duplex modes gracefully in mv88e6xxx_port_set_duplex (git-fixes).\n\n - net: dsa: mv88x6xxx: mv88e6390 errata (networking-stable-19_01_22).\n\n - net: dsa: slave: Do not propagate flag changes on down slave interfaces (networking-stable-19_02_10).\n\n - net: ena: fix race between link up and device initalization (bsc#1083548).\n\n - net: ena: update driver version from 2.0.2 to 2.0.3 (bsc#1129276 bsc#1125342).\n\n - netfilter: check for seqadj ext existence before adding it in nf_nat_setup_info (git-fixes).\n\n - netfilter: nf_tables: check the result of dereferencing base_chain->stats (git-fixes).\n\n - net: Fix usage of pskb_trim_rcsum (networking-stable-19_01_26).\n\n - net: ipv4: Fix memory leak in network namespace dismantle (networking-stable-19_01_26).\n\n - net/mlx4_core: Add masking for a few queries on HCA caps (networking-stable-19_02_01).\n\n - net/mlx4_core: Fix locking in SRIOV mode when switching between events and polling (git-fixes).\n\n - net/mlx4_core: Fix qp mtt size calculation (git-fixes).\n\n - net/mlx4_core: Fix reset flow when in command polling mode (git-fixes).\n\n - net/mlx5e: Allow MAC invalidation while spoofchk is ON (networking-stable-19_02_01).\n\n - net/mlx5e: IPoIB, Fix RX checksum statistics update (git-fixes).\n\n - net/mlx5e: RX, Fix wrong early return in receive queue poll (bsc#1046305).\n\n - net/mlx5: fix uaccess beyond 'count' in debugfs read/write handlers (git-fixes).\n\n - net/mlx5: Release resource on error flow (git-fixes).\n\n - net/mlx5: Return success for PAGE_FAULT_RESUME in internal error state (git-fixes).\n\n - net/mlx5: Use multi threaded workqueue for page fault handling (git-fixes).\n\n - net/ncsi: Fix AEN HNCDSC packet length (git-fixes).\n\n - net/ncsi: Stop monitor if channel times out or is inactive (git-fixes).\n\n - net: netem: fix skb length BUG_ON in __skb_to_sgvec (git-fixes).\n\n - netns: restrict uevents (bsc#1122982).\n\n - net: phy: marvell: Errata for mv88e6390 internal PHYs (networking-stable-19_01_26).\n\n - net: phy: mdio_bus: add missing device_del() in mdiobus_register() error handling (networking-stable-19_01_26).\n\n - net: phy: Micrel KSZ8061: link failure after cable connect (git-fixes).\n\n - netrom: switch to sock timer API (bsc#1051510).\n\n - net/rose: fix NULL ax25_cb kernel panic (networking-stable-19_02_01).\n\n - net/sched: act_tunnel_key: fix memory leak in case of action replace (networking-stable-19_01_26).\n\n - net_sched: refetch skb protocol for each filter (networking-stable-19_01_26).\n\n - net: set default network namespace in init_dummy_netdev() (networking-stable-19_02_01).\n\n - net: stmmac: Fix a race in EEE enable callback (git-fixes).\n\n - net: stmmac: fix broken dma_interrupt handling for multi-queues (git-fixes).\n\n - net: stmmac: handle endianness in dwmac4_get_timestamp (git-fixes).\n\n - net: stmmac: Use mutex instead of spinlock (git-fixes).\n\n - net-sysfs: Fix mem leak in netdev_register_kobject (git-fixes).\n\n - net: systemport: Fix WoL with password after deep sleep (networking-stable-19_02_10).\n\n - net: thunderx: fix NULL pointer dereference in nic_remove (git-fixes).\n\n - nfit: acpi_nfit_ctl(): Check out_obj->type in the right place (bsc#1129547).\n\n - nfit/ars: Attempt a short-ARS whenever the ARS state is idle at boot (bsc#1051510).\n\n - nfit/ars: Attempt short-ARS even in the no_init_ars case (bsc#1051510).\n\n - nfp: bpf: fix ALU32 high bits clearance bug (git-fixes).\n\n - nfsd: fix memory corruption caused by readdir (bsc#1127445).\n\n - niu: fix missing checks of niu_pci_eeprom_read (bsc#1051510).\n\n - ntb_transport: Fix bug with max_mw_size parameter (bsc#1051510).\n\n - nvme-fc: reject reconnect if io queue count is reduced to zero (bsc#1128351).\n\n - nvme: flush namespace scanning work just before removing namespaces (bsc#1108101).\n\n - nvme: kABI fix for scan_lock (bsc#1123882).\n\n - nvme: lock NS list changes while handling command effects (bsc#1123882).\n\n - nvme-loop: fix kernel oops in case of unhandled command (bsc#1126807).\n\n - nvme-multipath: drop optimization for static ANA group IDs (bsc#1113939).\n\n - nvme-pci: fix out of bounds access in nvme_cqe_pending (bsc#1127595).\n\n - nvme: schedule requeue whenever a LIVE state is entered (bsc#1123105).\n\n - of, numa: Validate some distance map rules (bsc#1051510).\n\n - of: unittest: Disable interrupt node tests for old world MAC systems (bsc#1051510).\n\n - openvswitch: Avoid OOB read when parsing flow nlattrs (bsc#1051510).\n\n - openvswitch: fix the incorrect flow action alloc size (bsc#1051510).\n\n - openvswitch: Remove padding from packet before L3+ conntrack processing (bsc#1051510).\n\n - parport_pc: fix find_superio io compare code, should use equal test (bsc#1051510).\n\n - Partially revert 'block: fail op_is_write() requests to (bsc#1125252).\n\n - pci: add USR vendor id and use it in r8169 and w6692 driver (networking-stable-19_01_22).\n\n - pci: designware-ep: dw_pcie_ep_set_msi() should only set MMC bits (bsc#1051510).\n\n - pci: endpoint: functions: Use memcpy_fromio()/memcpy_toio() (bsc#1051510).\n\n - pci-hyperv: increase HV_VP_SET_BANK_COUNT_MAX to handle 1792 vcpus (bsc#1122822).\n\n - pci/pme: Fix hotplug/sysfs remove deadlock in pcie_pme_remove() (bsc#1051510).\n\n - pci: qcom: Do not deassert reset GPIO during probe (bsc#1129281).\n\n - pcrypt: use format specifier in kobject_add (bsc#1051510).\n\n - perf/x86: Add sysfs entry to freeze counters on SMI (bsc#1121805).\n\n - perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu() (bsc#1121805).\n\n - perf/x86/intel: Do not enable freeze-on-smi for PerfMon V1 (bsc#1121805).\n\n - perf/x86/intel: Fix memory corruption (bsc#1121805).\n\n - perf/x86/intel: Generalize dynamic constraint creation (bsc#1121805).\n\n - perf/x86/intel: Implement support for TSX Force Abort (bsc#1121805).\n\n - perf/x86/intel: Make cpuc allocations consistent (bsc#1121805).\n\n - phy: allwinner: sun4i-usb: poll vbus changes on A23/A33 when driving VBUS (bsc#1051510).\n\n - phy: qcom-qmp: Fix failure path in phy_init functions (bsc#1051510).\n\n - phy: qcom-qmp: Fix phy pipe clock gating (bsc#1051510).\n\n - phy: renesas: rcar-gen3-usb2: fix vbus_ctrl for role sysfs (bsc#1051510).\n\n - phy: rockchip-emmc: retry calpad busy trimming (bsc#1051510).\n\n - phy: sun4i-usb: add support for missing USB PHY index (bsc#1051510).\n\n - phy: tegra: remove redundant self assignment of 'map' (bsc#1051510).\n\n - phy: work around 'phys' references to usb-nop-xceiv devices (bsc#1051510).\n\n - pinctrl: max77620: Use define directive for max77620_pinconf_param values (bsc#1051510).\n\n - pinctrl: meson: fix pull enable register calculation (bsc#1051510).\n\n - pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins (bsc#1051510).\n\n - pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins (bsc#1051510).\n\n - pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins (bsc#1051510).\n\n - pinctrl: msm: fix gpio-hog related boot issues (bsc#1051510).\n\n - pinctrl: sh-pfc: emev2: Add missing pinmux functions (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7778: Fix HSPI pin numbers and names (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field (bsc#1051510).\n\n - pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration (bsc#1051510).\n\n - pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field (bsc#1051510).\n\n - pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group (bsc#1051510).\n\n - pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups (bsc#1051510).\n\n - pinctrl: sh-pfc: sh7734: Add missing IPSR11 field (bsc#1051510).\n\n - pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10 (bsc#1051510).\n\n - pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value (bsc#1051510).\n\n - pinctrl: sunxi: a64: Rename function csi0 to csi (bsc#1051510).\n\n - pinctrl: sunxi: a64: Rename function ts0 to ts (bsc#1051510).\n\n - pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11 (bsc#1051510).\n\n - pinctrl: sx150x: handle failure case of devm_kstrdup (bsc#1051510).\n\n - pktcdvd: Fix possible Spectre-v1 for pkt_devs (bsc#1051510).\n\n - platform/x86: Fix unmet dependency warning for SAMSUNG_Q10 (bsc#1051510).\n\n - pm / wakeup: Rework wakeup source timer cancellation (bsc#1051510).\n\n - powercap: intel_rapl: add support for Jacobsville ().\n\n - powerpc/64s: Clear on-stack exception marker upon exception return (bsc#1071995).\n\n - powerpc/livepatch: relax reliable stack tracer checks for first-frame (bsc#1071995).\n\n - powerpc/livepatch: small cleanups in save_stack_trace_tsk_reliable() (bsc#1071995).\n\n - powerpc/pseries: export timebase register sample in lparcfg (bsc#1127750).\n\n - powerpc/pseries/mce: Fix misleading print for TLB mutlihit (bsc#1094244, git-fixes).\n\n - powerpc/pseries: Perform full re-add of CPU for topology update post-migration (bsc#1125728).\n\n - power: supply: charger-manager: Fix incorrect return value (bsc#1051510).\n\n - pptp: dst_release sk_dst_cache in pptp_sock_destruct (git-fixes).\n\n - proc/sysctl: do not return ENOMEM on lookup when a table is unregistering (git-fixes).\n\n - pseries/energy: Use OF accessor function to read ibm,drc-indexes (bsc#1129080).\n\n - ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl (bsc#1051510).\n\n - ptp: Fix pass zero to ERR_PTR() in ptp_clock_register (bsc#1051510).\n\n - pwm-backlight: Enable/disable the PWM before/after LCD enable toggle (bsc#1051510).\n\n - qmi_wwan: add MTU default to qmap network interface (networking-stable-19_01_22).\n\n - qmi_wwan: apply SET_DTR quirk to Sierra WP7607 (bsc#1051510).\n\n - qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup (bsc#1051510).\n\n - r8169: Add support for new Realtek Ethernet (networking-stable-19_01_22).\n\n - r8169: use PCI_VDEVICE macro (networking-stable-19_01_22).\n\n - rbd: do not return 0 on unmap if RBD_DEV_FLAG_REMOVING is set (bsc#1125797).\n\n - rcu: Fix up pending cbs check in rcu_prepare_for_idle (git fixes (kernel/rcu)).\n\n - rcu: Make need_resched() respond to urgent RCU-QS needs (git fixes (kernel/rcu)).\n\n - rdma/vmw_pvrdma: Support upto 64-bit PFNs (bsc#1127285).\n\n - Refresh patches.suse/scsi-do-not-print-reservation-conflict-for- TEST-UNIT.patch (bsc#1119843)\n\n - regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting (bsc#1051510).\n\n - regulator: max77620: Initialize values for DT properties (bsc#1051510).\n\n - regulator: pv88060: Fix array out-of-bounds access (bsc#1051510).\n\n - regulator: pv88080: Fix array out-of-bounds access (bsc#1051510).\n\n - regulator: pv88090: Fix array out-of-bounds access (bsc#1051510).\n\n - regulator: s2mpa01: Fix step values for some LDOs (bsc#1051510).\n\n - regulator: s2mps11: Fix steps for buck7, buck8 and LDO35 (bsc#1051510).\n\n - regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA (bsc#1051510).\n\n - Remove blacklist of virtio patch so we can install it (bsc#1114585)\n\n - Remove patches rejected upstream ().\n\n - Revert drm/i915 patches that caused regressions (bsc#1131062)\n\n - Revert 'drm/rockchip: Allow driver to be shutdown on reboot/kexec' (bsc#1051510).\n\n - Revert 'Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G' (bsc#1051510).\n\n - Revert 'ipv4: keep skb->dst around in presence of IP options' (git-fixes).\n\n - Revert 'openvswitch: Fix template leak in error cases.' (bsc#1051510).\n\n - Revert 'scsi: qla2xxx: Fix NVMe Target discovery' (bsc#1125252).\n\n - Revert 'sd: disable logical block provisioning if 'lbpme' is not set' This reverts commit e365f138cb9c9c48b710864a9f37a91b4b93381d. Patch not accepted upstream.\n\n - Revert the previous merge of drm fixes The branch was merged mistakenly and breaks the build. Revert it.\n\n - Revert 'xhci: Reset Renesas uPD72020x USB controller for 32-bit DMA issue' (bsc#1120854).\n\n - rhashtable: Still do rehash when we get EEXIST (bsc#1051510).\n\n - rocker: fix rocker_tlv_put_* functions for KASAN (bsc#1051510).\n\n - rpm/kernel-source.changes.old: Really drop old changelogs (bsc#1098995)\n\n - rt2800: enable TX_PIN_CFG_RFRX_EN only for MT7620 (bsc#1120902).\n\n - rtc: 88pm80x: fix unintended sign extension (bsc#1051510).\n\n - rtc: 88pm860x: fix unintended sign extension (bsc#1051510).\n\n - rtc: cmos: ignore bogus century byte (bsc#1051510).\n\n - rtc: ds1672: fix unintended sign extension (bsc#1051510).\n\n - rtc: Fix overflow when converting time64_t to rtc_time (bsc#1051510).\n\n - rtc: pm8xxx: fix unintended sign extension (bsc#1051510).\n\n - rtnetlink: bring NETDEV_CHANGE_TX_QUEUE_LEN event process back in rtnetlink_event (git-fixes).\n\n - rtnetlink: bring NETDEV_CHANGEUPPER event process back in rtnetlink_event (git-fixes).\n\n - rtnetlink: bring NETDEV_POST_TYPE_CHANGE event process back in rtnetlink_event (git-fixes).\n\n - rtnetlink: check DO_SETLINK_NOTIFY correctly in do_setlink (git-fixes).\n\n - rxrpc: bad unlock balance in rxrpc_recvmsg (networking-stable-19_02_10).\n\n - s390/cio: Fix how vfio-ccw checks pinned pages (git-fixes).\n\n - s390/cpum_cf: Reject request for sampling in event initialization (git-fixes).\n\n - s390/early: improve machine detection (git-fixes).\n\n - s390/mm: always force a load of the primary ASCE on context switch (git-fixes).\n\n - s390/mm: fix addressing exception after suspend/resume (bsc#1125252).\n\n - s390/qeth: cancel close_dev work before removing a card (LTC#175898, bsc#1127561).\n\n - s390/qeth: conclude all event processing before offlining a card (LTC#175901, bsc#1127567).\n\n - s390/qeth: fix use-after-free in error path (bsc#1127534).\n\n - s390/qeth: invoke softirqs after napi_schedule() (git-fixes).\n\n - s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU (git-fixes).\n\n - s390/smp: fix CPU hotplug deadlock with CPU rescan (git-fixes).\n\n - s390/sthyi: Fix machine name validity indication (git-fixes).\n\n - sata_rcar: fix deferred probing (bsc#1051510).\n\n - sc16is7xx: Fix for multi-channel stall (bsc#1051510).\n\n - sched: Do not re-read h_load_next during hierarchical load calculation (bnc#1120909).\n\n - sched/wake_q: Document wake_q_add() (bsc#1050549).\n\n - sched/wake_q: Fix wakeup ordering for wake_q (bsc#1050549).\n\n - sched/wake_q: Reduce reference counting for special users (bsc#1050549).\n\n - sch_multiq: fix double free on init failure (bsc#1051510).\n\n - scripts/git_sort/git_sort.py: add vfs 'fixes' branch\n\n - scsi: core: reset host byte in DID_NEXUS_FAILURE case (bsc#1122764).\n\n - scsi: csiostor: remove flush_scheduled_work() (bsc#1127363).\n\n - scsi: fix queue cleanup race before queue initialization is done (bsc#1125252).\n\n - scsi: ibmvscsi: Fix empty event pool access during host removal (bsc#1119019).\n\n - scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton (bsc#1119019).\n\n - scsi: libiscsi: fix possible NULL pointer dereference in case of TMF (bsc#1127378).\n\n - scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task (bsc#1122192).\n\n - scsi: lpfc: Add log messages to aid in debugging fc4type discovery issues (bsc#1121317).\n\n - scsi: lpfc: Correct MDS loopback diagnostics support (bsc#1121317).\n\n - scsi: lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt is invalid (bsc#1121317).\n\n - scsi: lpfc: Fix discovery failure when PLOGI is defered (bsc#1121317).\n\n - scsi: lpfc: Fix link state reporting for trunking when adapter is offline (bsc#1121317).\n\n - scsi: lpfc: fix remoteport access (bsc#1125252).\n\n - scsi: lpfc: remove an unnecessary NULL check (bsc#1121317).\n\n - scsi: lpfc: update fault value on successful trunk events (bsc#1121317).\n\n - scsi: lpfc: Update lpfc version to 12.0.0.10 (bsc#1121317).\n\n - scsi: mpt3sas: Add ioc_<level> logging macros (bsc#1117108).\n\n - scsi: mpt3sas: Annotate switch/case fall-through (bsc#1117108).\n\n - scsi: mpt3sas: Convert logging uses with MPT3SAS_FMT and reply_q_name to %s: (bsc#1117108).\n\n - scsi: mpt3sas: Convert logging uses with MPT3SAS_FMT without logging levels (bsc#1117108).\n\n - scsi: mpt3sas: Convert mlsleading uses of pr_<level> with MPT3SAS_FMT (bsc#1117108).\n\n - scsi: mpt3sas: Convert uses of pr_<level> with MPT3SAS_FMT to ioc_<level> (bsc#1117108).\n\n - scsi: mpt3sas: Fix a race condition in mpt3sas_base_hard_reset_handler() (bsc#1117108).\n\n - scsi: mpt3sas: Fix indentation (bsc#1117108).\n\n - scsi: mpt3sas: Improve kernel-doc headers (bsc#1117108).\n\n - scsi: mpt3sas: Introduce struct mpt3sas_nvme_cmd (bsc#1117108).\n\n - scsi: mpt3sas: Remove KERN_WARNING from panic uses (bsc#1117108).\n\n - scsi: mpt3sas: Remove set-but-not-used variables (bsc#1117108).\n\n - scsi: mpt3sas: Remove unnecessary parentheses and simplify null checks (bsc#1117108).\n\n - scsi: mpt3sas: Remove unused macro MPT3SAS_FMT (bsc#1117108).\n\n - scsi: mpt3sas: Split _base_reset_handler(), mpt3sas_scsih_reset_handler() and mpt3sas_ctl_reset_handler() (bsc#1117108).\n\n - scsi: mpt3sas: Swap I/O memory read value back to cpu endianness (bsc#1117108).\n\n - scsi: mpt3sas: switch to generic DMA API (bsc#1117108).\n\n - scsi: mpt3sas: Use dma_pool_zalloc (bsc#1117108).\n\n - scsi: mptsas: Fixup device hotplug for VMware ESXi (bsc#1129046).\n\n - scsi: qla2xxx: Enable FC-NVME on NPIV ports (bsc#1094555).\n\n - scsi: qla2xxx: Fix a typo in MODULE_PARM_DESC (bsc#1094555).\n\n - scsi: qla2xxx: Fix for FC-NVMe discovery for NPIV port (bsc#1094555).\n\n - scsi: qla2xxx: Fix NPIV handling for FC-NVMe (bsc#1094555).\n\n - scsi: qla2xxx: Initialize port speed to avoid setting lower speed (bsc#1094555).\n\n - scsi: qla2xxx: Modify fall-through annotations (bsc#1094555).\n\n - scsi: qla2xxx: Remove unnecessary self assignment (bsc#1094555).\n\n - scsi: qla2xxx: Simplify conditional check (bsc#1094555).\n\n - scsi: qla2xxx: Update driver version to 10.00.00.12-k (bsc#1094555).\n\n - scsi: storvsc: Fix a race in sub-channel creation that can cause panic ().\n\n - scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir() (bsc#1125315).\n\n - scsi: virtio_scsi: fix pi_bytes(out,in) on 4 KiB block size devices (bsc#1114585).\n\n - sctp: add a ceiling to optlen in some sockopts (bnc#1129163).\n\n - sctp: improve the events for sctp stream adding (networking-stable-19_02_01).\n\n - sctp: improve the events for sctp stream reset (networking-stable-19_02_01).\n\n - sd: disable logical block provisioning if 'lbpme' is not set (bsc#1086095 bsc#1078355).\n\n - selftests/livepatch: add DYNAMIC_DEBUG config dependency (bsc#1071995).\n\n - selftests/livepatch: introduce tests (bsc#1071995).\n\n - selinux: always allow mounting submounts (bsc#1051510).\n\n - seq_buf: Make seq_buf_puts() null-terminate the buffer (bsc#1051510).\n\n - serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart (bsc#1051510).\n\n - serial: 8250_pci: Fix number of ports for ACCES serial cards (bsc#1051510).\n\n - serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup() (bsc#1051510).\n\n - serial: fix race between flush_to_ldisc and tty_open (bsc#1051510).\n\n - serial: fsl_lpuart: clear parity enable bit when disable parity (bsc#1051510).\n\n - serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling (bsc#1051510).\n\n - serial: imx: Update cached mctrl value when changing RTS (bsc#1051510).\n\n - serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO (bsc#1051510).\n\n - skge: potential memory corruption in skge_get_regs() (bsc#1051510).\n\n - sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79 (bsc#1051510).\n\n - sky2: Increase D3 delay again (bsc#1051510).\n\n - smb311: Improve checking of negotiate security contexts (bsc#1051510).\n\n - smb3: Enable encryption for SMB3.1.1 (bsc#1051510).\n\n - smb3: Fix 3.11 encryption to Windows and handle encrypted smb3 tcon (bsc#1051510).\n\n - smb3: Fix SMB3.1.1 guest mounts to Samba (bsc#1051510).\n\n - smb3: remove noisy warning message on mount (bsc#1129664).\n\n - soc: bcm: brcmstb: Do not leak device tree node reference (bsc#1051510).\n\n - soc: fsl: qbman: avoid race in clearing QMan interrupt (bsc#1051510).\n\n - soc/tegra: Do not leak device tree node reference (bsc#1051510).\n\n - spi: pxa2xx: Setup maximum supported DMA transfer length (bsc#1051510).\n\n - spi: ti-qspi: Fix mmap read when more than one CS in use (bsc#1051510).\n\n - spi/topcliff_pch: Fix potential NULL dereference on allocation error (bsc#1051510).\n\n - splice: do not merge into linked buffers (git-fixes).\n\n - staging: comedi: ni_660x: fix missing break in switch statement (bsc#1051510).\n\n - staging:iio:ad2s90: Make probe handle spi_setup failure (bsc#1051510).\n\n - staging: iio: ad7780: update voltage on read (bsc#1051510).\n\n - staging: iio: adc: ad7280a: handle error from\n __ad7280_read32() (bsc#1051510).\n\n - staging: iio: adt7316: allow adt751x to use internal vref for all dacs (bsc#1051510).\n\n - staging: iio: adt7316: fix register and bit definitions (bsc#1051510).\n\n - staging: iio: adt7316: fix the dac read calculation (bsc#1051510).\n\n - staging: iio: adt7316: fix the dac write calculation (bsc#1051510).\n\n - staging: rtl8723bs: Fix build error with Clang when inlining is disabled (bsc#1051510).\n\n - staging: speakup: Replace strncpy with memcpy (bsc#1051510).\n\n - staging: wilc1000: fix to set correct value for 'vif_num' (bsc#1051510).\n\n - supported.conf\n\n - svm: Add mutex_lock to protect apic_access_page_done on AMD systems (bsc#1129285).\n\n - svm: Fix improper check when deactivate AVIC (bsc#1130335).\n\n - swiotlb: Add is_swiotlb_active() function (bsc#1120008).\n\n - swiotlb: Introduce swiotlb_max_mapping_size() (bsc#1120008).\n\n - switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite (bsc#1051510).\n\n - switchtec: Remove immediate status check after submitting MRPC command (bsc#1051510).\n\n - sysfs: Disable lockdep for driver bind/unbind files (bsc#1051510).\n\n - tcp: batch tcp_net_metrics_exit (bsc#1122982).\n\n - tcp: change txhash on SYN-data timeout (networking-stable-19_01_20).\n\n - tcp: handle inet_csk_reqsk_queue_add() failures (git-fixes).\n\n - team: avoid complex list operations in team_nl_cmd_options_set() (bsc#1051510).\n\n - team: Free BPF filter when unregistering netdev (bsc#1051510).\n\n - thermal: bcm2835: Fix crash in bcm2835_thermal_debugfs (bsc#1051510).\n\n - thermal: do not clear passive state during system sleep (bsc#1051510).\n\n - thermal/drivers/hisi: Encapsulate register writes into helpers (bsc#1051510).\n\n - thermal/drivers/hisi: Fix configuration register setting (bsc#1051510).\n\n - thermal: generic-adc: Fix adc to temp interpolation (bsc#1051510).\n\n - thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set (bsc#1051510).\n\n - thermal/intel_powerclamp: fix truncated kthread name ().\n\n - thermal: mediatek: fix register index error (bsc#1051510).\n\n - timekeeping: Use proper seqcount initializer (bsc#1051510).\n\n - tipc: eliminate KMSAN uninit-value in strcmp complaint (bsc#1051510).\n\n - tipc: error path leak fixes in tipc_enable_bearer() (bsc#1051510).\n\n - tipc: fix a race condition of releasing subscriber object (bsc#1051510).\n\n - tipc: fix bug in function tipc_nl_node_dump_monitor (bsc#1051510).\n\n - tipc: fix infinite loop when dumping link monitor summary (bsc#1051510).\n\n - tipc: fix RDM/DGRAM connect() regression (bsc#1051510).\n\n - tipc: fix uninit-value in tipc_nl_compat_bearer_enable (bsc#1051510).\n\n - tipc: fix uninit-value in tipc_nl_compat_doit (bsc#1051510).\n\n - tipc: fix uninit-value in tipc_nl_compat_link_reset_stats (bsc#1051510).\n\n - tipc: fix uninit-value in tipc_nl_compat_link_set (bsc#1051510).\n\n - tipc: fix uninit-value in tipc_nl_compat_name_table_dump (bsc#1051510).\n\n - tpm: fix kdoc for tpm2_flush_context_cmd() (bsc#1051510).\n\n - tpm: Fix some name collisions with drivers/char/tpm.h (bsc#1051510).\n\n - tpm: return a TPM_RC_COMMAND_CODE response if command is not implemented (bsc#1051510).\n\n - tpm: Return the actual size when receiving an unsupported command (bsc#1051510).\n\n - tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated (bsc#1051510).\n\n - tpm_tis_spi: Pass the SPI IRQ down to the driver (bsc#1051510).\n\n - tpm/tpm_crb: Avoid unaligned reads in crb_recv() (bsc#1051510).\n\n - tpm/tpm_i2c_infineon: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) (bsc#1051510).\n\n - tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x (bsc#1051510).\n\n - tpm: tpm_try_transmit() refactor error flow (bsc#1051510).\n\n - tracing: Do not free iter->trace in fail path of tracing_open_pipe() (bsc#1129581).\n\n - tracing/uprobes: Fix output for multiple string arguments (bsc#1126495).\n\n - tracing: Use strncpy instead of memcpy for string keys in hist triggers (bsc#1129625).\n\n - Tree connect for SMB3.1.1 must be signed for non-encrypted shares (bsc#1051510).\n\n - tty: ipwireless: Fix potential NULL pointer dereference (bsc#1051510).\n\n - tty: serial: samsung: Properly set flags in autoCTS mode (bsc#1051510).\n\n - ucc_geth: Reset BQL queue when stopping device (networking-stable-19_02_01).\n\n - ucma: fix a use-after-free in ucma_resolve_ip() (bsc#1051510).\n\n - uevent: add alloc_uevent_skb() helper (bsc#1122982).\n\n - uio: Reduce return paths from uio_write() (bsc#1051510).\n\n - Update config files. Remove conditional support for SMB2 and SMB3 :\n\n - Update patches.arch/s390-sles15-zcrypt-fix-specification-except ion.patch (LTC#174936, bsc#1123060, bsc#1123061).\n\n - Update patches.fixes/acpi-nfit-Block-function-zero-DSMs.patch (bsc#1051510, bsc#1121789).\n\n - Update patches.fixes/acpi-nfit-Fix-command-supported-detection.\n patch (bsc#1051510, bsc#1121789). Add more detailed bugzilla reference.\n\n - uprobes: Fix handle_swbp() vs. unregister() + register() race once more (bsc#1051510).\n\n - usb: Add new USB LPM helpers (bsc#1120902).\n\n - usb: cdc-acm: fix race during wakeup blocking TX traffic (bsc#1129770).\n\n - usb: common: Consider only available nodes for dr_mode (bsc#1129770).\n\n - usb: Consolidate LPM checks to avoid enabling LPM twice (bsc#1120902).\n\n - usb: core: only clean up what we allocated (bsc#1051510).\n\n - usb: dwc3: Correct the logic for checking TRB full in\n __dwc3_prepare_one_trb() (bsc#1051510).\n\n - usb: dwc3: gadget: Disable CSP for stream OUT ep (bsc#1051510).\n\n - usb: dwc3: gadget: Fix the uninitialized link_state when udc starts (bsc#1051510).\n\n - usb: dwc3: gadget: Handle 0 xfer length for OUT EP (bsc#1051510).\n\n - usb: dwc3: gadget: synchronize_irq dwc irq in suspend (bsc#1051510).\n\n - usb: gadget: f_hid: fix deadlock in f_hidg_write() (bsc#1129770).\n\n - usb: gadget: musb: fix short isoc packets with inventra dma (bsc#1051510).\n\n - usb: gadget: Potential NULL dereference on allocation error (bsc#1051510).\n\n - usb: gadget: udc: net2272: Fix bitwise and boolean operations (bsc#1051510).\n\n - usb: hub: delay hub autosuspend if USB3 port is still link training (bsc#1051510).\n\n - usb: mtu3: fix the issue about SetFeature(U1/U2_Enable) (bsc#1051510).\n\n - usb: musb: dsps: fix otg state machine (bsc#1051510).\n\n - usb: musb: dsps: fix runtime pm for peripheral mode (bsc#1120902).\n\n - usbnet: smsc95xx: fix rx packet alignment (bsc#1051510).\n\n - usb: phy: am335x: fix race condition in _probe (bsc#1051510).\n\n - usb: phy: fix link errors (bsc#1051510).\n\n - usb: phy: twl6030-usb: fix possible use-after-free on remove (bsc#1051510).\n\n - usb: serial: cp210x: add ID for Ingenico 3070 (bsc#1129770).\n\n - usb: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485 (bsc#1129770).\n\n - usb: serial: mos7720: fix mos_parport refcount imbalance on error path (bsc#1129770).\n\n - usb: serial: option: add Telit ME910 ECM composition (bsc#1129770).\n\n - usb: serial: option: set driver_info for SIM5218 and compatibles (bsc#1129770).\n\n - usb: serial: pl2303: add new PID to support PL2303TB (bsc#1051510).\n\n - usb: serial: simple: add Motorola Tetra TPG2200 device id (bsc#1051510).\n\n - veth: set peer GSO values (bsc#1051510).\n\n - vfio: ccw: fix cleanup if cp_prefetch fails (git-fixes).\n\n - vfio: ccw: process ssch with interrupts disabled (git-fixes).\n\n - vfs: Add iomap_seek_hole and iomap_seek_data helpers (bsc#1070995).\n\n - vfs: Add page_cache_seek_hole_data helper (bsc#1070995).\n\n - vfs: in iomap seek_(hole,data), return -ENXIO for negative offsets (bsc#1070995).\n\n - vhost: correctly check the return value of translate_desc() in log_used() (bsc#1051510).\n\n - vhost: log dirty page correctly (networking-stable-19_01_26).\n\n - vhost/vsock: fix uninitialized vhost_vsock->guest_cid (bsc#1051510).\n\n - video: clps711x-fb: release disp device node in probe() (bsc#1051510).\n\n - virtio-blk: Consider virtio_max_dma_size() for maximum segment size (bsc#1120008).\n\n - virtio: Introduce virtio_max_dma_size() (bsc#1120008).\n\n - virtio_net: Do not call free_old_xmit_skbs for xdp_frames (networking-stable-19_02_01).\n\n - virtio/s390: avoid race on vcdev->config (git-fixes).\n\n - virtio/s390: fix race in ccw_io_helper() (git-fixes).\n\n - vmci: Support upto 64-bit PPNs (bsc#1127286).\n\n - vsock: cope with memory allocation failure at socket creation time (bsc#1051510).\n\n - vxge: ensure data0 is initialized in when fetching firmware version information (bsc#1051510).\n\n - vxlan: Fix GRO cells race condition between receive and link delete (git-fixes).\n\n - vxlan: test dev->flags & IFF_UP before calling gro_cells_receive() (git-fixes).\n\n - vxlan: update skb dst pmtu on tx path (bsc#1123456).\n\n - w90p910_ether: remove incorrect __init annotation (bsc#1051510).\n\n - watchdog: docs: kernel-api: do not reference removed functions (bsc#1051510).\n\n - x86: Add TSX Force Abort CPUID/MSR (bsc#1121805).\n\n - x86/a.out: Clear the dump structure initially (bsc#1114279).\n\n - x86/apic: Provide apic_ack_irq() (bsc#1122822).\n\n - x86/boot/e820: Avoid overwriting e820_table_firmware (bsc#1127154).\n\n - x86/boot/e820: Introduce the bootloader provided e820_table_firmware[] table (bsc#1127154).\n\n - x86/boot/e820: Rename the e820_table_firmware to e820_table_kexec (bsc#1127154).\n\n - x86/cpu: Add Atom Tremont (Jacobsville) ().\n\n - x86/CPU/AMD: Set the CPB bit unconditionally on F17h (bsc#1114279).\n\n - x86/efi: Allocate e820 buffer before calling efi_exit_boot_service (bsc#1127307).\n\n - x86/Hyper-V: Set x2apic destination mode to physical when x2apic is available (bsc#1122822).\n\n - x86/kaslr: Fix incorrect i8254 outb() parameters (bsc#1114279).\n\n - x86/mce: Improve error message when kernel cannot recover, p2 (bsc#1114279).\n\n - x86/mtrr: Do not copy uninitialized gentry fields back to userspace (bsc#1114279).\n\n - x86/pkeys: Properly copy pkey state at fork() (bsc#1129366).\n\n - x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls (bsc#1125614).\n\n - x86: respect memory size limiting via mem= parameter (bsc#1117645).\n\n - x86/vdso: Remove obsolete 'fake section table' reservation (bsc#1114279).\n\n - x86/xen: dont add memory above max allowed allocation (bsc#1117645).\n\n - xen, cpu_hotplug: Prevent an out of bounds access (bsc#1065600).\n\n - xen: fix dom0 boot on huge systems (bsc#1127836).\n\n - xen/manage: do not complain about an empty value in control/sysrq node (bsc#1065600).\n\n - xen: remove pre-xen3 fallback handlers (bsc#1065600).\n\n - xfs: add option to mount with barrier=0 or barrier=1 (bsc#1088133).\n\n - xfs: fix contiguous dquot chunk iteration livelock (bsc#1070995).\n\n - xfs: remove filestream item xfs_inode reference (bsc#1127961).\n\n - xfs: rewrite xfs_dq_get_next_id using xfs_iext_lookup_extent (bsc#1070995).\n\n - xfs: Switch to iomap for SEEK_HOLE / SEEK_DATA (bsc#1070995).\n\n - yama: Check for pid death before checking ancestry (bsc#1051510).\n\n - yam: fix a missing-check bug (bsc#1051510).\n\n - zswap: re-check zswap_is_full() after do zswap_shrink() (bsc#1051510).\n\n - x86/uaccess: Do not leak the AC flag into __put_user() value evaluation (bsc#1114279).", "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-04-15T00:00:00", "type": "nessus", "title": "openSUSE Security Update : the Linux Kernel (openSUSE-2019-1193)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-2024", "CVE-2019-3819", "CVE-2019-7308", "CVE-2019-8912", "CVE-2019-8980", "CVE-2019-9213"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:kernel-debug", "p-cpe:/a:novell:opensuse:kernel-debug-base", "p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-debug-debuginfo", "p-cpe:/a:novell:opensuse:kernel-debug-debugsource", "p-cpe:/a:novell:opensuse:kernel-debug-devel", "p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default", "p-cpe:/a:novell:opensuse:kernel-default-base", "p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default-debugsource", "p-cpe:/a:novell:opensuse:kernel-default-devel", "p-cpe:/a:novell:opensuse:kernel-default-devel-debuginfo", "p-cpe:/a:novell:opensuse:kernel-devel", "p-cpe:/a:novell:opensuse:kernel-docs-html", "p-cpe:/a:novell:opensuse:kernel-kvmsmall", "p-cpe:/a:novell:opensuse:kernel-kvmsmall-base", "p-cpe:/a:novell:opensuse:kernel-kvmsmall-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-kvmsmall-debuginfo", "p-cpe:/a:novell:opensuse:kernel-kvmsmall-debugsource", "p-cpe:/a:novell:opensuse:kernel-kvmsmall-devel", "p-cpe:/a:novell:opensuse:kernel-kvmsmall-devel-debuginfo", "p-cpe:/a:novell:opensuse:kernel-macros", "p-cpe:/a:novell:opensuse:kernel-obs-build", "p-cpe:/a:novell:opensuse:kernel-obs-build-debugsource", "p-cpe:/a:novell:opensuse:kernel-obs-qa", "p-cpe:/a:novell:opensuse:kernel-source", "p-cpe:/a:novell:opensuse:kernel-source-vanilla", "p-cpe:/a:novell:opensuse:kernel-syms", "p-cpe:/a:novell:opensuse:kernel-vanilla", "p-cpe:/a:novell:opensuse:kernel-vanilla-base", "p-cpe:/a:novell:opensuse:kernel-vanilla-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo", "p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource", "p-cpe:/a:novell:opensuse:kernel-vanilla-devel", "p-cpe:/a:novell:opensuse:kernel-vanilla-devel-debuginfo", "cpe:/o:novell:opensuse:15.0"], "id": "OPENSUSE-2019-1193.NASL", "href": "https://www.tenable.com/plugins/nessus/124050", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2019-1193.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(124050);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2019-2024\", \"CVE-2019-3819\", \"CVE-2019-7308\", \"CVE-2019-8912\", \"CVE-2019-8980\", \"CVE-2019-9213\");\n\n script_name(english:\"openSUSE Security Update : the Linux Kernel (openSUSE-2019-1193)\");\n script_summary(english:\"Check for the openSUSE-2019-1193 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The openSUSE Leap 15.0 was updated to receive various security and\nbugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2019-2024: A use-after-free when disconnecting a\n source was fixed which could lead to crashes.\n bnc#1129179).\n\n - CVE-2019-3819: A flaw was found in the Linux kernel in\n the function hid_debug_events_read() in\n drivers/hid/hid-debug.c file which may enter an infinite\n loop with certain parameters passed from a userspace. A\n local privileged user ('root') can cause a system lock\n up and a denial of service. Versions from v4.18 and\n newer are vulnerable (bnc#1123161).\n\n - CVE-2019-7308: kernel/bpf/verifier.c performed\n undesirable out-of-bounds speculation on pointer\n arithmetic in various cases, including cases of\n different branches with different state or limits to\n sanitize, leading to side-channel attacks (bnc#1124055).\n\n - CVE-2019-8912: af_alg_release() in crypto/af_alg.c\n neglected to set a NULL value for a certain structure\n member, which leads to a use-after-free in\n sockfs_setattr (bnc#1125907).\n\n - CVE-2019-8980: A memory leak in the kernel_read_file\n function in fs/exec.c allowed attackers to cause a\n denial of service (memory consumption) by triggering\n vfs_read failures (bnc#1126209).\n\n - CVE-2019-9213: expand_downwards in mm/mmap.c lacked a\n check for the mmap minimum address, which made it easier\n for attackers to exploit kernel NULL pointer\n dereferences on non-SMAP platforms. This is related to a\n capability check for the wrong task (bnc#1128166).\n\nThe following non-security bugs were fixed :\n\n - 9p/net: fix memory leak in p9_client_create\n (bsc#1051510).\n\n - 9p: use inode->i_lock to protect i_size_write() under\n 32-bit (bsc#1051510).\n\n - acpi: acpi_pad: Do not launch acpi_pad threads on idle\n cpus (bsc#1113399).\n\n - acpi/APEI: Clear GHES block_status before panic()\n (bsc#1051510).\n\n - acpi/device_sysfs: Avoid OF modalias creation for\n removed device (bsc#1051510).\n\n - acpi/nfit: Fix bus command validation (bsc#1051510).\n\n - acpi: NUMA: Use correct type for printing addresses on\n i386-PAE (bsc#1051510).\n\n - acpi / video: Extend chassis-type detection with a\n 'Lunch Box' check (bsc#1051510).\n\n - acpi / video: Refactor and fix dmi_is_desktop()\n (bsc#1051510).\n\n - alsa: bebob: use more identical mod_alias for Saffire\n Pro 10 I/O against Liquid Saffire 56 (bsc#1051510).\n\n - alsa: compress: prevent potential divide by zero bugs\n (bsc#1051510).\n\n - alsa: echoaudio: add a check for ioremap_nocache\n (bsc#1051510).\n\n - alsa: firewire: add const qualifier to identifiers for\n read-only symbols (bsc#1051510).\n\n - alsa: firewire-motu: add a flag for AES/EBU on XLR\n interface (bsc#1051510).\n\n - alsa: firewire-motu: add specification flag for position\n of flag for MIDI messages (bsc#1051510).\n\n - alsa: firewire-motu: add support for MOTU Audio Express\n (bsc#1051510).\n\n - alsa: firewire-motu: add support for Motu Traveler\n (bsc#1051510).\n\n - alsa: firewire-motu: fix construction of PCM frame for\n capture direction (bsc#1051510).\n\n - alsa: firewire-motu: use 'version' field of unit\n directory to identify model (bsc#1051510).\n\n - alsa: hda - add Lenovo IdeaCentre B550 to the\n power_save_blacklist (bsc#1051510).\n\n - alsa: hda - Add quirk for HP EliteBook 840 G5\n (bsc#1051510).\n\n - alsa: hda - Enforces runtime_resume after S3 and S4 for\n each codec (bsc#1051510).\n\n - alsa: hda/realtek - Add support for Acer Aspire\n E5-523G/ES1-432 headset mic (bsc#1051510).\n\n - alsa: hda/realtek: Disable PC beep in passthrough on\n alc285 (bsc#1051510).\n\n - alsa: hda/realtek: Enable ASUS X441MB and X705FD headset\n MIC with ALC256 (bsc#1051510).\n\n - alsa: hda/realtek: Enable audio jacks of ASUS UX362FA\n with ALC294 (bsc#1051510).\n\n - alsa: hda/realtek: Enable headset MIC of Acer AIO with\n ALC286 (bsc#1051510).\n\n - alsa: hda/realtek: Enable headset MIC of Acer Aspire\n Z24-890 with ALC286 (bsc#1051510).\n\n - alsa: hda/realtek: Enable headset mic of ASUS P5440FF\n with ALC256 (bsc#1051510).\n\n - alsa: hda/realtek - Headset microphone and internal\n speaker support for System76 oryp5 (bsc#1051510).\n\n - alsa: hda/realtek - Headset microphone support for\n System76 darp5 (bsc#1051510).\n\n - alsa: hda/realtek - Reduce click noise on Dell Precision\n 5820 headphone (bsc#1126131).\n\n - alsa: hda - Record the current power state before\n suspend/resume calls (bsc#1051510).\n\n - alsa: opl3: fix mismatch between snd_opl3_drum_switch\n definition and declaration (bsc#1051510).\n\n - alsa: pcm: Do not suspend stream in unrecoverable PCM\n state (bsc#1051510).\n\n - alsa: pcm: Fix possible OOB access in PCM oss plugins\n (bsc#1051510).\n\n - alsa: rawmidi: Fix potential Spectre v1 vulnerability\n (bsc#1051510).\n\n - alsa: sb8: add a check for request_region (bsc#1051510).\n\n - alsa: seq: oss: Fix Spectre v1 vulnerability\n (bsc#1051510).\n\n - alsa: usb-audio: Fix implicit fb endpoint setup by quirk\n (bsc#1051510).\n\n - altera-stapl: check for a null key before strcasecmp'ing\n it (bsc#1051510).\n\n - apparmor: Fix aa_label_build() error handling for failed\n merges (bsc#1051510).\n\n - applicom: Fix potential Spectre v1 vulnerabilities\n (bsc#1051510).\n\n - aquantia: Setup max_mtu in ndev to enable jumbo frames\n (bsc#1051510).\n\n - arm64: fault: avoid send SIGBUS two times (bsc#1126393).\n\n - arm: 8808/1: kexec:offline panic_smp_self_stop CPU\n (bsc#1051510).\n\n - arm/arm64: KVM: Rename function\n kvm_arch_dev_ioctl_check_extension() (bsc#1126393).\n\n - arm: iop32x/n2100: fix PCI IRQ mapping (bsc#1051510).\n\n - arm: OMAP2+: hwmod: Fix some section annotations\n (bsc#1051510).\n\n - arm: pxa: avoid section mismatch warning (bsc#1051510).\n\n - arm: tango: Improve ARCH_MULTIPLATFORM compatibility\n (bsc#1051510).\n\n - ASoC: atom: fix a missing check of\n snd_pcm_lib_malloc_pages (bsc#1051510).\n\n - ASoC: dapm: change snprintf to scnprintf for possible\n overflow (bsc#1051510).\n\n - ASoC: fsl_esai: fix register setting issue in RIGHT_J\n mode (bsc#1051510).\n\n - ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on\n i.MX8M (bsc#1051510).\n\n - ASoC: imx-audmux: change snprintf to scnprintf for\n possible overflow (bsc#1051510).\n\n - ASoC: imx-sgtl5000: put of nodes if finding codec fails\n (bsc#1051510).\n\n - ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic\n field (bsc#1051510).\n\n - ASoC: msm8916-wcd-analog: add missing license\n information (bsc#1051510).\n\n - ASoC: qcom: Fix of-node refcount unbalance in\n apq8016_sbc_parse_of() (bsc#1051510).\n\n - ASoC: rsnd: fixup rsnd_ssi_master_clk_start() user count\n check (bsc#1051510).\n\n - assoc_array: Fix shortcut creation (bsc#1051510).\n\n - ata: ahci: mvebu: remove stale comment (bsc#1051510).\n\n - ath9k: Avoid OF no-EEPROM quirks without qca,no-eeprom\n (bsc#1051510).\n\n - ath9k: dynack: check da->enabled first in sampling\n routines (bsc#1051510).\n\n - ath9k: dynack: make ewma estimation faster\n (bsc#1051510).\n\n - ath9k: dynack: use authentication messages for 'late'\n ack (bsc#1051510).\n\n - atm: he: fix sign-extension overflow on large shift\n (bsc#1051510).\n\n - auxdisplay: hd44780: Fix memory leak on ->remove()\n (bsc#1051510).\n\n - auxdisplay: ht16k33: fix potential user-after-free on\n module unload (bsc#1051510).\n\n - ax25: fix possible use-after-free (bsc#1051510).\n\n - backlight: pwm_bl: Use gpiod_get_value_cansleep() to get\n initial (bsc#1113722)\n\n - batman-adv: Avoid WARN on net_device without parent in\n netns (bsc#1051510).\n\n - batman-adv: fix uninit-value in batadv_interface_tx()\n (bsc#1051510).\n\n - batman-adv: Force mac header to start of data on xmit\n (bsc#1051510).\n\n - bio: Introduce BIO_ALLOCED flag and check it in bio_free\n (bsc#1128094).\n\n - blk-mq: fix a hung issue when fsync (bsc#1125252).\n\n - block_dev: fix crash on chained bios with O_DIRECT\n (bsc#1128094).\n\n - block_dev: fix crash on chained bios with O_DIRECT\n (bsc#1128094).\n\n - blockdev: Fix livelocks on loop device (bsc#1124984).\n\n - block: do not use bio->bi_vcnt to figure out segment\n number (bsc#1128895).\n\n - block: do not warn when doing fsync on read-only devices\n (bsc#1125252).\n\n - block/loop: Use global lock for ioctl() operation\n (bsc#1124974).\n\n - block: move bio_integrity_(intervals,bytes) into\n blkdev.h (bsc#1114585).\n\n - bluetooth: Fix decrementing reference count twice in\n releasing socket (bsc#1051510).\n\n - bluetooth: Fix locking in bt_accept_enqueue() for BH\n context (bsc#1051510).\n\n - bluetooth: Fix unnecessary error message for HCI request\n completion (bsc#1051510).\n\n - bluetooth: hci_ldisc: Initialize hci_dev before open()\n (bsc#1051510).\n\n - bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit\n set in hci_uart_set_proto() (bsc#1051510).\n\n - bnxt_en: Fix typo in firmware message timeout logic\n (bsc#1086282 ).\n\n - bnxt_en: Wait longer for the firmware message response\n to complete (bsc#1086282).\n\n - bpf: decrease usercnt if bpf_map_new_fd() fails in\n bpf_map_get_fd_by_id() (bsc#1083647).\n\n - bpf: drop refcount if bpf_map_new_fd() fails in\n map_create() (bsc#1083647).\n\n - bpf: fix lockdep false positive in percpu_freelist\n (bsc#1083647).\n\n - bpf: fix replace_map_fd_with_map_ptr's ldimm64 second\n imm field (bsc#1083647).\n\n - bpf: fix sanitation rewrite in case of non-pointers\n (bsc#1083647).\n\n - bpf: Fix syscall's stackmap lookup potential deadlock\n (bsc#1083647).\n\n - bpf, lpm: fix lookup bug in map_delete_elem\n (bsc#1083647).\n\n - bpf/verifier: fix verifier instability (bsc#1056787).\n\n - bsg: Do not copy sense if no response buffer is\n allocated (bsc#1106811,bsc#1126555).\n\n - btrfs: dedupe_file_range ioctl: remove 16MiB restriction\n (bsc#1127494).\n\n - btrfs: do not unnecessarily pass write_lock_level when\n processing leaf (bsc#1126802).\n\n - btrfs: ensure that a DUP or RAID1 block group has\n exactly two stripes (bsc#1128451).\n\n - btrfs: fix clone vs chattr NODATASUM race (bsc#1127497).\n\n - btrfs: fix corruption reading shared and compressed\n extents after hole punching (bsc#1126476).\n\n - btrfs: fix deadlock between clone/dedupe and rename\n (bsc#1130518).\n\n - btrfs: fix deadlock when allocating tree block during\n leaf/node split (bsc#1126806).\n\n - btrfs: fix deadlock when using free space tree due to\n block group creation (bsc#1126804).\n\n - btrfs: fix fsync after succession of renames and\n unlink/rmdir (bsc#1126488).\n\n - btrfs: fix fsync after succession of renames of\n different files (bsc#1126481).\n\n - btrfs: fix invalid-free in btrfs_extent_same\n (bsc#1127498).\n\n - btrfs: fix reading stale metadata blocks after degraded\n raid1 mounts (bsc#1126803).\n\n - btrfs: fix use-after-free of cmp workspace pages\n (bsc#1127603).\n\n - btrfs: grab write lock directly if write_lock_level is\n the max level (bsc#1126802).\n\n - btrfs: Improve btrfs_search_slot description\n (bsc#1126802).\n\n - btrfs: move get root out of btrfs_search_slot to a\n helper (bsc#1126802).\n\n - btrfs: qgroup: Cleanup old subtree swap code\n (bsc#1063638).\n\n - btrfs: qgroup: Do not trace subtree if we're dropping\n reloc tree (bsc#1063638).\n\n - btrfs: qgroup: Finish rescan when hit the last leaf of\n extent tree (bsc#1129327).\n\n - btrfs: qgroup: Introduce function to find all new tree\n blocks of reloc tree (bsc#1063638).\n\n - btrfs: qgroup: Introduce function to trace two swaped\n extents (bsc#1063638).\n\n - btrfs: qgroup: Introduce per-root swapped blocks\n infrastructure (bsc#1063638).\n\n - btrfs: qgroup: Introduce trace event to analyse the\n number of dirty extents accounted (bsc#1063638\n dependency).\n\n - btrfs: qgroup: Make qgroup async transaction commit more\n aggressive (bsc#1113042).\n\n - btrfs: qgroup: Only trace data extents in leaves if\n we're relocating data block group (bsc#1063638).\n\n - btrfs: qgroup: Refactor btrfs_qgroup_trace_subtree_swap\n (bsc#1063638).\n\n - btrfs: qgroup: Search commit root for rescan to avoid\n missing extent (bsc#1129326).\n\n - btrfs: qgroup: Use delayed subtree rescan for balance\n (bsc#1063638).\n\n - btrfs: qgroup: Use generation-aware subtree swap to mark\n dirty extents (bsc#1063638).\n\n - btrfs: quota: Set rescan progress to (u64)-1 if we hit\n last leaf (bsc#1129327).\n\n - btrfs: relocation: Delay reloc tree deletion after\n merge_reloc_roots (bsc#1063638).\n\n - btrfs: reloc: Fix NULL pointer dereference due to\n expanded reloc_root lifespan (bsc#1129497).\n\n - btrfs: remove always true check in unlock_up\n (bsc#1126802).\n\n - btrfs: remove superfluous free_extent_buffer in\n read_block_for_search (bsc#1126802).\n\n - btrfs: remove unnecessary level check in balance_level\n (bsc#1126802).\n\n - btrfs: remove unused check of skip_locking\n (bsc#1126802).\n\n - btrfs: reuse cmp workspace in EXTENT_SAME ioctl\n (bsc#1127495).\n\n - btrfs: send, fix race with transaction commits that\n create snapshots (bsc#1126802).\n\n - btrfs: simplify IS_ERR/PTR_ERR checks (bsc#1126481).\n\n - btrfs: split btrfs_extent_same (bsc#1127493).\n\n - btrfs: use kvzalloc for EXTENT_SAME temporary data\n (bsc#1127496).\n\n - btrfs: use more straightforward extent_buffer_uptodate\n check (bsc#1126802).\n\n - cdc-wdm: pass return value of recover_from_urb_loss\n (bsc#1051510).\n\n - ceph: avoid repeatedly adding inode to\n mdsc->snap_flush_list (bsc#1126790).\n\n - ceph: clear inode pointer when snap realm gets dropped\n by its inode (bsc#1125799).\n\n - cfg80211: extend range deviation for DMG (bsc#1051510).\n\n - ch: add missing mutex_lock()/mutex_unlock() in\n ch_release() (bsc#1124235).\n\n - ch: fixup refcounting imbalance for SCSI devices\n (bsc#1124235).\n\n - cifs: allow guest mounts to work for smb3.11\n (bsc#1051510).\n\n - cifs: Always resolve hostname before reconnecting\n (bsc#1051510).\n\n - cifs: connect to servername instead of IP for IPC$ share\n (bsc#1051510).\n\n - cifs: Fix NULL pointer dereference of devname\n (bnc#1129519).\n\n - cifs: invalidate cache when we truncate a file\n (bsc#1051510).\n\n - cifs: OFD locks do not conflict with eachothers\n (bsc#1051510).\n\n - clk: armada-370: fix refcount leak in a370_clk_init()\n (bsc#1051510).\n\n - clk: armada-xp: fix refcount leak in axp_clk_init()\n (bsc#1051510).\n\n - clk: clk-twl6040: Fix imprecise external abort for\n pdmclk (bsc#1051510).\n\n - clk: dove: fix refcount leak in dove_clk_init()\n (bsc#1051510).\n\n - clk: highbank: fix refcount leak in hb_clk_init()\n (bsc#1051510).\n\n - clk: imx6q: fix refcount leak in imx6q_clocks_init()\n (bsc#1051510).\n\n - clk: imx6sl: ensure MMDC CH0 handshake is bypassed\n (bsc#1051510).\n\n - clk: imx6sx: fix refcount leak in imx6sx_clocks_init()\n (bsc#1051510).\n\n - clk: imx7d: fix refcount leak in imx7d_clocks_init()\n (bsc#1051510).\n\n - clk: ingenic: Fix doc of ingenic_cgu_div_info\n (bsc#1051510).\n\n - clk: ingenic: Fix round_rate misbehaving with\n non-integer dividers (bsc#1051510).\n\n - clk: kirkwood: fix refcount leak in kirkwood_clk_init()\n (bsc#1051510).\n\n - clk: mv98dx3236: fix refcount leak in\n mv98dx3236_clk_init() (bsc#1051510).\n\n - clk: qoriq: fix refcount leak in clockgen_init()\n (bsc#1051510).\n\n - clk: samsung: exynos4: fix refcount leak in\n exynos4_get_xom() (bsc#1051510).\n\n - clk: socfpga: fix refcount leak (bsc#1051510).\n\n - clk: sunxi: A31: Fix wrong AHB gate number\n (bsc#1051510).\n\n - clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all\n audio module clocks (bsc#1051510).\n\n - clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when\n ungating it (bsc#1051510).\n\n - clk: sunxi-ng: v3s: Fix TCON reset de-assert bit\n (bsc#1051510).\n\n - clk: uniphier: Fix update register for CPU-gear\n (bsc#1051510).\n\n - clk: vc5: Abort clock configuration without upstream\n clock (bsc#1051510).\n\n - clk: vf610: fix refcount leak in vf610_clocks_init()\n (bsc#1051510).\n\n - clocksource/drivers/exynos_mct: Clear timer interrupt\n when shutdown (bsc#1051510).\n\n - clocksource/drivers/exynos_mct: Fix error path in timer\n resources initialization (bsc#1051510).\n\n - clocksource/drivers/exynos_mct: Move one-shot check from\n tick clear to ISR (bsc#1051510).\n\n - clocksource/drivers/integrator-ap: Add missing\n of_node_put() (bsc#1051510).\n\n - clocksource/drivers/sun5i: Fail gracefully when clock\n rate is unavailable (bsc#1051510).\n\n - configfs: fix registered group removal (bsc#1051510).\n\n - copy_mount_string: Limit string length to PATH_MAX\n (bsc#1082943).\n\n - cpcap-charger: generate events for userspace\n (bsc#1051510).\n\n - cpufreq: Cap the default transition delay value to 10 ms\n (bsc#1127042).\n\n - cpufreq: conservative: Take limits changes into account\n properly (bsc#1051510).\n\n - cpufreq: governor: Avoid accessing invalid governor_data\n (bsc#1051510).\n\n - cpufreq: governor: Drop min_sampling_rate (bsc#1127042).\n\n - cpufreq: governor: Ensure sufficiently large sampling\n intervals (bsc#1127042).\n\n - cpufreq: pxa2xx: remove incorrect __init annotation\n (bsc#1051510).\n\n - cpufreq: tegra124: add missing of_node_put()\n (bsc#1051510).\n\n - cpufreq: Use transition_delay_us for legacy governors as\n well (bsc#1127042).\n\n - cpuidle: big.LITTLE: fix refcount leak (bsc#1051510).\n\n - crypto: aes_ti - disable interrupts while accessing\n S-box (bsc#1051510).\n\n - crypto: ahash - fix another early termination in hash\n walk (bsc#1051510).\n\n - crypto: arm64/aes-ccm - fix logical bug in AAD MAC\n handling (bsc#1051510).\n\n - crypto: arm/crct10dif - revert to C code for short\n inputs (bsc#1051510).\n\n - crypto: brcm - Fix some set-but-not-used warning\n (bsc#1051510).\n\n - crypto: caam - fixed handling of sg list (bsc#1051510).\n\n - crypto: cavium/zip - fix collision with generic\n cra_driver_name (bsc#1051510).\n\n - crypto: crypto4xx - add missing of_node_put after\n of_device_is_available (bsc#1051510).\n\n - crypto: crypto4xx - Fix wrong\n ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments\n (bsc#1051510).\n\n - crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey()\n fails (bsc#1051510).\n\n - crypto: testmgr - skip crc32c context test for ahash\n algorithms (bsc#1051510).\n\n - crypto: tgr192 - fix unaligned memory access\n (bsc#1051510).\n\n - crypto: ux500 - Use proper enum in cryp_set_dma_transfer\n (bsc#1051510).\n\n - crypto: ux500 - Use proper enum in hash_set_dma_transfer\n (bsc#1051510).\n\n - cw1200: drop useless LIST_HEAD (bsc#1051510).\n\n - cw1200: Fix concurrency use-after-free bugs in\n cw1200_hw_scan() (bsc#1051510).\n\n - cw1200: fix missing unlock on error in cw1200_hw_scan()\n (bsc#1051510).\n\n - dccp: fool proof ccid_hc_[rt]x_parse_options()\n (bsc#1051510).\n\n - debugfs: fix debugfs_rename parameter checking\n (bsc#1051510).\n\n - device property: Fix the length used in\n PROPERTY_ENTRY_STRING() (bsc#1051510).\n\n - dlm: Do not swamp the CPU with callbacks queued during\n recovery (bsc#1051510).\n\n - dmaengine: at_hdmac: drop useless LIST_HEAD\n (bsc#1051510).\n\n - dmaengine: at_xdmac: Fix wrongfull report of a channel\n as in use (bsc#1051510).\n\n - dmaengine: bcm2835: Fix abort of transactions\n (bsc#1051510).\n\n - dmaengine: bcm2835: Fix interrupt race on RT\n (bsc#1051510).\n\n - dmaengine: dmatest: Abort test in case of mapping error\n (bsc#1051510).\n\n - dmaengine: dw: drop useless LIST_HEAD (bsc#1051510).\n\n - dmaengine: imx-dma: fix wrong callback invoke\n (bsc#1051510).\n\n - dmaengine: mv_xor: Use correct device for DMA API\n (bsc#1051510).\n\n - dmaengine: pl330: drop useless LIST_HEAD (bsc#1051510).\n\n - dmaengine: sa11x0: drop useless LIST_HEAD (bsc#1051510).\n\n - dmaengine: st_fdma: drop useless LIST_HEAD\n (bsc#1051510).\n\n - dmaengine: stm32-dma: fix incomplete configuration in\n cyclic mode (bsc#1051510).\n\n - dma: Introduce dma_max_mapping_size() (bsc#1120008).\n\n - doc: rcu: Suspicious RCU usage is a warning\n (bsc#1051510).\n\n - Do not log confusing message on reconnect by default\n (bsc#1129664).\n\n - driver core: Do not resume suppliers under\n device_links_write_lock() (bsc#1051510).\n\n - drivers: hv: vmbus: Check for ring when getting debug\n info (bsc#1126389, bsc#1126579).\n\n - drivers: hv: vmbus: preserve hv_ringbuffer_get_debuginfo\n kABI (bsc#1126389, bsc#1126579).\n\n - drivers: hv: vmbus: Return -EINVAL for the sys files for\n unopened channels (bsc#1126389, bsc#1126579).\n\n - drm/amdgpu: Add delay after enable RLC ucode\n (bsc#1051510).\n\n - drm/ast: Fix connector leak during driver unload\n (bsc#1051510).\n\n - drm/ast: fixed reading monitor EDID not stable issue\n (bsc#1051510).\n\n - drm/atomic-helper: Complete fake_commit->flip_done\n potentially earlier (bsc#1051510).\n\n - drm: Block fb changes for async plane updates\n (bsc#1051510).\n\n - drm/bridge: tc358767: add defines for DP1_SRCCTRL &\n PHY_2LANE (bsc#1051510).\n\n - drm/bridge: tc358767: fix initial DP0/1_SRCCTRL value\n (bsc#1051510).\n\n - drm/bridge: tc358767: fix output H/V syncs\n (bsc#1051510).\n\n - drm/bridge: tc358767: fix single lane configuration\n (bsc#1051510).\n\n - drm/bridge: tc358767: reject modes which require too\n much BW (bsc#1051510).\n\n - drm/bufs: Fix Spectre v1 vulnerability (bsc#1051510).\n\n - drm: Clear state->acquire_ctx before leaving\n drm_atomic_helper_commit_duplicated_state()\n (bsc#1051510).\n\n - drm: disable uncached DMA optimization for ARM and arm64\n (bsc#1051510).\n\n - drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump()\n (bsc#1113722)\n\n - drm/etnaviv: potential NULL dereference (bsc#1113722)\n\n - drm: Fix error handling in drm_legacy_addctx\n (bsc#1113722)\n\n - drm/i915/bios: assume eDP is present on port A when\n there is no VBT (bsc#1051510).\n\n - drm/i915: Block fbdev HPD processing during suspend\n (bsc#1113722)\n\n - drm/i915/fbdev: Actually configure untiled displays\n (bsc#1113722)\n\n - drm/i915: Flush GPU relocs harder for gen3 (bsc#1113722)\n\n - drm/i915/gvt: free VFIO region space in vgpu detach\n (bsc#1113722)\n\n - drm/i915/gvt: release shadow batch buffer and wa_ctx\n before destroy one workload (bsc#1051510).\n\n - drm/i915/opregion: fix version check (bsc#1113722)\n\n - drm/i915/opregion: rvda is relative from opregion base\n in opregion (bsc#1113722)\n\n - drm/i915: Prevent a race during I915_GEM_MMAP ioctl with\n WC set (bsc#1113722)\n\n - drm/i915: Redefine some Whiskey Lake SKUs (bsc#1051510).\n\n - drm/i915: Relax mmap VMA check (bsc#1051510).\n\n - drm/i915: Use the correct crtc when sanitizing plane\n mapping (bsc#1113722)\n\n - drm/imx: ignore plane updates on disabled crtcs\n (bsc#1051510).\n\n - drm/imx: imx-ldb: add missing of_node_puts\n (bsc#1051510).\n\n - drm/meson: add missing of_node_put (bsc#1051510).\n\n - drm/modes: Prevent division by zero htotal\n (bsc#1051510).\n\n - drm/msm: Fix error return checking (bsc#1051510).\n\n - drm/msm: Grab a vblank reference when waiting for\n commit_done (bsc#1051510).\n\n - drm/msm: Unblock writer if reader closes file\n (bsc#1051510).\n\n - drm/nouveau/bios/ramcfg: fix missing parentheses when\n calculating RON (bsc#1113722)\n\n - drm/nouveau/debugfs: Fix check of pm_runtime_get_sync\n failure (bsc#1051510).\n\n - drm/nouveau: Do not spew kernel WARNING for each timeout\n (bsc#1126480).\n\n - drm/nouveau: Do not WARN_ON VCPI allocation failures\n (bsc#1113722)\n\n - drm/nouveau/falcon: avoid touching registers if engine\n is off (bsc#1051510).\n\n - drm/nouveau/pmu: do not print reply values if exec is\n false (bsc#1113722)\n\n - drm/radeon/evergreen_cs: fix missing break in switch\n statement (bsc#1113722)\n\n - drm: Reorder set_property_atomic to avoid returning with\n an active ww_ctx (bsc#1051510).\n\n - drm/rockchip: fix for mailbox read size (bsc#1051510).\n\n - drm/shmob: Fix return value check in shmob_drm_probe\n (bsc#1113722)\n\n - drm/sun4i: tcon: Prepare and enable TCON channel 0 clock\n at init (bsc#1051510).\n\n - drm/vmwgfx: Do not double-free the mode stored in\n par->set_mode (bsc#1103429)\n\n - earlycon: Initialize port->uartclk based on\n clock-frequency property (bsc#1051510).\n\n - earlycon: Remove hardcoded port->uartclk initialization\n in of_setup_earlycon (bsc#1051510).\n\n - Enable CONFIG_RDMA_RXE=m also for ppc64le (bsc#1107665,)\n\n - Enable livepatch test drivers in lib/ Livepatch\n kselftests need those.\n\n - enic: fix build warning without CONFIG_CPUMASK_OFFSTACK\n (bsc#1051510).\n\n - enic: fix checksum validation for IPv6 (bsc#1051510).\n\n - esp6: fix memleak on error path in esp6_input\n (bsc#1051510).\n\n - esp: Fix locking on page fragment allocation\n (bsc#1051510).\n\n - esp: Fix memleaks on error paths (bsc#1051510).\n\n - esp: Fix skb tailroom calculation (bsc#1051510).\n\n - ext4: avoid kernel warning when writing the superblock\n to a dead device (bsc#1124981).\n\n - ext4: Avoid panic during forced reboot (bsc#1126356).\n\n - ext4: check for shutdown and r/o file system in\n ext4_write_inode() (bsc#1124978).\n\n - ext4: fix a potential fiemap/page fault deadlock w/\n inline_data (bsc#1124980).\n\n - ext4: force inode writes when nfsd calls\n commit_metadata() (bsc#1125125).\n\n - ext4: include terminating u32 in size of xattr entries\n when expanding inodes (bsc#1124976).\n\n - ext4: make sure enough credits are reserved for\n dioread_nolock writes (bsc#1124979).\n\n - ext4: track writeback errors using the generic tracking\n infrastructure (bsc#1124982).\n\n - fbdev: chipsfb: remove set but not used variable 'size'\n (bsc#1113722)\n\n - firmware/efi: Add NULL pointer checks in efivars API\n functions (bsc#1051510).\n\n - floppy: check_events callback should not return a\n negative number (bsc#1051510).\n\n - fs/dax: deposit pagetable even when installing zero page\n (bsc#1126740).\n\n - fs/dcache: Fix incorrect nr_dentry_unused accounting in\n shrink_dcache_sb() (git-fixes).\n\n - fs/devpts: always delete dcache dentry-s in dput()\n (git-fixes).\n\n - fuse: call pipe_buf_release() under pipe lock\n (bsc#1051510).\n\n - fuse: continue to send FUSE_RELEASEDIR when FUSE_OPEN\n returns ENOSYS (bsc#1051510).\n\n - fuse: decrement NR_WRITEBACK_TEMP on the right page\n (bsc#1051510).\n\n - fuse: handle zero sized retrieve correctly\n (bsc#1051510).\n\n - futex: Fix (possible) missed wakeup (bsc#1050549).\n\n - gdrom: fix a memory leak bug (bsc#1051510).\n\n - geneve: cleanup hard coded value for Ethernet header\n length (bsc#1123456).\n\n - geneve: correctly handle ipv6.disable module parameter\n (bsc#1051510).\n\n - geneve, vxlan: Do not check skb_dst() twice\n (bsc#1123456).\n\n - geneve, vxlan: Do not set exceptions if skb->len < mtu\n (bsc#1123456).\n\n - genwqe: Fix size check (bsc#1051510).\n\n - gfs2: Revert 'Fix loop in gfs2_rbm_find' (bsc#1120601).\n\n - gianfar: fix a flooded alignment reports because of\n padding issue (bsc#1051510).\n\n - gianfar: Fix Rx byte accounting for ndev stats\n (bsc#1051510).\n\n - gianfar: prevent integer wrapping in the rx handler\n (bsc#1051510).\n\n - gpu: ipu-v3: Fix CSI offsets for imx53 (bsc#1113722)\n\n - gpu: ipu-v3: Fix i.MX51 CSI control registers offset\n (bsc#1113722)\n\n - gpu: ipu-v3: image-convert: Prevent race between run and\n unprepare (bsc#1051510).\n\n - gro_cells: make sure device is up in gro_cells_receive()\n (git-fixes).\n\n - hid: lenovo: Add checks to fix of_led_classdev_register\n (bsc#1051510).\n\n - hpet: Fix missing '=' character in the __setup() code of\n hpet_mmap_enable (git-fixes).\n\n - hvc_opal: do not set tb_ticks_per_usec in\n udbg_init_opal_common() (bsc#1051510).\n\n - hv: reduce storvsc_ringbuffer_size from 1M to 128K to\n simplify booting with 1k vcpus ().\n\n - hv: v4.12 API for hyperv-iommu (bsc#1122822).\n\n - hwmon: (lm80) fix a missing check of bus read in lm80\n probe (bsc#1051510).\n\n - hwmon: (lm80) fix a missing check of the status of SMBus\n read (bsc#1051510).\n\n - hwmon: (lm80) Fix missing unlock on error in\n set_fan_div() (bsc#1051510).\n\n - hwmon: (tmp421) Correct the misspelling of the tmp442\n compatible attribute in OF device ID table\n (bsc#1051510).\n\n - HYPERV/IOMMU: Add Hyper-V stub IOMMU driver\n (bsc#1122822).\n\n - i2c-axxia: check for error conditions first\n (bsc#1051510).\n\n - i2c: bcm2835: Clear current buffer pointers and counts\n after a transfer (bsc#1051510).\n\n - i2c: cadence: Fix the hold bit setting (bsc#1051510).\n\n - i2c: omap: Use noirq system sleep pm ops to idle device\n for suspend (bsc#1051510).\n\n - i2c: sh_mobile: add support for r8a77990 (R-Car E3)\n (bsc#1051510).\n\n - i2c: tegra: fix maximum transfer size (bsc#1051510).\n\n - ib/core: Destroy QP if XRC QP fails (bsc#1046306).\n\n - ib/core: Fix potential memory leak while creating MAD\n agents (bsc#1046306).\n\n - ib/core: Unregister notifier before freeing MAD security\n (bsc#1046306).\n\n - ib/hfi1: Close race condition on user context disable\n and close (bsc#1060463).\n\n - ib/mlx5: Unmap DMA addr from HCA before IOMMU\n (bsc#1046305 ).\n\n - ibmvnic: Report actual backing device speed and duplex\n values (bsc#1129923).\n\n - ibmvscsi: Fix empty event pool access during host\n removal (bsc#1119019).\n\n - ibmvscsi: Protect ibmvscsi_head from concurrent\n modificaiton (bsc#1119019).\n\n - ieee802154: ca8210: fix possible u8 overflow in\n ca8210_rx_done (bsc#1051510).\n\n - igb: Fix an issue that PME is not enabled during runtime\n suspend (bsc#1051510).\n\n - iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID\n (bsc#1051510).\n\n - iio: adc: exynos-adc: Fix NULL pointer exception on\n unbind (bsc#1051510).\n\n - iio: chemical: atlas-ph-sensor: correct IIO_TEMP values\n to millicelsius (bsc#1051510).\n\n - Input: bma150 - register input device after setting\n private data (bsc#1051510).\n\n - input: cap11xx - switch to using\n set_brightness_blocking() (bsc#1051510).\n\n - Input: elan_i2c - add ACPI ID for touchpad in Lenovo\n V330-15ISK (bsc#1051510).\n\n - Input: elan_i2c - add id for touchpad found in Lenovo\n s21e-20 (bsc#1051510).\n\n - Input: elantech - enable 3rd button support on Fujitsu\n CELSIUS H780 (bsc#1051510).\n\n - input: matrix_keypad - use flush_delayed_work()\n (bsc#1051510).\n\n - Input: raspberrypi-ts - select CONFIG_INPUT_POLLDEV\n (git-fixes).\n\n - input: st-keyscan - fix potential zalloc NULL\n dereference (bsc#1051510).\n\n - input: uinput - fix undefined behavior in\n uinput_validate_absinfo() (bsc#1120902).\n\n - Input: wacom_serial4 - add support for Wacom ArtPad II\n tablet (bsc#1051510).\n\n - intel_th: Do not reference unassigned outputs\n (bsc#1051510).\n\n - intel_th: gth: Fix an off-by-one in output unassigning\n (bsc#1051510).\n\n - iomap: fix integer truncation issues in the zeroing and\n dirtying helpers (bsc#1125947).\n\n - iomap: warn on zero-length mappings (bsc#1127062).\n\n - iommu/amd: Fix NULL dereference bug in match_hid_uid\n (bsc#1130336).\n\n - iommu/amd: fix sg->dma_address for sg->offset bigger\n than PAGE_SIZE (bsc#1130337).\n\n - iommu/amd: Reserve exclusion range in iova-domain\n (bsc#1130425).\n\n - iommu/dmar: Fix buffer overflow during PCI bus\n notification (bsc#1129181).\n\n - iommu: Document iommu_ops.is_attach_deferred()\n (bsc#1129182).\n\n - iommu: Do not print warning when IOMMU driver only\n supports unmanaged domains (bsc#1130130).\n\n - iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables\n (bsc#1129205).\n\n - iommu/vt-d: Check capability before disabling protected\n memory (bsc#1130338).\n\n - iommu/vt-d: Check identity map for hot-added devices\n (bsc#1129183).\n\n - iommu/vt-d: Fix NULL pointer reference in\n intel_svm_bind_mm() (bsc#1129184).\n\n - ip6: fix PMTU discovery when using /127 subnets\n (git-fixes).\n\n - ip6mr: Do not call __IP6_INC_STATS() from preemptible\n context (git-fixes).\n\n - ip6_tunnel: get the min mtu properly in ip6_tnl_xmit\n (bsc#1123456).\n\n - ip6_tunnel: use the right value for ipv4 min mtu check\n in ip6_tnl_xmit (bsc#1123456).\n\n - ipsec: check return value of skb_to_sgvec always\n (bsc#1051510).\n\n - ipv4/route: fail early when inet dev is missing\n (git-fixes).\n\n - ipv4: speedup ipv6 tunnels dismantle (bsc#1122982).\n\n - ipv6: addrlabel: per netns list (bsc#1122982).\n\n - ipv6: Consider sk_bound_dev_if when binding a socket to\n an address (networking-stable-19_02_01).\n\n - ipv6: Consider sk_bound_dev_if when binding a socket to\n a v4 mapped address (networking-stable-19_01_22).\n\n - ipv6: fix kernel-infoleak in ipv6_local_error()\n (networking-stable-19_01_20).\n\n - ipv6: speedup ipv6 tunnels dismantle (bsc#1122982).\n Refresh\n patches.suse/ip6_vti-fix-a-null-pointer-deference-when-d\n estroy-vt.patch\n\n - ipv6: Take rcu_read_lock in __inet6_bind for mapped\n addresses (networking-stable-19_01_22).\n\n - ipvlan, l3mdev: fix broken l3s mode wrt local routes\n (networking-stable-19_02_01).\n\n - irqchip/gic-v3-its: Align PCI Multi-MSI allocation on\n their size (bsc#1051510).\n\n - irqchip/gic-v3-its: Avoid parsing _indirect_ twice for\n Device table (bsc#1051510).\n\n - irqchip/gic-v3-its: Do not bind LPI to unavailable NUMA\n node (bsc#1051510).\n\n - irqchip/gic-v3-its: Fix ITT_entry_size accessor\n (bsc#1051510).\n\n - irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on\n enable/disable (bsc#1051510).\n\n - iscsi_ibft: Fix missing break in switch statement\n (bsc#1051510).\n\n - isdn: avm: Fix string plus integer warning from Clang\n (bsc#1051510).\n\n - isdn: hisax: hfc_pci: Fix a possible concurrency\n use-after-free bug in HFCPCI_l1hw() (bsc#1051510).\n\n - isdn: i4l: isdn_tty: Fix some concurrency double-free\n bugs (bsc#1051510).\n\n - iser: set sector for ambiguous mr status errors\n (bsc#1051510).\n\n - iwlwifi: mvm: avoid possible access out of array\n (bsc#1051510).\n\n - iwlwifi: mvm: fix A-MPDU reference assignment\n (bsc#1051510).\n\n - iwlwifi: mvm: fix firmware statistics usage\n (bsc#1129770).\n\n - iwlwifi: mvm: fix RSS config command (bsc#1051510).\n\n - iwlwifi: pcie: fix emergency path (bsc#1051510).\n\n - iwlwifi: pcie: fix TX while flushing (bsc#1120902).\n\n - ixgbe: Be more careful when modifying MAC filters\n (bsc#1051510).\n\n - ixgbe: check return value of napi_complete_done()\n (bsc#1051510).\n\n - ixgbe: recognize 1000BaseLX SFP modules as 1Gbps\n (bsc#1051510).\n\n - kabi: cpufreq: keep min_sampling_rate in struct dbs_data\n (bsc#1127042).\n\n - kabi: handle addition of ip6addrlbl_table into struct\n netns_ipv6 (bsc#1122982).\n\n - kabi: handle addition of uevent_sock into struct net\n (bsc#1122982).\n\n - kabi: Preserve kABI for dma_max_mapping_size()\n (bsc#1120008).\n\n - kabi: protect vhost_log_write (kabi).\n\n - kabi: restore ip_tunnel_delete_net() (bsc#1122982).\n\n - kabi workaround for ath9k ath_node.ackto type change\n (bsc#1051510).\n\n - kABI workaround for bt_accept_enqueue() change\n (bsc#1051510).\n\n - kallsyms: Handle too long symbols in kallsyms.c\n (bsc#1126805).\n\n - kasan: fix shadow_size calculation error in\n kasan_module_alloc (bsc#1051510).\n\n - kbuild: fix false positive warning/error about missing\n libelf (bsc#1051510).\n\n - kconfig: fix file name and line number of\n warn_ignored_character() (bsc#1051510).\n\n - kconfig: fix line numbers for if-entries in menu tree\n (bsc#1051510).\n\n - kconfig: fix memory leak when EOF is encountered in\n quotation (bsc#1051510).\n\n - kconfig: fix the rule of mainmenu_stmt symbol\n (bsc#1051510).\n\n - keys: allow reaching the keys quotas exactly\n (bsc#1051510).\n\n - keys: Timestamp new keys (bsc#1051510).\n\n - kgdboc: fix KASAN global-out-of-bounds bug in\n param_set_kgdboc_var() (bsc#1051510).\n\n - kgdboc: Fix restrict error (bsc#1051510).\n\n - kgdboc: Fix warning with module build (bsc#1051510).\n\n - kobject: add kobject_uevent_net_broadcast()\n (bsc#1122982).\n\n - kobject: copy env blob in one go (bsc#1122982).\n\n - kobject: factorize skb setup in\n kobject_uevent_net_broadcast() (bsc#1122982).\n\n - kprobes: Return error if we fail to reuse kprobe instead\n of BUG_ON() (bsc#1051510).\n\n - kvm: mmu: Fix race in emulated page table writes\n (bsc#1129284).\n\n - kvm: nVMX: Free the VMREAD/VMWRITE bitmaps if\n alloc_kvm_area() fails (bsc#1129291).\n\n - kvm: nVMX: NMI-window and interrupt-window exiting\n should wake L2 from HLT (bsc#1129292).\n\n - kvm: nVMX: Set VM instruction error for VMPTRLD of\n unbacked page (bsc#1129293).\n\n - kvm: vmx: Set IA32_TSC_AUX for legacy mode guests\n (bsc#1129294).\n\n - kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs\n (bsc#1127082).\n\n - kvm: x86: Fix single-step debugging (bsc#1129295).\n\n - kvm: x86: Use jmp to invoke kvm_spurious_fault() from\n .fixup (bsc#1129296).\n\n - l2tp: copy 4 more bytes to linear part if necessary\n (networking-stable-19_02_01).\n\n - l2tp: fix infoleak in l2tp_ip6_recvmsg() (git-fixes).\n\n - l2tp: fix reading optional fields of L2TPv3\n (networking-stable-19_02_01).\n\n - leds: lp5523: fix a missing check of return value of\n lp55xx_read (bsc#1051510).\n\n - leds: lp55xx: fix null deref on firmware load failure\n (bsc#1051510).\n\n - libceph: avoid KEEPALIVE_PENDING races in\n ceph_con_keepalive() (bsc#1125800).\n\n - libceph: handle an empty authorize reply (bsc#1126789).\n\n - libceph: wait for latest osdmap in\n ceph_monc_blacklist_add() (bsc#1130427).\n\n - lib/div64.c: off by one in shift (bsc#1051510).\n\n - libertas_tf: do not set URB_ZERO_PACKET on IN USB\n transfer (bsc#1051510).\n\n - libnvdimm: Fix altmap reservation size calculation\n (bsc#1127682).\n\n - libnvdimm/label: Clear 'updating' flag after label-set\n update (bsc#1129543).\n\n - libnvdimm/pmem: Honor force_raw for legacy pmem regions\n (bsc#1129551).\n\n - lightnvm: fail fast on passthrough commands\n (bsc#1125780).\n\n - livepatch: Change unsigned long old_addr -> void\n *old_func in struct klp_func (bsc#1071995).\n\n - livepatch: Consolidate klp_free functions (bsc#1071995\n ).\n\n - livepatch: core: Return EOPNOTSUPP instead of ENOSYS\n (bsc#1071995).\n\n - livepatch: Define a macro for new API identification\n (bsc#1071995).\n\n - livepatch: Do not block the removal of patches loaded\n after a forced transition (bsc#1071995).\n\n - livepatch: Introduce klp_for_each_patch macro\n (bsc#1071995 ).\n\n - livepatch: Module coming and going callbacks can proceed\n with all listed patches (bsc#1071995).\n\n - livepatch: Proper error handling in the shadow variables\n selftest (bsc#1071995).\n\n - livepatch: Remove ordering (stacking) of the livepatches\n (bsc#1071995).\n\n - livepatch: Remove signal sysfs attribute (bsc#1071995 ).\n\n - livepatch: return -ENOMEM on ptr_id() allocation failure\n (bsc#1071995).\n\n - livepatch: Send a fake signal periodically (bsc#1071995\n ).\n\n - livepatch: Shuffle\n klp_enable_patch()/klp_disable_patch() code\n (bsc#1071995).\n\n - livepatch: Simplify API by removing registration step\n (bsc#1071995).\n\n - llc: do not use sk_eat_skb() (bsc#1051510).\n\n - locking/rwsem: Fix (possible) missed wakeup\n (bsc#1050549).\n\n - loop: drop caches if offset or block_size are changed\n (bsc#1124975).\n\n - loop: Reintroduce lo_ctl_mutex removed by commit\n 310ca162d (bsc#1124974).\n\n - mac80211: Add attribute aligned(2) to struct 'action'\n (bsc#1051510).\n\n - mac80211: do not initiate TDLS connection if station is\n not associated to AP (bsc#1051510).\n\n - mac80211: ensure that mgmt tx skbs have tailroom for\n encryption (bsc#1051510).\n\n - mac80211: fix miscounting of ttl-dropped frames\n (bsc#1051510).\n\n - mac80211: fix radiotap vendor presence bitmap handling\n (bsc#1051510).\n\n - mac80211: Fix Tx aggregation session tear down with\n ITXQs (bsc#1051510).\n\n - mac80211: Free mpath object when rhashtable insertion\n fails (bsc#1051510).\n\n - mac80211_hwsim: propagate genlmsg_reply return code\n (bsc#1051510).\n\n - mac80211: Restore vif beacon interval if start ap fails\n (bsc#1051510).\n\n - macvlan: Only deliver one copy of the frame to the\n macvlan interface (bsc#1051510).\n\n - mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush\n timeout issue (bsc#1051510).\n\n - mdio_bus: Fix use-after-free on device_register fails\n (bsc#1051510).\n\n - media: adv*/tc358743/ths8200: fill in min\n width/height/pixelclock (bsc#1051510).\n\n - media: DaVinci-VPBE: fix error handling in\n vpbe_initialize() (bsc#1051510).\n\n - media: dt-bindings: media: i2c: Fix i2c address for\n OV5645 camera sensor (bsc#1051510).\n\n - media: mtk-vcodec: Release device nodes in\n mtk_vcodec_init_enc_pm() (bsc#1051510).\n\n - media: rc: mce_kbd decoder: fix stuck keys\n (bsc#1100132).\n\n - media: s5k4ecgx: delete a bogus error message\n (bsc#1051510).\n\n - media: s5p-jpeg: Check for fmt_ver_flag when doing fmt\n enumeration (bsc#1051510).\n\n - media: s5p-jpeg: Correct step and max values for\n V4L2_CID_JPEG_RESTART_INTERVAL (bsc#1051510).\n\n - media: s5p-mfc: fix incorrect bus assignment in virtual\n child device (bsc#1051510).\n\n - media: uvcvideo: Avoid NULL pointer dereference at the\n end of streaming (bsc#1051510).\n\n - media: uvcvideo: Fix 'type' check leading to overflow\n (bsc#1051510).\n\n - media: v4l2-ctrls.c/uvc: zero v4l2_event (bsc#1051510).\n\n - media: v4l2: i2c: ov7670: Fix PLL bypass register values\n (bsc#1051510).\n\n - media: vb2: do not call __vb2_queue_cancel if\n vb2_start_streaming failed (bsc#1119086).\n\n - memremap: fix softlockup reports at teardown\n (bnc#1130154).\n\n - memstick: Prevent memstick host from getting runtime\n suspended during card detection (bsc#1051510).\n\n - mfd: db8500-prcmu: Fix some section annotations\n (bsc#1051510).\n\n - mfd: mc13xxx: Fix a missing check of a register-read\n failure (bsc#1051510).\n\n - mfd: mt6397: Do not call irq_domain_remove if PMIC\n unsupported (bsc#1051510).\n\n - mfd: qcom_rpm: write fw_version to CTRL_REG\n (bsc#1051510).\n\n - mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while\n registering mfd cells (bsc#1051510).\n\n - mfd: tps65218: Use devm_regmap_add_irq_chip and clean up\n error path in probe() (bsc#1051510).\n\n - mfd: twl-core: Fix section annotations on\n (,un)protect_pm_master (bsc#1051510).\n\n - mfd: wm5110: Add missing ASRC rate register\n (bsc#1051510).\n\n - misc: hpilo: Do not claim unsupported hardware\n (bsc#1129330).\n\n - misc: hpilo: Exclude unsupported device via blacklist\n (bsc#1129330).\n\n - mISDN: fix a race in dev_expire_timer() (bsc#1051510).\n\n - mlxsw: __mlxsw_sp_port_headroom_set(): Fix a use of\n local variable (git-fixes).\n\n - mlxsw: spectrum: Disable lag port TX before removing it\n (networking-stable-19_01_22).\n\n - mmap: introduce sane default mmap limits (git fixes\n (mm/mmap)).\n\n - mmap: relax file size limit for regular files (git fixes\n (mm/mmap)).\n\n - mmc: bcm2835: Recover from MMC_SEND_EXT_CSD\n (bsc#1051510).\n\n - mmc: Kconfig: Enable CONFIG_MMC_SDHCI_IO_ACCESSORS\n (bsc#1051510).\n\n - mmc: omap: fix the maximum timeout setting\n (bsc#1051510).\n\n - mmc: pxamci: fix enum type confusion (bsc#1051510).\n\n - mmc: sdhci-brcmstb: handle mmc_of_parse() errors during\n probe (bsc#1051510).\n\n - mmc: sdhci-esdhc-imx: fix HS400 timing issue\n (bsc#1051510).\n\n - mmc: sdhci-of-esdhc: Fix timeout checks (bsc#1051510).\n\n - mmc: sdhci-xenon: Fix timeout checks (bsc#1051510).\n\n - mmc: spi: Fix card detection during probe (bsc#1051510).\n\n - mm: do not drop unused pages when userfaultd is running\n (git fixes (mm/userfaultfd)).\n\n - mm: Fix modifying of page protection by insert_pfn()\n (bsc#1126740).\n\n - mm: Fix warning in insert_pfn() (bsc#1126740).\n\n - mm/hmm: hmm_pfns_bad() was accessing wrong struct (git\n fixes (mm/hmm)).\n\n - mm: hwpoison: use do_send_sig_info() instead of\n force_sig() (git fixes (mm/hwpoison)).\n\n - mm/ksm.c: ignore STABLE_FLAG of rmap_item->address in\n rmap_walk_ksm() (git fixes (mm/ksm)).\n\n - mm: madvise(MADV_DODUMP): allow hugetlbfs pages (git\n fixes (mm/madvise)).\n\n - mm,memory_hotplug: fix scan_movable_pages() for gigantic\n hugepages (bsc#1127731).\n\n - mm: migrate: do not rely on __PageMovable() of newpage\n after unlocking it (git fixes (mm/migrate)).\n\n - mm, oom: fix use-after-free in oom_kill_process (git\n fixes (mm/oom)).\n\n - mm: use swp_offset as key in shmem_replace_page() (git\n fixes (mm/shmem)).\n\n - mm,vmscan: Make unregister_shrinker() no-op if\n register_shrinker() failed (git fixes (mm/vmscan)).\n\n - Move upstreamed ALSA and BT patches into sorted section\n\n - Move upstreamed libnvdimm patch into sorted section\n\n - mtd: cfi_cmdset_0002: Avoid walking all chips when\n unlocking (bsc#1051510).\n\n - mtd: cfi_cmdset_0002: Change write buffer to check\n correct value (bsc#1051510).\n\n - mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips\n (bsc#1051510).\n\n - mtd: cfi_cmdset_0002: Fix unlocking requests crossing a\n chip boudary (bsc#1051510).\n\n - mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock()\n (bsc#1051510).\n\n - mtdchar: fix overflows in adjustment of `count`\n (bsc#1051510).\n\n - mtdchar: fix usage of mtd_ooblayout_ecc() (bsc#1051510).\n\n - mtd: docg3: do not set conflicting BCH_CONST_PARAMS\n option (bsc#1051510).\n\n - mtd/maps: fix solutionengine.c printk format warnings\n (bsc#1051510).\n\n - mtd: mtd_oobtest: Handle bitflips during reads\n (bsc#1051510).\n\n - mtd: nand: atmel: fix buffer overflow in\n atmel_pmecc_user (bsc#1051510).\n\n - mtd: nand: atmel: Fix get_sectorsize() function\n (bsc#1051510).\n\n - mtd: nand: atmel: fix of_irq_get() error check\n (bsc#1051510).\n\n - mtd: nand: brcmnand: Disable prefetch by default\n (bsc#1051510).\n\n - mtd: nand: brcmnand: Zero bitflip is not an error\n (bsc#1051510).\n\n - mtd: nand: denali_pci: add missing\n MODULE_DESCRIPTION/AUTHOR/LICENSE (bsc#1051510).\n\n - mtd: nand: fix interpretation of NAND_CMD_NONE in\n nand_command[_lp]() (bsc#1051510).\n\n - mtd: nand: Fix nand_do_read_oob() return value\n (bsc#1051510).\n\n - mtd: nand: Fix writing mtdoops to nand flash\n (bsc#1051510).\n\n - mtd: nand: fsl_ifc: Fix nand waitfunc return value\n (bsc#1051510).\n\n - mtd: nand: gpmi: Fix failure when a erased page has a\n bitflip at BBM (bsc#1051510).\n\n - mtd: nand: ifc: update bufnum mask for ver >= 2.0.0\n (bsc#1051510).\n\n - mtd: nand: mtk: fix infinite ECC decode IRQ issue\n (bsc#1051510).\n\n - mtd: nand: omap2: Fix subpage write (bsc#1051510).\n\n - mtd: nand: pxa3xx: Fix READOOB implementation\n (bsc#1051510).\n\n - mtd: nand: qcom: Add a NULL check for devm_kasprintf()\n (bsc#1051510).\n\n - mtd: nandsim: remove debugfs entries in error path\n (bsc#1051510).\n\n - mtd: nand: sunxi: Fix ECC strength choice (bsc#1051510).\n\n - mtd: nand: sunxi: fix potential divide-by-zero error\n (bsc#1051510).\n\n - mtd: nand: vf610: set correct ooblayout (bsc#1051510).\n\n - mtd: spi-nor: cadence-quadspi: Fix page fault kernel\n panic (bsc#1051510).\n\n - mtd: spi-nor: Fix Cadence QSPI page fault kernel panic\n (bsc#1051510).\n\n - mtd: spi-nor: fsl-quadspi: fix read error for flash size\n larger than 16MB (bsc#1051510).\n\n - mtd: spi-nor: stm32-quadspi: Fix uninitialized error\n return code (bsc#1051510).\n\n - mv88e6060: disable hardware level MAC learning\n (bsc#1051510).\n\n - nbd: Use set_blocksize() to set device blocksize\n (bsc#1124984).\n\n - net: add uevent socket member (bsc#1122982).\n\n - net: aquantia: driver should correctly declare\n vlan_features bits (bsc#1051510).\n\n - net: aquantia: fixed instack structure overflow\n (git-fixes).\n\n - net: aquantia: Fix hardware DMA stream overload on large\n MRRS (bsc#1051510).\n\n - net: bcmgenet: abort suspend on error (bsc#1051510).\n\n - net: bcmgenet: code movement (bsc#1051510).\n\n - net: bcmgenet: fix OF child-node lookup (bsc#1051510).\n\n - net: bcmgenet: remove HFB_CTRL access (bsc#1051510).\n\n - net: bcmgenet: return correct value 'ret' from\n bcmgenet_power_down (bsc#1051510).\n\n - net: bridge: fix a bug on using a neighbour cache entry\n without checking its state (networking-stable-19_01_20).\n\n - net: bridge: Fix ethernet header pointer before check\n skb forwardable (networking-stable-19_01_26).\n\n - net: do not call update_pmtu unconditionally\n (bsc#1123456).\n\n - net: Do not default Cavium PTP driver to 'y'\n (bsc#1110096).\n\n - net: dp83640: expire old TX-skb\n (networking-stable-19_02_10).\n\n - net: dsa: mv88e6xxx: handle unknown duplex modes\n gracefully in mv88e6xxx_port_set_duplex (git-fixes).\n\n - net: dsa: mv88x6xxx: mv88e6390 errata\n (networking-stable-19_01_22).\n\n - net: dsa: slave: Do not propagate flag changes on down\n slave interfaces (networking-stable-19_02_10).\n\n - net: ena: fix race between link up and device\n initalization (bsc#1083548).\n\n - net: ena: update driver version from 2.0.2 to 2.0.3\n (bsc#1129276 bsc#1125342).\n\n - netfilter: check for seqadj ext existence before adding\n it in nf_nat_setup_info (git-fixes).\n\n - netfilter: nf_tables: check the result of dereferencing\n base_chain->stats (git-fixes).\n\n - net: Fix usage of pskb_trim_rcsum\n (networking-stable-19_01_26).\n\n - net: ipv4: Fix memory leak in network namespace\n dismantle (networking-stable-19_01_26).\n\n - net/mlx4_core: Add masking for a few queries on HCA caps\n (networking-stable-19_02_01).\n\n - net/mlx4_core: Fix locking in SRIOV mode when switching\n between events and polling (git-fixes).\n\n - net/mlx4_core: Fix qp mtt size calculation (git-fixes).\n\n - net/mlx4_core: Fix reset flow when in command polling\n mode (git-fixes).\n\n - net/mlx5e: Allow MAC invalidation while spoofchk is ON\n (networking-stable-19_02_01).\n\n - net/mlx5e: IPoIB, Fix RX checksum statistics update\n (git-fixes).\n\n - net/mlx5e: RX, Fix wrong early return in receive queue\n poll (bsc#1046305).\n\n - net/mlx5: fix uaccess beyond 'count' in debugfs\n read/write handlers (git-fixes).\n\n - net/mlx5: Release resource on error flow (git-fixes).\n\n - net/mlx5: Return success for PAGE_FAULT_RESUME in\n internal error state (git-fixes).\n\n - net/mlx5: Use multi threaded workqueue for page fault\n handling (git-fixes).\n\n - net/ncsi: Fix AEN HNCDSC packet length (git-fixes).\n\n - net/ncsi: Stop monitor if channel times out or is\n inactive (git-fixes).\n\n - net: netem: fix skb length BUG_ON in __skb_to_sgvec\n (git-fixes).\n\n - netns: restrict uevents (bsc#1122982).\n\n - net: phy: marvell: Errata for mv88e6390 internal PHYs\n (networking-stable-19_01_26).\n\n - net: phy: mdio_bus: add missing device_del() in\n mdiobus_register() error handling\n (networking-stable-19_01_26).\n\n - net: phy: Micrel KSZ8061: link failure after cable\n connect (git-fixes).\n\n - netrom: switch to sock timer API (bsc#1051510).\n\n - net/rose: fix NULL ax25_cb kernel panic\n (networking-stable-19_02_01).\n\n - net/sched: act_tunnel_key: fix memory leak in case of\n action replace (networking-stable-19_01_26).\n\n - net_sched: refetch skb protocol for each filter\n (networking-stable-19_01_26).\n\n - net: set default network namespace in\n init_dummy_netdev() (networking-stable-19_02_01).\n\n - net: stmmac: Fix a race in EEE enable callback\n (git-fixes).\n\n - net: stmmac: fix broken dma_interrupt handling for\n multi-queues (git-fixes).\n\n - net: stmmac: handle endianness in dwmac4_get_timestamp\n (git-fixes).\n\n - net: stmmac: Use mutex instead of spinlock (git-fixes).\n\n - net-sysfs: Fix mem leak in netdev_register_kobject\n (git-fixes).\n\n - net: systemport: Fix WoL with password after deep sleep\n (networking-stable-19_02_10).\n\n - net: thunderx: fix NULL pointer dereference in\n nic_remove (git-fixes).\n\n - nfit: acpi_nfit_ctl(): Check out_obj->type in the right\n place (bsc#1129547).\n\n - nfit/ars: Attempt a short-ARS whenever the ARS state is\n idle at boot (bsc#1051510).\n\n - nfit/ars: Attempt short-ARS even in the no_init_ars case\n (bsc#1051510).\n\n - nfp: bpf: fix ALU32 high bits clearance bug (git-fixes).\n\n - nfsd: fix memory corruption caused by readdir\n (bsc#1127445).\n\n - niu: fix missing checks of niu_pci_eeprom_read\n (bsc#1051510).\n\n - ntb_transport: Fix bug with max_mw_size parameter\n (bsc#1051510).\n\n - nvme-fc: reject reconnect if io queue count is reduced\n to zero (bsc#1128351).\n\n - nvme: flush namespace scanning work just before removing\n namespaces (bsc#1108101).\n\n - nvme: kABI fix for scan_lock (bsc#1123882).\n\n - nvme: lock NS list changes while handling command\n effects (bsc#1123882).\n\n - nvme-loop: fix kernel oops in case of unhandled command\n (bsc#1126807).\n\n - nvme-multipath: drop optimization for static ANA group\n IDs (bsc#1113939).\n\n - nvme-pci: fix out of bounds access in nvme_cqe_pending\n (bsc#1127595).\n\n - nvme: schedule requeue whenever a LIVE state is entered\n (bsc#1123105).\n\n - of, numa: Validate some distance map rules\n (bsc#1051510).\n\n - of: unittest: Disable interrupt node tests for old world\n MAC systems (bsc#1051510).\n\n - openvswitch: Avoid OOB read when parsing flow nlattrs\n (bsc#1051510).\n\n - openvswitch: fix the incorrect flow action alloc size\n (bsc#1051510).\n\n - openvswitch: Remove padding from packet before L3+\n conntrack processing (bsc#1051510).\n\n - parport_pc: fix find_superio io compare code, should use\n equal test (bsc#1051510).\n\n - Partially revert 'block: fail op_is_write() requests to\n (bsc#1125252).\n\n - pci: add USR vendor id and use it in r8169 and w6692\n driver (networking-stable-19_01_22).\n\n - pci: designware-ep: dw_pcie_ep_set_msi() should only set\n MMC bits (bsc#1051510).\n\n - pci: endpoint: functions: Use\n memcpy_fromio()/memcpy_toio() (bsc#1051510).\n\n - pci-hyperv: increase HV_VP_SET_BANK_COUNT_MAX to handle\n 1792 vcpus (bsc#1122822).\n\n - pci/pme: Fix hotplug/sysfs remove deadlock in\n pcie_pme_remove() (bsc#1051510).\n\n - pci: qcom: Do not deassert reset GPIO during probe\n (bsc#1129281).\n\n - pcrypt: use format specifier in kobject_add\n (bsc#1051510).\n\n - perf/x86: Add sysfs entry to freeze counters on SMI\n (bsc#1121805).\n\n - perf/x86/intel: Delay memory deallocation until\n x86_pmu_dead_cpu() (bsc#1121805).\n\n - perf/x86/intel: Do not enable freeze-on-smi for PerfMon\n V1 (bsc#1121805).\n\n - perf/x86/intel: Fix memory corruption (bsc#1121805).\n\n - perf/x86/intel: Generalize dynamic constraint creation\n (bsc#1121805).\n\n - perf/x86/intel: Implement support for TSX Force Abort\n (bsc#1121805).\n\n - perf/x86/intel: Make cpuc allocations consistent\n (bsc#1121805).\n\n - phy: allwinner: sun4i-usb: poll vbus changes on A23/A33\n when driving VBUS (bsc#1051510).\n\n - phy: qcom-qmp: Fix failure path in phy_init functions\n (bsc#1051510).\n\n - phy: qcom-qmp: Fix phy pipe clock gating (bsc#1051510).\n\n - phy: renesas: rcar-gen3-usb2: fix vbus_ctrl for role\n sysfs (bsc#1051510).\n\n - phy: rockchip-emmc: retry calpad busy trimming\n (bsc#1051510).\n\n - phy: sun4i-usb: add support for missing USB PHY index\n (bsc#1051510).\n\n - phy: tegra: remove redundant self assignment of 'map'\n (bsc#1051510).\n\n - phy: work around 'phys' references to usb-nop-xceiv\n devices (bsc#1051510).\n\n - pinctrl: max77620: Use define directive for\n max77620_pinconf_param values (bsc#1051510).\n\n - pinctrl: meson: fix pull enable register calculation\n (bsc#1051510).\n\n - pinctrl: meson: meson8b: fix the GPIO function for the\n GPIOAO pins (bsc#1051510).\n\n - pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins\n (bsc#1051510).\n\n - pinctrl: meson: meson8: fix the GPIO function for the\n GPIOAO pins (bsc#1051510).\n\n - pinctrl: msm: fix gpio-hog related boot issues\n (bsc#1051510).\n\n - pinctrl: sh-pfc: emev2: Add missing pinmux functions\n (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to\n lcd0_data24_1 group (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to\n gether_gmii group (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7778: Fix HSPI pin numbers and names\n (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group\n (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from\n qspi_data4_b group (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7791: Remove bogus marks from\n vin1_b_data18 group (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group\n (bsc#1051510).\n\n - pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field\n (bsc#1051510).\n\n - pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register\n configuration (bsc#1051510).\n\n - pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field\n (bsc#1051510).\n\n - pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3\n group (bsc#1051510).\n\n - pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups\n (bsc#1051510).\n\n - pinctrl: sh-pfc: sh7734: Add missing IPSR11 field\n (bsc#1051510).\n\n - pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10\n (bsc#1051510).\n\n - pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value\n (bsc#1051510).\n\n - pinctrl: sunxi: a64: Rename function csi0 to csi\n (bsc#1051510).\n\n - pinctrl: sunxi: a64: Rename function ts0 to ts\n (bsc#1051510).\n\n - pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11\n (bsc#1051510).\n\n - pinctrl: sx150x: handle failure case of devm_kstrdup\n (bsc#1051510).\n\n - pktcdvd: Fix possible Spectre-v1 for pkt_devs\n (bsc#1051510).\n\n - platform/x86: Fix unmet dependency warning for\n SAMSUNG_Q10 (bsc#1051510).\n\n - pm / wakeup: Rework wakeup source timer cancellation\n (bsc#1051510).\n\n - powercap: intel_rapl: add support for Jacobsville ().\n\n - powerpc/64s: Clear on-stack exception marker upon\n exception return (bsc#1071995).\n\n - powerpc/livepatch: relax reliable stack tracer checks\n for first-frame (bsc#1071995).\n\n - powerpc/livepatch: small cleanups in\n save_stack_trace_tsk_reliable() (bsc#1071995).\n\n - powerpc/pseries: export timebase register sample in\n lparcfg (bsc#1127750).\n\n - powerpc/pseries/mce: Fix misleading print for TLB\n mutlihit (bsc#1094244, git-fixes).\n\n - powerpc/pseries: Perform full re-add of CPU for topology\n update post-migration (bsc#1125728).\n\n - power: supply: charger-manager: Fix incorrect return\n value (bsc#1051510).\n\n - pptp: dst_release sk_dst_cache in pptp_sock_destruct\n (git-fixes).\n\n - proc/sysctl: do not return ENOMEM on lookup when a table\n is unregistering (git-fixes).\n\n - pseries/energy: Use OF accessor function to read\n ibm,drc-indexes (bsc#1129080).\n\n - ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl\n (bsc#1051510).\n\n - ptp: Fix pass zero to ERR_PTR() in ptp_clock_register\n (bsc#1051510).\n\n - pwm-backlight: Enable/disable the PWM before/after LCD\n enable toggle (bsc#1051510).\n\n - qmi_wwan: add MTU default to qmap network interface\n (networking-stable-19_01_22).\n\n - qmi_wwan: apply SET_DTR quirk to Sierra WP7607\n (bsc#1051510).\n\n - qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup\n (bsc#1051510).\n\n - r8169: Add support for new Realtek Ethernet\n (networking-stable-19_01_22).\n\n - r8169: use PCI_VDEVICE macro\n (networking-stable-19_01_22).\n\n - rbd: do not return 0 on unmap if RBD_DEV_FLAG_REMOVING\n is set (bsc#1125797).\n\n - rcu: Fix up pending cbs check in rcu_prepare_for_idle\n (git fixes (kernel/rcu)).\n\n - rcu: Make need_resched() respond to urgent RCU-QS needs\n (git fixes (kernel/rcu)).\n\n - rdma/vmw_pvrdma: Support upto 64-bit PFNs (bsc#1127285).\n\n - Refresh\n patches.suse/scsi-do-not-print-reservation-conflict-for-\n TEST-UNIT.patch (bsc#1119843)\n\n - regulator: act8865: Fix act8600_sudcdc_voltage_ranges\n setting (bsc#1051510).\n\n - regulator: max77620: Initialize values for DT properties\n (bsc#1051510).\n\n - regulator: pv88060: Fix array out-of-bounds access\n (bsc#1051510).\n\n - regulator: pv88080: Fix array out-of-bounds access\n (bsc#1051510).\n\n - regulator: pv88090: Fix array out-of-bounds access\n (bsc#1051510).\n\n - regulator: s2mpa01: Fix step values for some LDOs\n (bsc#1051510).\n\n - regulator: s2mps11: Fix steps for buck7, buck8 and LDO35\n (bsc#1051510).\n\n - regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim\n from mA to uA (bsc#1051510).\n\n - Remove blacklist of virtio patch so we can install it\n (bsc#1114585)\n\n - Remove patches rejected upstream ().\n\n - Revert drm/i915 patches that caused regressions\n (bsc#1131062)\n\n - Revert 'drm/rockchip: Allow driver to be shutdown on\n reboot/kexec' (bsc#1051510).\n\n - Revert 'Input: elan_i2c - add ACPI ID for touchpad in\n ASUS Aspire F5-573G' (bsc#1051510).\n\n - Revert 'ipv4: keep skb->dst around in presence of IP\n options' (git-fixes).\n\n - Revert 'openvswitch: Fix template leak in error cases.'\n (bsc#1051510).\n\n - Revert 'scsi: qla2xxx: Fix NVMe Target discovery'\n (bsc#1125252).\n\n - Revert 'sd: disable logical block provisioning if\n 'lbpme' is not set' This reverts commit\n e365f138cb9c9c48b710864a9f37a91b4b93381d. Patch not\n accepted upstream.\n\n - Revert the previous merge of drm fixes The branch was\n merged mistakenly and breaks the build. Revert it.\n\n - Revert 'xhci: Reset Renesas uPD72020x USB controller for\n 32-bit DMA issue' (bsc#1120854).\n\n - rhashtable: Still do rehash when we get EEXIST\n (bsc#1051510).\n\n - rocker: fix rocker_tlv_put_* functions for KASAN\n (bsc#1051510).\n\n - rpm/kernel-source.changes.old: Really drop old\n changelogs (bsc#1098995)\n\n - rt2800: enable TX_PIN_CFG_RFRX_EN only for MT7620\n (bsc#1120902).\n\n - rtc: 88pm80x: fix unintended sign extension\n (bsc#1051510).\n\n - rtc: 88pm860x: fix unintended sign extension\n (bsc#1051510).\n\n - rtc: cmos: ignore bogus century byte (bsc#1051510).\n\n - rtc: ds1672: fix unintended sign extension\n (bsc#1051510).\n\n - rtc: Fix overflow when converting time64_t to rtc_time\n (bsc#1051510).\n\n - rtc: pm8xxx: fix unintended sign extension\n (bsc#1051510).\n\n - rtnetlink: bring NETDEV_CHANGE_TX_QUEUE_LEN event\n process back in rtnetlink_event (git-fixes).\n\n - rtnetlink: bring NETDEV_CHANGEUPPER event process back\n in rtnetlink_event (git-fixes).\n\n - rtnetlink: bring NETDEV_POST_TYPE_CHANGE event process\n back in rtnetlink_event (git-fixes).\n\n - rtnetlink: check DO_SETLINK_NOTIFY correctly in\n do_setlink (git-fixes).\n\n - rxrpc: bad unlock balance in rxrpc_recvmsg\n (networking-stable-19_02_10).\n\n - s390/cio: Fix how vfio-ccw checks pinned pages\n (git-fixes).\n\n - s390/cpum_cf: Reject request for sampling in event\n initialization (git-fixes).\n\n - s390/early: improve machine detection (git-fixes).\n\n - s390/mm: always force a load of the primary ASCE on\n context switch (git-fixes).\n\n - s390/mm: fix addressing exception after suspend/resume\n (bsc#1125252).\n\n - s390/qeth: cancel close_dev work before removing a card\n (LTC#175898, bsc#1127561).\n\n - s390/qeth: conclude all event processing before\n offlining a card (LTC#175901, bsc#1127567).\n\n - s390/qeth: fix use-after-free in error path\n (bsc#1127534).\n\n - s390/qeth: invoke softirqs after napi_schedule()\n (git-fixes).\n\n - s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU\n (git-fixes).\n\n - s390/smp: fix CPU hotplug deadlock with CPU rescan\n (git-fixes).\n\n - s390/sthyi: Fix machine name validity indication\n (git-fixes).\n\n - sata_rcar: fix deferred probing (bsc#1051510).\n\n - sc16is7xx: Fix for multi-channel stall (bsc#1051510).\n\n - sched: Do not re-read h_load_next during hierarchical\n load calculation (bnc#1120909).\n\n - sched/wake_q: Document wake_q_add() (bsc#1050549).\n\n - sched/wake_q: Fix wakeup ordering for wake_q\n (bsc#1050549).\n\n - sched/wake_q: Reduce reference counting for special\n users (bsc#1050549).\n\n - sch_multiq: fix double free on init failure\n (bsc#1051510).\n\n - scripts/git_sort/git_sort.py: add vfs 'fixes' branch\n\n - scsi: core: reset host byte in DID_NEXUS_FAILURE case\n (bsc#1122764).\n\n - scsi: csiostor: remove flush_scheduled_work()\n (bsc#1127363).\n\n - scsi: fix queue cleanup race before queue initialization\n is done (bsc#1125252).\n\n - scsi: ibmvscsi: Fix empty event pool access during host\n removal (bsc#1119019).\n\n - scsi: ibmvscsi: Protect ibmvscsi_head from concurrent\n modificaiton (bsc#1119019).\n\n - scsi: libiscsi: fix possible NULL pointer dereference in\n case of TMF (bsc#1127378).\n\n - scsi: libiscsi: Fix race between iscsi_xmit_task and\n iscsi_complete_task (bsc#1122192).\n\n - scsi: lpfc: Add log messages to aid in debugging fc4type\n discovery issues (bsc#1121317).\n\n - scsi: lpfc: Correct MDS loopback diagnostics support\n (bsc#1121317).\n\n - scsi: lpfc: do not set queue->page_count to 0 if\n pc_sli4_params.wqpcnt is invalid (bsc#1121317).\n\n - scsi: lpfc: Fix discovery failure when PLOGI is defered\n (bsc#1121317).\n\n - scsi: lpfc: Fix link state reporting for trunking when\n adapter is offline (bsc#1121317).\n\n - scsi: lpfc: fix remoteport access (bsc#1125252).\n\n - scsi: lpfc: remove an unnecessary NULL check\n (bsc#1121317).\n\n - scsi: lpfc: update fault value on successful trunk\n events (bsc#1121317).\n\n - scsi: lpfc: Update lpfc version to 12.0.0.10\n (bsc#1121317).\n\n - scsi: mpt3sas: Add ioc_<level> logging macros\n (bsc#1117108).\n\n - scsi: mpt3sas: Annotate switch/case fall-through\n (bsc#1117108).\n\n - scsi: mpt3sas: Convert logging uses with MPT3SAS_FMT and\n reply_q_name to %s: (bsc#1117108).\n\n - scsi: mpt3sas: Convert logging uses with MPT3SAS_FMT\n without logging levels (bsc#1117108).\n\n - scsi: mpt3sas: Convert mlsleading uses of pr_<level>\n with MPT3SAS_FMT (bsc#1117108).\n\n - scsi: mpt3sas: Convert uses of pr_<level> with\n MPT3SAS_FMT to ioc_<level> (bsc#1117108).\n\n - scsi: mpt3sas: Fix a race condition in\n mpt3sas_base_hard_reset_handler() (bsc#1117108).\n\n - scsi: mpt3sas: Fix indentation (bsc#1117108).\n\n - scsi: mpt3sas: Improve kernel-doc headers (bsc#1117108).\n\n - scsi: mpt3sas: Introduce struct mpt3sas_nvme_cmd\n (bsc#1117108).\n\n - scsi: mpt3sas: Remove KERN_WARNING from panic uses\n (bsc#1117108).\n\n - scsi: mpt3sas: Remove set-but-not-used variables\n (bsc#1117108).\n\n - scsi: mpt3sas: Remove unnecessary parentheses and\n simplify null checks (bsc#1117108).\n\n - scsi: mpt3sas: Remove unused macro MPT3SAS_FMT\n (bsc#1117108).\n\n - scsi: mpt3sas: Split _base_reset_handler(),\n mpt3sas_scsih_reset_handler() and\n mpt3sas_ctl_reset_handler() (bsc#1117108).\n\n - scsi: mpt3sas: Swap I/O memory read value back to cpu\n endianness (bsc#1117108).\n\n - scsi: mpt3sas: switch to generic DMA API (bsc#1117108).\n\n - scsi: mpt3sas: Use dma_pool_zalloc (bsc#1117108).\n\n - scsi: mptsas: Fixup device hotplug for VMware ESXi\n (bsc#1129046).\n\n - scsi: qla2xxx: Enable FC-NVME on NPIV ports\n (bsc#1094555).\n\n - scsi: qla2xxx: Fix a typo in MODULE_PARM_DESC\n (bsc#1094555).\n\n - scsi: qla2xxx: Fix for FC-NVMe discovery for NPIV port\n (bsc#1094555).\n\n - scsi: qla2xxx: Fix NPIV handling for FC-NVMe\n (bsc#1094555).\n\n - scsi: qla2xxx: Initialize port speed to avoid setting\n lower speed (bsc#1094555).\n\n - scsi: qla2xxx: Modify fall-through annotations\n (bsc#1094555).\n\n - scsi: qla2xxx: Remove unnecessary self assignment\n (bsc#1094555).\n\n - scsi: qla2xxx: Simplify conditional check (bsc#1094555).\n\n - scsi: qla2xxx: Update driver version to 10.00.00.12-k\n (bsc#1094555).\n\n - scsi: storvsc: Fix a race in sub-channel creation that\n can cause panic ().\n\n - scsi: sym53c8xx: fix NULL pointer dereference panic in\n sym_int_sir() (bsc#1125315).\n\n - scsi: virtio_scsi: fix pi_bytes(out,in) on 4 KiB block\n size devices (bsc#1114585).\n\n - sctp: add a ceiling to optlen in some sockopts\n (bnc#1129163).\n\n - sctp: improve the events for sctp stream adding\n (networking-stable-19_02_01).\n\n - sctp: improve the events for sctp stream reset\n (networking-stable-19_02_01).\n\n - sd: disable logical block provisioning if 'lbpme' is not\n set (bsc#1086095 bsc#1078355).\n\n - selftests/livepatch: add DYNAMIC_DEBUG config dependency\n (bsc#1071995).\n\n - selftests/livepatch: introduce tests (bsc#1071995).\n\n - selinux: always allow mounting submounts (bsc#1051510).\n\n - seq_buf: Make seq_buf_puts() null-terminate the buffer\n (bsc#1051510).\n\n - serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart\n (bsc#1051510).\n\n - serial: 8250_pci: Fix number of ports for ACCES serial\n cards (bsc#1051510).\n\n - serial: 8250_pci: Have ACCES cards that use the four\n port Pericom PI7C9X7954 chip use the pci_pericom_setup()\n (bsc#1051510).\n\n - serial: fix race between flush_to_ldisc and tty_open\n (bsc#1051510).\n\n - serial: fsl_lpuart: clear parity enable bit when disable\n parity (bsc#1051510).\n\n - serial: fsl_lpuart: fix maximum acceptable baud rate\n with over-sampling (bsc#1051510).\n\n - serial: imx: Update cached mctrl value when changing RTS\n (bsc#1051510).\n\n - serial: uartps: Fix stuck ISR if RX disabled with\n non-empty FIFO (bsc#1051510).\n\n - skge: potential memory corruption in skge_get_regs()\n (bsc#1051510).\n\n - sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79\n (bsc#1051510).\n\n - sky2: Increase D3 delay again (bsc#1051510).\n\n - smb311: Improve checking of negotiate security contexts\n (bsc#1051510).\n\n - smb3: Enable encryption for SMB3.1.1 (bsc#1051510).\n\n - smb3: Fix 3.11 encryption to Windows and handle\n encrypted smb3 tcon (bsc#1051510).\n\n - smb3: Fix SMB3.1.1 guest mounts to Samba (bsc#1051510).\n\n - smb3: remove noisy warning message on mount\n (bsc#1129664).\n\n - soc: bcm: brcmstb: Do not leak device tree node\n reference (bsc#1051510).\n\n - soc: fsl: qbman: avoid race in clearing QMan interrupt\n (bsc#1051510).\n\n - soc/tegra: Do not leak device tree node reference\n (bsc#1051510).\n\n - spi: pxa2xx: Setup maximum supported DMA transfer length\n (bsc#1051510).\n\n - spi: ti-qspi: Fix mmap read when more than one CS in use\n (bsc#1051510).\n\n - spi/topcliff_pch: Fix potential NULL dereference on\n allocation error (bsc#1051510).\n\n - splice: do not merge into linked buffers (git-fixes).\n\n - staging: comedi: ni_660x: fix missing break in switch\n statement (bsc#1051510).\n\n - staging:iio:ad2s90: Make probe handle spi_setup failure\n (bsc#1051510).\n\n - staging: iio: ad7780: update voltage on read\n (bsc#1051510).\n\n - staging: iio: adc: ad7280a: handle error from\n __ad7280_read32() (bsc#1051510).\n\n - staging: iio: adt7316: allow adt751x to use internal\n vref for all dacs (bsc#1051510).\n\n - staging: iio: adt7316: fix register and bit definitions\n (bsc#1051510).\n\n - staging: iio: adt7316: fix the dac read calculation\n (bsc#1051510).\n\n - staging: iio: adt7316: fix the dac write calculation\n (bsc#1051510).\n\n - staging: rtl8723bs: Fix build error with Clang when\n inlining is disabled (bsc#1051510).\n\n - staging: speakup: Replace strncpy with memcpy\n (bsc#1051510).\n\n - staging: wilc1000: fix to set correct value for\n 'vif_num' (bsc#1051510).\n\n - supported.conf\n\n - svm: Add mutex_lock to protect apic_access_page_done on\n AMD systems (bsc#1129285).\n\n - svm: Fix improper check when deactivate AVIC\n (bsc#1130335).\n\n - swiotlb: Add is_swiotlb_active() function (bsc#1120008).\n\n - swiotlb: Introduce swiotlb_max_mapping_size()\n (bsc#1120008).\n\n - switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags\n overwrite (bsc#1051510).\n\n - switchtec: Remove immediate status check after\n submitting MRPC command (bsc#1051510).\n\n - sysfs: Disable lockdep for driver bind/unbind files\n (bsc#1051510).\n\n - tcp: batch tcp_net_metrics_exit (bsc#1122982).\n\n - tcp: change txhash on SYN-data timeout\n (networking-stable-19_01_20).\n\n - tcp: handle inet_csk_reqsk_queue_add() failures\n (git-fixes).\n\n - team: avoid complex list operations in\n team_nl_cmd_options_set() (bsc#1051510).\n\n - team: Free BPF filter when unregistering netdev\n (bsc#1051510).\n\n - thermal: bcm2835: Fix crash in bcm2835_thermal_debugfs\n (bsc#1051510).\n\n - thermal: do not clear passive state during system sleep\n (bsc#1051510).\n\n - thermal/drivers/hisi: Encapsulate register writes into\n helpers (bsc#1051510).\n\n - thermal/drivers/hisi: Fix configuration register setting\n (bsc#1051510).\n\n - thermal: generic-adc: Fix adc to temp interpolation\n (bsc#1051510).\n\n - thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON\n is not set (bsc#1051510).\n\n - thermal/intel_powerclamp: fix truncated kthread name ().\n\n - thermal: mediatek: fix register index error\n (bsc#1051510).\n\n - timekeeping: Use proper seqcount initializer\n (bsc#1051510).\n\n - tipc: eliminate KMSAN uninit-value in strcmp complaint\n (bsc#1051510).\n\n - tipc: error path leak fixes in tipc_enable_bearer()\n (bsc#1051510).\n\n - tipc: fix a race condition of releasing subscriber\n object (bsc#1051510).\n\n - tipc: fix bug in function tipc_nl_node_dump_monitor\n (bsc#1051510).\n\n - tipc: fix infinite loop when dumping link monitor\n summary (bsc#1051510).\n\n - tipc: fix RDM/DGRAM connect() regression (bsc#1051510).\n\n - tipc: fix uninit-value in tipc_nl_compat_bearer_enable\n (bsc#1051510).\n\n - tipc: fix uninit-value in tipc_nl_compat_doit\n (bsc#1051510).\n\n - tipc: fix uninit-value in\n tipc_nl_compat_link_reset_stats (bsc#1051510).\n\n - tipc: fix uninit-value in tipc_nl_compat_link_set\n (bsc#1051510).\n\n - tipc: fix uninit-value in tipc_nl_compat_name_table_dump\n (bsc#1051510).\n\n - tpm: fix kdoc for tpm2_flush_context_cmd()\n (bsc#1051510).\n\n - tpm: Fix some name collisions with drivers/char/tpm.h\n (bsc#1051510).\n\n - tpm: return a TPM_RC_COMMAND_CODE response if command is\n not implemented (bsc#1051510).\n\n - tpm: Return the actual size when receiving an\n unsupported command (bsc#1051510).\n\n - tpm: suppress transmit cmd error logs when TPM 1.2 is\n disabled/deactivated (bsc#1051510).\n\n - tpm_tis_spi: Pass the SPI IRQ down to the driver\n (bsc#1051510).\n\n - tpm/tpm_crb: Avoid unaligned reads in crb_recv()\n (bsc#1051510).\n\n - tpm/tpm_i2c_infineon: switch to i2c_lock_bus(...,\n I2C_LOCK_SEGMENT) (bsc#1051510).\n\n - tpm: tpm_i2c_nuvoton: use correct command duration for\n TPM 2.x (bsc#1051510).\n\n - tpm: tpm_try_transmit() refactor error flow\n (bsc#1051510).\n\n - tracing: Do not free iter->trace in fail path of\n tracing_open_pipe() (bsc#1129581).\n\n - tracing/uprobes: Fix output for multiple string\n arguments (bsc#1126495).\n\n - tracing: Use strncpy instead of memcpy for string keys\n in hist triggers (bsc#1129625).\n\n - Tree connect for SMB3.1.1 must be signed for\n non-encrypted shares (bsc#1051510).\n\n - tty: ipwireless: Fix potential NULL pointer dereference\n (bsc#1051510).\n\n - tty: serial: samsung: Properly set flags in autoCTS mode\n (bsc#1051510).\n\n - ucc_geth: Reset BQL queue when stopping device\n (networking-stable-19_02_01).\n\n - ucma: fix a use-after-free in ucma_resolve_ip()\n (bsc#1051510).\n\n - uevent: add alloc_uevent_skb() helper (bsc#1122982).\n\n - uio: Reduce return paths from uio_write() (bsc#1051510).\n\n - Update config files. Remove conditional support for SMB2\n and SMB3 :\n\n - Update\n patches.arch/s390-sles15-zcrypt-fix-specification-except\n ion.patch (LTC#174936, bsc#1123060, bsc#1123061).\n\n - Update\n patches.fixes/acpi-nfit-Block-function-zero-DSMs.patch\n (bsc#1051510, bsc#1121789).\n\n - Update\n patches.fixes/acpi-nfit-Fix-command-supported-detection.\n patch (bsc#1051510, bsc#1121789). Add more detailed\n bugzilla reference.\n\n - uprobes: Fix handle_swbp() vs. unregister() + register()\n race once more (bsc#1051510).\n\n - usb: Add new USB LPM helpers (bsc#1120902).\n\n - usb: cdc-acm: fix race during wakeup blocking TX traffic\n (bsc#1129770).\n\n - usb: common: Consider only available nodes for dr_mode\n (bsc#1129770).\n\n - usb: Consolidate LPM checks to avoid enabling LPM twice\n (bsc#1120902).\n\n - usb: core: only clean up what we allocated\n (bsc#1051510).\n\n - usb: dwc3: Correct the logic for checking TRB full in\n __dwc3_prepare_one_trb() (bsc#1051510).\n\n - usb: dwc3: gadget: Disable CSP for stream OUT ep\n (bsc#1051510).\n\n - usb: dwc3: gadget: Fix the uninitialized link_state when\n udc starts (bsc#1051510).\n\n - usb: dwc3: gadget: Handle 0 xfer length for OUT EP\n (bsc#1051510).\n\n - usb: dwc3: gadget: synchronize_irq dwc irq in suspend\n (bsc#1051510).\n\n - usb: gadget: f_hid: fix deadlock in f_hidg_write()\n (bsc#1129770).\n\n - usb: gadget: musb: fix short isoc packets with inventra\n dma (bsc#1051510).\n\n - usb: gadget: Potential NULL dereference on allocation\n error (bsc#1051510).\n\n - usb: gadget: udc: net2272: Fix bitwise and boolean\n operations (bsc#1051510).\n\n - usb: hub: delay hub autosuspend if USB3 port is still\n link training (bsc#1051510).\n\n - usb: mtu3: fix the issue about SetFeature(U1/U2_Enable)\n (bsc#1051510).\n\n - usb: musb: dsps: fix otg state machine (bsc#1051510).\n\n - usb: musb: dsps: fix runtime pm for peripheral mode\n (bsc#1120902).\n\n - usbnet: smsc95xx: fix rx packet alignment (bsc#1051510).\n\n - usb: phy: am335x: fix race condition in _probe\n (bsc#1051510).\n\n - usb: phy: fix link errors (bsc#1051510).\n\n - usb: phy: twl6030-usb: fix possible use-after-free on\n remove (bsc#1051510).\n\n - usb: serial: cp210x: add ID for Ingenico 3070\n (bsc#1129770).\n\n - usb: serial: ftdi_sio: add ID for Hjelmslund Electronics\n USB485 (bsc#1129770).\n\n - usb: serial: mos7720: fix mos_parport refcount imbalance\n on error path (bsc#1129770).\n\n - usb: serial: option: add Telit ME910 ECM composition\n (bsc#1129770).\n\n - usb: serial: option: set driver_info for SIM5218 and\n compatibles (bsc#1129770).\n\n - usb: serial: pl2303: add new PID to support PL2303TB\n (bsc#1051510).\n\n - usb: serial: simple: add Motorola Tetra TPG2200 device\n id (bsc#1051510).\n\n - veth: set peer GSO values (bsc#1051510).\n\n - vfio: ccw: fix cleanup if cp_prefetch fails (git-fixes).\n\n - vfio: ccw: process ssch with interrupts disabled\n (git-fixes).\n\n - vfs: Add iomap_seek_hole and iomap_seek_data helpers\n (bsc#1070995).\n\n - vfs: Add page_cache_seek_hole_data helper (bsc#1070995).\n\n - vfs: in iomap seek_(hole,data), return -ENXIO for\n negative offsets (bsc#1070995).\n\n - vhost: correctly check the return value of\n translate_desc() in log_used() (bsc#1051510).\n\n - vhost: log dirty page correctly\n (networking-stable-19_01_26).\n\n - vhost/vsock: fix uninitialized vhost_vsock->guest_cid\n (bsc#1051510).\n\n - video: clps711x-fb: release disp device node in probe()\n (bsc#1051510).\n\n - virtio-blk: Consider virtio_max_dma_size() for maximum\n segment size (bsc#1120008).\n\n - virtio: Introduce virtio_max_dma_size() (bsc#1120008).\n\n - virtio_net: Do not call free_old_xmit_skbs for\n xdp_frames (networking-stable-19_02_01).\n\n - virtio/s390: avoid race on vcdev->config (git-fixes).\n\n - virtio/s390: fix race in ccw_io_helper() (git-fixes).\n\n - vmci: Support upto 64-bit PPNs (bsc#1127286).\n\n - vsock: cope with memory allocation failure at socket\n creation time (bsc#1051510).\n\n - vxge: ensure data0 is initialized in when fetching\n firmware version information (bsc#1051510).\n\n - vxlan: Fix GRO cells race condition between receive and\n link delete (git-fixes).\n\n - vxlan: test dev->flags & IFF_UP before calling\n gro_cells_receive() (git-fixes).\n\n - vxlan: update skb dst pmtu on tx path (bsc#1123456).\n\n - w90p910_ether: remove incorrect __init annotation\n (bsc#1051510).\n\n - watchdog: docs: kernel-api: do not reference removed\n functions (bsc#1051510).\n\n - x86: Add TSX Force Abort CPUID/MSR (bsc#1121805).\n\n - x86/a.out: Clear the dump structure initially\n (bsc#1114279).\n\n - x86/apic: Provide apic_ack_irq() (bsc#1122822).\n\n - x86/boot/e820: Avoid overwriting e820_table_firmware\n (bsc#1127154).\n\n - x86/boot/e820: Introduce the bootloader provided\n e820_table_firmware[] table (bsc#1127154).\n\n - x86/boot/e820: Rename the e820_table_firmware to\n e820_table_kexec (bsc#1127154).\n\n - x86/cpu: Add Atom Tremont (Jacobsville) ().\n\n - x86/CPU/AMD: Set the CPB bit unconditionally on F17h\n (bsc#1114279).\n\n - x86/efi: Allocate e820 buffer before calling\n efi_exit_boot_service (bsc#1127307).\n\n - x86/Hyper-V: Set x2apic destination mode to physical\n when x2apic is available (bsc#1122822).\n\n - x86/kaslr: Fix incorrect i8254 outb() parameters\n (bsc#1114279).\n\n - x86/mce: Improve error message when kernel cannot\n recover, p2 (bsc#1114279).\n\n - x86/mtrr: Do not copy uninitialized gentry fields back\n to userspace (bsc#1114279).\n\n - x86/pkeys: Properly copy pkey state at fork()\n (bsc#1129366).\n\n - x86/platform/UV: Use efi_runtime_lock to serialise BIOS\n calls (bsc#1125614).\n\n - x86: respect memory size limiting via mem= parameter\n (bsc#1117645).\n\n - x86/vdso: Remove obsolete 'fake section table'\n reservation (bsc#1114279).\n\n - x86/xen: dont add memory above max allowed allocation\n (bsc#1117645).\n\n - xen, cpu_hotplug: Prevent an out of bounds access\n (bsc#1065600).\n\n - xen: fix dom0 boot on huge systems (bsc#1127836).\n\n - xen/manage: do not complain about an empty value in\n control/sysrq node (bsc#1065600).\n\n - xen: remove pre-xen3 fallback handlers (bsc#1065600).\n\n - xfs: add option to mount with barrier=0 or barrier=1\n (bsc#1088133).\n\n - xfs: fix contiguous dquot chunk iteration livelock\n (bsc#1070995).\n\n - xfs: remove filestream item xfs_inode reference\n (bsc#1127961).\n\n - xfs: rewrite xfs_dq_get_next_id using\n xfs_iext_lookup_extent (bsc#1070995).\n\n - xfs: Switch to iomap for SEEK_HOLE / SEEK_DATA\n (bsc#1070995).\n\n - yama: Check for pid death before checking ancestry\n (bsc#1051510).\n\n - yam: fix a missing-check bug (bsc#1051510).\n\n - zswap: re-check zswap_is_full() after do zswap_shrink()\n (bsc#1051510).\n\n - x86/uaccess: Do not leak the AC flag into __put_user()\n value evaluation (bsc#1114279).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1046305\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1046306\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1050549\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1051510\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1056787\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1060463\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1063638\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1065600\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1070995\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1071995\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1078355\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1082943\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1083548\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1083647\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1086095\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1086282\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1088133\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1094244\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1094555\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1098995\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1100132\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1103429\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1106811\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1107078\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1107665\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1108101\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1110096\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1113042\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1113399\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1113722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1113939\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1114279\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1114585\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1117108\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1117645\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1119019\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1119086\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1119843\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1120008\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1120601\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1120854\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1120902\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1120909\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1121317\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1121789\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1121805\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1122192\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1122764\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1122822\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1122982\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1123060\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1123061\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1123105\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1123161\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1123456\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1123882\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1124055\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1124235\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1124974\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1124975\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1124976\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1124978\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1124979\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1124980\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1124981\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1124982\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1124984\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1125125\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1125252\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1125315\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1125342\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1125614\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1125728\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1125780\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1125797\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1125799\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1125800\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1125907\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1125947\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126131\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126209\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126356\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126389\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126476\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126480\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126481\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126488\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126495\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126555\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126579\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126740\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126789\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126790\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126802\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126803\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126804\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126805\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126806\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1126807\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127042\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127062\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127082\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127154\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127285\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127286\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127307\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127363\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127378\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127445\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127493\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127494\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127495\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127496\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127497\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127498\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127534\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127561\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127567\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127595\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127603\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127682\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127731\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127750\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127836\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1127961\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1128094\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1128166\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1128351\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1128451\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1128895\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129046\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129080\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129163\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129179\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129181\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129182\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129183\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129184\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129205\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129276\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129281\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129284\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129285\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129291\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129292\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129293\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129294\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129295\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129296\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129326\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129327\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129330\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129363\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129366\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129497\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129519\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129543\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129547\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129551\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129581\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129625\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129664\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129739\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129770\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1129923\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1130130\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1130154\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1130335\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1130336\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1130337\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1130338\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1130425\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1130427\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1130518\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1131062\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=824948\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected the Linux Kernel packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8912\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-docs-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-macros\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-build\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-build-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-qa\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-source-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/01/25\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/04/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-debug-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-debug-base-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-debug-base-debuginfo-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-debug-debuginfo-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-debug-debugsource-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-debug-devel-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-debug-devel-debuginfo-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-default-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-default-base-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-default-base-debuginfo-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-default-debuginfo-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-default-debugsource-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-default-devel-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-default-devel-debuginfo-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-devel-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-docs-html-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-kvmsmall-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-kvmsmall-base-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-kvmsmall-base-debuginfo-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-kvmsmall-debuginfo-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-kvmsmall-debugsource-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-kvmsmall-devel-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-kvmsmall-devel-debuginfo-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-macros-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-obs-build-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-obs-build-debugsource-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-obs-qa-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-source-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-source-vanilla-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-syms-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-vanilla-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-vanilla-base-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-vanilla-base-debuginfo-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-vanilla-debuginfo-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-vanilla-debugsource-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-vanilla-devel-4.12.14-lp150.12.58.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"kernel-vanilla-devel-debuginfo-4.12.14-lp150.12.58.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel-debug / kernel-debug-base / kernel-debug-base-debuginfo / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-06-16T16:21:15", "description": "According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :\n\n - An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames. This is related to cgw_csum_xor_rel. An unprivileged user can trigger a system crash (general protection fault).(CVE-2019-3701)\n\n - A flaw was found in mmap in the Linux kernel allowing the process to map a null page. This allows attackers to abuse this mechanism to turn null pointer dereferences into workable exploits.(CVE-2019-9213)\n\n - A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.i1/4^CVE-2018-16862i1/4%0\n\n - It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation.i1/4^CVE-2018-10902i1/4%0\n\n - In the function wmi_set_ie() in the Linux kernel the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the aEUR~ie_lenaEURtm argument can cause a buffer overflow and thus a memory corruption leading to a system crash or other or unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.i1/4^CVE-2018-5848i1/4%0\n\n - A flaw was found in the Linux kernel in the function hid_debug_events_read() in the drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a user space. A local privileged user ('root') can cause a system lock up and a denial of service.i1/4^CVE-2019-3819i1/4%0\n\n - A flaw was found in the Linux kernel in the hid_debug_events_read() function in the drivers/hid/hid-debug.c file. A lack of the certain checks may allow a privileged user ('root') to achieve an out-of-bounds write and thus receiving user space buffer corruption.i1/4^CVE-2018-9516i1/4%0\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-04-04T00:00:00", "type": "nessus", "title": "EulerOS Virtualization 2.5.3 : kernel (EulerOS-SA-2019-1259)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-10902", "CVE-2018-16862", "CVE-2018-5848", "CVE-2018-9516", "CVE-2019-3701", "CVE-2019-3819", "CVE-2019-9213"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "p-cpe:/a:huawei:euleros:kernel-tools-libs-devel", "cpe:/o:huawei:euleros:uvp:2.5.3"], "id": "EULEROS_SA-2019-1259.NASL", "href": "https://www.tenable.com/plugins/nessus/123727", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(123727);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2018-10902\",\n \"CVE-2018-16862\",\n \"CVE-2018-5848\",\n \"CVE-2018-9516\",\n \"CVE-2019-3701\",\n \"CVE-2019-3819\",\n \"CVE-2019-9213\"\n );\n\n script_name(english:\"EulerOS Virtualization 2.5.3 : kernel (EulerOS-SA-2019-1259)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - An issue was discovered in can_can_gw_rcv in\n net/can/gw.c in the Linux kernel through 4.19.13. The\n CAN frame modification rules allow bitwise logical\n operations that can be also applied to the can_dlc\n field. Because of a missing check, the CAN drivers may\n write arbitrary content beyond the data registers in\n the CAN controller's I/O memory when processing can-gw\n manipulated outgoing frames. This is related to\n cgw_csum_xor_rel. An unprivileged user can trigger a\n system crash (general protection fault).(CVE-2019-3701)\n\n - A flaw was found in mmap in the Linux kernel allowing\n the process to map a null page. This allows attackers\n to abuse this mechanism to turn null pointer\n dereferences into workable exploits.(CVE-2019-9213)\n\n - A security flaw was found in the Linux kernel in a way\n that the cleancache subsystem clears an inode after the\n final file truncation (removal). The new file created\n with the same inode may contain leftover pages from\n cleancache and the old file data instead of the new\n one.i1/4^CVE-2018-16862i1/4%0\n\n - It was found that the raw midi kernel driver does not\n protect against concurrent access which leads to a\n double realloc (double free) in\n snd_rawmidi_input_params() and\n snd_rawmidi_output_status() which are part of\n snd_rawmidi_ioctl() handler in rawmidi.c file. A\n malicious local attacker could possibly use this for\n privilege escalation.i1/4^CVE-2018-10902i1/4%0\n\n - In the function wmi_set_ie() in the Linux kernel the\n length validation code does not handle unsigned integer\n overflow properly. As a result, a large value of the\n aEUR~ie_lenaEURtm argument can cause a buffer overflow and\n thus a memory corruption leading to a system crash or\n other or unspecified impact. Due to the nature of the\n flaw, privilege escalation cannot be fully ruled out,\n although we believe it is unlikely.i1/4^CVE-2018-5848i1/4%0\n\n - A flaw was found in the Linux kernel in the function\n hid_debug_events_read() in the drivers/hid/hid-debug.c\n file which may enter an infinite loop with certain\n parameters passed from a user space. A local privileged\n user ('root') can cause a system lock up and a denial\n of service.i1/4^CVE-2019-3819i1/4%0\n\n - A flaw was found in the Linux kernel in the\n hid_debug_events_read() function in the\n drivers/hid/hid-debug.c file. A lack of the certain\n checks may allow a privileged user ('root') to achieve\n an out-of-bounds write and thus receiving user space\n buffer corruption.i1/4^CVE-2018-9516i1/4%0\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1259\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?39825ffc\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/04/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:2.5.3\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"2.5.3\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 2.5.3\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-3.10.0-514.44.5.10_136\",\n \"kernel-devel-3.10.0-514.44.5.10_136\",\n \"kernel-headers-3.10.0-514.44.5.10_136\",\n \"kernel-tools-3.10.0-514.44.5.10_136\",\n \"kernel-tools-libs-3.10.0-514.44.5.10_136\",\n \"kernel-tools-libs-devel-3.10.0-514.44.5.10_136\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-08-10T16:01:06", "description": "The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4670 advisory.\n\n - A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e.\n depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target.\n Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. Kernel versions 4.18.x, 4.14.x and 3.10.x are believed to be vulnerable. (CVE-2018-14633)\n\n - An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free. (CVE-2018-20836)\n\n - An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c.\n This causes a Denial of Service, related to a use-after-free. (CVE-2019-11810)\n\n - An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup. (CVE-2019-11815)\n\n - The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\\0' character. (CVE-2019-11884)\n\n - A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1. (CVE-2019-3459)\n\n - A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user (root) can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable. (CVE-2019-3819)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"score": 8.1, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-06-07T00:00:00", "type": "nessus", "title": "Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4670)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-14633", "CVE-2018-20836", "CVE-2019-11810", "CVE-2019-11815", "CVE-2019-11884", "CVE-2019-3459", "CVE-2019-3819"], "modified": "2021-09-08T00:00:00", "cpe": ["cpe:/o:oracle:linux:6", "cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:kernel-uek", "p-cpe:/a:oracle:linux:kernel-uek-debug", "p-cpe:/a:oracle:linux:kernel-uek-debug-devel", "p-cpe:/a:oracle:linux:kernel-uek-devel", "p-cpe:/a:oracle:linux:kernel-uek-doc", "p-cpe:/a:oracle:linux:kernel-uek-firmware"], "id": "ORACLELINUX_ELSA-2019-4670.NASL", "href": "https://www.tenable.com/plugins/nessus/125755", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2019-4670.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(125755);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/09/08\");\n\n script_cve_id(\n \"CVE-2018-14633\",\n \"CVE-2018-20836\",\n \"CVE-2019-3459\",\n \"CVE-2019-3819\",\n \"CVE-2019-11810\",\n \"CVE-2019-11815\",\n \"CVE-2019-11884\"\n );\n\n script_name(english:\"Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4670)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe ELSA-2019-4670 advisory.\n\n - A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux\n kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote\n attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the\n iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e.\n depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and\n thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target.\n Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is\n highly unlikely. Kernel versions 4.18.x, 4.14.x and 3.10.x are believed to be vulnerable. (CVE-2018-14633)\n\n - An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout()\n and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free. (CVE-2018-20836)\n\n - An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when\n megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c.\n This causes a Denial of Service, related to a use-after-free. (CVE-2019-11810)\n\n - An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a\n race condition leading to a use-after-free, related to net namespace cleanup. (CVE-2019-11815)\n\n - The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a\n local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command,\n because a name field may not end with a '\\0' character. (CVE-2019-11884)\n\n - A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before\n 5.1-rc1. (CVE-2019-3459)\n\n - A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c\n file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged\n user (root) can cause a system lock up and a denial of service. Versions from v4.18 and newer are\n vulnerable. (CVE-2019-3819)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2019-4670.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-11815\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/09/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/06/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/06/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-firmware\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"linux_alt_patch_detect.nasl\", \"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('ksplice.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^(6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 6 / 7', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\nif ('x86_64' >!< cpu) audit(AUDIT_ARCH_NOT, 'x86_64', cpu);\n\nvar machine_uptrack_level = get_one_kb_item('Host/uptrack-uname-r');\nif (machine_uptrack_level)\n{\n var trimmed_uptrack_level = ereg_replace(string:machine_uptrack_level, pattern:\"\\.(x86_64|i[3-6]86|aarch64)$\", replace:'');\n var fixed_uptrack_levels = ['4.1.12-124.28.1.el6uek', '4.1.12-124.28.1.el7uek'];\n foreach var fixed_uptrack_level ( fixed_uptrack_levels ) {\n if (rpm_spec_vers_cmp(a:trimmed_uptrack_level, b:fixed_uptrack_level) >= 0)\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for ELSA-2019-4670');\n }\n }\n __rpm_report = 'Running KSplice level of ' + trimmed_uptrack_level + ' does not meet the minimum fixed level of ' + join(fixed_uptrack_levels, sep:' / ') + ' for this advisory.\\n\\n';\n}\n\nvar kernel_major_minor = get_kb_item('Host/uname/major_minor');\nif (empty_or_null(kernel_major_minor)) exit(1, 'Unable to determine kernel major-minor level.');\nvar expected_kernel_major_minor = '4.1';\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, 'running kernel level ' + expected_kernel_major_minor + ', it is running kernel level ' + kernel_major_minor);\n\nvar pkgs = [\n {'reference':'kernel-uek-4.1.12-124.28.1.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-4.1.12'},\n {'reference':'kernel-uek-debug-4.1.12-124.28.1.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-4.1.12'},\n {'reference':'kernel-uek-debug-devel-4.1.12-124.28.1.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-4.1.12'},\n {'reference':'kernel-uek-devel-4.1.12-124.28.1.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-4.1.12'},\n {'reference':'kernel-uek-doc-4.1.12-124.28.1.el6uek', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-4.1.12'},\n {'reference':'kernel-uek-firmware-4.1.12-124.28.1.el6uek', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-firmware-4.1.12'},\n {'reference':'kernel-uek-4.1.12-124.28.1.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-4.1.12'},\n {'reference':'kernel-uek-debug-4.1.12-124.28.1.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-4.1.12'},\n {'reference':'kernel-uek-debug-devel-4.1.12-124.28.1.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-4.1.12'},\n {'reference':'kernel-uek-devel-4.1.12-124.28.1.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-4.1.12'},\n {'reference':'kernel-uek-doc-4.1.12-124.28.1.el7uek', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-4.1.12'},\n {'reference':'kernel-uek-firmware-4.1.12-124.28.1.el7uek', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-firmware-4.1.12'}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release) {\n if (exists_check) {\n if (rpm_exists(release:release, rpm:exists_check) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-uek / kernel-uek-debug / kernel-uek-debug-devel / etc');\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-08-10T16:01:07", "description": "The remote OracleVM system is missing necessary patches to address critical security updates :\n\n - hugetlbfs: don't retry when pool page allocations start to fail (Mike Kravetz) [Orabug: 29324267]\n\n - x86/speculation: RSB stuffing with retpoline on Skylake+ cpus (William Roche) [Orabug: 29660924]\n\n - x86/speculation: reformatting RSB overwrite macro (William Roche) [Orabug: 29660924]\n\n - x86/speculation: Dynamic enable and disable of RSB stuffing with IBRS&!SMEP (William Roche) [Orabug:\n 29660924]\n\n - x86/speculation: STUFF_RSB dynamic enable (William Roche) [Orabug: 29660924]\n\n - int3 handler better address space detection on interrupts (William Roche) [Orabug: 29660924]\n\n - repairing out-of-tree build functionality (Mark Nicholson) [Orabug: 29755100]\n\n - ext4: fix false negatives*and* false positives in ext4_check_descriptors (Shuning Zhang) [Orabug:\n 29797007]\n\n - ocfs2: fix ocfs2 read inode data panic in ocfs2_iget (Shuning Zhang) [Orabug: 29233739]\n\n - Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer (Marcel Holtmann) [Orabug: 29526426] (CVE-2019-3459)\n\n - Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt (Marcel Holtmann) [Orabug: 29526426] (CVE-2019-3459)\n\n - HID: debug: fix the ring buffer implementation (Vladis Dronov) [Orabug: 29629481] (CVE-2019-3819) (CVE-2019-3819)\n\n - scsi: target: iscsi: Use hex2bin instead of a re-implementation (Vincent Pelletier) [Orabug: 29778875] (CVE-2018-14633) (CVE-2018-14633)\n\n - scsi: libsas: fix a race condition when smp task timeout (Jason Yan) [Orabug: 29783225] (CVE-2018-20836)\n\n - scsi: megaraid_sas: return error when create DMA pool failed (Jason Yan) [Orabug: 29783254] (CVE-2019-11810)\n\n - Bluetooth: hidp: fix buffer overflow (Young Xiao) [Orabug: 29786786] (CVE-2011-1079) (CVE-2019-11884)\n\n - x86/speculation/mds: Add 'mitigations=' support for MDS (Kanth Ghatraju) [Orabug: 29791046]\n\n - net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock. (Mao Wenan) [Orabug: 29802785] (CVE-2019-11815)", "cvss3": {"score": 8.1, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-06-07T00:00:00", "type": "nessus", "title": "OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0024)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-1079", "CVE-2018-14633", "CVE-2018-20836", "CVE-2019-11810", "CVE-2019-11815", "CVE-2019-11884", "CVE-2019-3459", "CVE-2019-3819"], "modified": "2020-01-10T00:00:00", "cpe": ["p-cpe:/a:oracle:vm:kernel-uek", "p-cpe:/a:oracle:vm:kernel-uek-firmware", "cpe:/o:oracle:vm_server:3.4"], "id": "ORACLEVM_OVMSA-2019-0024.NASL", "href": "https://www.tenable.com/plugins/nessus/125754", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from OracleVM\n# Security Advisory OVMSA-2019-0024.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(125754);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2020/01/10\");\n\n script_cve_id(\"CVE-2011-1079\", \"CVE-2018-14633\", \"CVE-2018-20836\", \"CVE-2019-11810\", \"CVE-2019-11815\", \"CVE-2019-11884\", \"CVE-2019-3459\", \"CVE-2019-3819\");\n script_bugtraq_id(46616);\n\n script_name(english:\"OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0024)\");\n script_summary(english:\"Checks the RPM output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote OracleVM host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote OracleVM system is missing necessary patches to address\ncritical security updates :\n\n - hugetlbfs: don't retry when pool page allocations start\n to fail (Mike Kravetz) [Orabug: 29324267]\n\n - x86/speculation: RSB stuffing with retpoline on Skylake+\n cpus (William Roche) [Orabug: 29660924]\n\n - x86/speculation: reformatting RSB overwrite macro\n (William Roche) [Orabug: 29660924]\n\n - x86/speculation: Dynamic enable and disable of RSB\n stuffing with IBRS&!SMEP (William Roche) [Orabug:\n 29660924]\n\n - x86/speculation: STUFF_RSB dynamic enable (William\n Roche) [Orabug: 29660924]\n\n - int3 handler better address space detection on\n interrupts (William Roche) [Orabug: 29660924]\n\n - repairing out-of-tree build functionality (Mark\n Nicholson) [Orabug: 29755100]\n\n - ext4: fix false negatives*and* false positives in\n ext4_check_descriptors (Shuning Zhang) [Orabug:\n 29797007]\n\n - ocfs2: fix ocfs2 read inode data panic in ocfs2_iget\n (Shuning Zhang) [Orabug: 29233739]\n\n - Bluetooth: Verify that l2cap_get_conf_opt provides large\n enough buffer (Marcel Holtmann) [Orabug: 29526426]\n (CVE-2019-3459)\n\n - Bluetooth: Check L2CAP option sizes returned from\n l2cap_get_conf_opt (Marcel Holtmann) [Orabug: 29526426]\n (CVE-2019-3459)\n\n - HID: debug: fix the ring buffer implementation (Vladis\n Dronov) [Orabug: 29629481] (CVE-2019-3819)\n (CVE-2019-3819)\n\n - scsi: target: iscsi: Use hex2bin instead of a\n re-implementation (Vincent Pelletier) [Orabug: 29778875]\n (CVE-2018-14633) (CVE-2018-14633)\n\n - scsi: libsas: fix a race condition when smp task timeout\n (Jason Yan) [Orabug: 29783225] (CVE-2018-20836)\n\n - scsi: megaraid_sas: return error when create DMA pool\n failed (Jason Yan) [Orabug: 29783254] (CVE-2019-11810)\n\n - Bluetooth: hidp: fix buffer overflow (Young Xiao)\n [Orabug: 29786786] (CVE-2011-1079) (CVE-2019-11884)\n\n - x86/speculation/mds: Add 'mitigations=' support for MDS\n (Kanth Ghatraju) [Orabug: 29791046]\n\n - net: rds: force to destroy connection if t_sock is NULL\n in rds_tcp_kill_sock. (Mao Wenan) [Orabug: 29802785]\n (CVE-2019-11815)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/oraclevm-errata/2019-June/000943.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel-uek / kernel-uek-firmware packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:kernel-uek-firmware\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:vm_server:3.4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2012/06/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/06/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/06/07\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"OracleVM Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleVM/release\", \"Host/OracleVM/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/OracleVM/release\");\nif (isnull(release) || \"OVS\" >!< release) audit(AUDIT_OS_NOT, \"OracleVM\");\nif (! preg(pattern:\"^OVS\" + \"3\\.4\" + \"(\\.[0-9]|$)\", string:release)) audit(AUDIT_OS_NOT, \"OracleVM 3.4\", \"OracleVM \" + release);\nif (!get_kb_item(\"Host/OracleVM/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"OracleVM\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"OVS3.4\", reference:\"kernel-uek-4.1.12-124.28.1.el6uek\")) flag++;\nif (rpm_check(release:\"OVS3.4\", reference:\"kernel-uek-firmware-4.1.12-124.28.1.el6uek\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel-uek / kernel-uek-firmware\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-08-10T16:09:05", "description": "The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed :\n\nCVE-2019-3819: A flaw was fixed in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may have enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') could have caused a system lock up and a denial of service (bnc#1123161).\n\nCVE-2019-15118: Fixed kernel stack exhaustion in check_input_term in sound/usb/mixer.c via mishandled recursion (bnc#1145922).\n\nCVE-2019-15117: Fixed out-of-bounds memory access in parse_audio_mixer_unit in sound/usb/mixer.c via mishandled short descriptor (bnc#1145920).\n\nCVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted.\nNOTE: QEMU creates the floppy device by default (bsc#1143189).\n\nCVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE:\nQEMU creates the floppy device by default (bsc#1143191).\n\nCVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023).\n\nCVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399).\n\nCVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358).\n\nCVE-2019-10207: Check for missing tty operations in bluetooth/hci_uart (bsc#1142857).\n\nCVE-2018-20856: Fixed a use-after-free issue in block/blk-core.c, where certain error case are mishandled (bnc#1143048).\n\nCVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045).\n\nCVE-2017-18551: An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel There was an out of bounds write in the function i2c_smbus_xfer_emulated (bnc#1146163).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-09-06T00:00:00", "type": "nessus", "title": "SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2299-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-18551", "CVE-2018-20855", "CVE-2018-20856", "CVE-2019-10207", "CVE-2019-1125", "CVE-2019-11810", "CVE-2019-13631", "CVE-2019-14283", "CVE-2019-14284", "CVE-2019-15117", "CVE-2019-15118", "CVE-2019-3819"], "modified": "2021-01-13T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-default", "p-cpe:/a:novell:suse_linux:kernel-default-base", "p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debugsource", "p-cpe:/a:novell:suse_linux:kernel-default-devel", "p-cpe:/a:novell:suse_linux:kernel-default-man", "p-cpe:/a:novell:suse_linux:kernel-syms", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_120-default", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2019-2299-1.NASL", "href": "https://www.tenable.com/plugins/nessus/128542", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:2299-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(128542);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/13\");\n\n script_cve_id(\"CVE-2017-18551\", \"CVE-2018-20855\", \"CVE-2018-20856\", \"CVE-2019-10207\", \"CVE-2019-1125\", \"CVE-2019-11810\", \"CVE-2019-13631\", \"CVE-2019-14283\", \"CVE-2019-14284\", \"CVE-2019-15117\", \"CVE-2019-15118\", \"CVE-2019-3819\");\n\n script_name(english:\"SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2299-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various\nsecurity and bugfixes.\n\nThe following security bugs were fixed :\n\nCVE-2019-3819: A flaw was fixed in the function\nhid_debug_events_read() in drivers/hid/hid-debug.c file which may have\nenter an infinite loop with certain parameters passed from a\nuserspace. A local privileged user ('root') could have caused a system\nlock up and a denial of service (bnc#1123161).\n\nCVE-2019-15118: Fixed kernel stack exhaustion in check_input_term in\nsound/usb/mixer.c via mishandled recursion (bnc#1145922).\n\nCVE-2019-15117: Fixed out-of-bounds memory access in\nparse_audio_mixer_unit in sound/usb/mixer.c via mishandled short\ndescriptor (bnc#1145920).\n\nCVE-2019-14284: The drivers/block/floppy.c allowed a denial of service\nby setup_format_params division-by-zero. Two consecutive ioctls can\ntrigger the bug: the first one should set the drive geometry with\n.sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the\nfloppy format operation should be called. It can be triggered by an\nunprivileged local user even when a floppy disk has not been inserted.\nNOTE: QEMU creates the floppy device by default (bsc#1143189).\n\nCVE-2019-14283: The function set_geometry in drivers/block/floppy.c\ndid not validate the sect and head fields, as demonstrated by an\ninteger overflow and out-of-bounds read. It can be triggered by an\nunprivileged local user when a floppy disk has been inserted. NOTE:\nQEMU creates the floppy device by default (bsc#1143191).\n\nCVE-2019-13631: In parse_hid_report_descriptor in\ndrivers/input/tablet/gtco.c, a malicious USB device can send an HID\nreport that triggers an out-of-bounds write during generation of\ndebugging messages (bsc#1142023).\n\nCVE-2019-11810: A NULL pointer dereference can occur when\nmegasas_create_frame_pool() fails in megasas_alloc_cmds() in\ndrivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of\nService, related to a use-after-free (bsc#1134399).\n\nCVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358).\n\nCVE-2019-10207: Check for missing tty operations in bluetooth/hci_uart\n(bsc#1142857).\n\nCVE-2018-20856: Fixed a use-after-free issue in block/blk-core.c,\nwhere certain error case are mishandled (bnc#1143048).\n\nCVE-2018-20855: An issue was discovered in create_qp_common in\ndrivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never\ninitialized, resulting in a leak of stack memory to userspace\n(bsc#1143045).\n\nCVE-2017-18551: An issue was discovered in\ndrivers/i2c/i2c-core-smbus.c in the Linux kernel There was an out of\nbounds write in the function i2c_smbus_xfer_emulated (bnc#1146163).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1045640\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1076033\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1107256\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123161\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1130972\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1134399\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1139358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1140012\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1140652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1140903\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1140945\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1141401\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1141402\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1141452\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1141453\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1141454\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1141628\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1142023\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1142098\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1142857\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1143045\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1143048\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1143189\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1143191\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1144257\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1144273\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1144288\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1144920\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1145920\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1145922\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1146163\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-18551/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-20855/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-20856/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-10207/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-1125/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-11810/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-13631/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-14283/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-14284/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-15117/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-15118/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-3819/\"\n );\n # https://www.suse.com/support/update/announcement/2019/suse-su-20192299-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?9ce411ba\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE OpenStack Cloud 7:zypper in -t patch\nSUSE-OpenStack-Cloud-7-2019-2299=1\n\nSUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch\nSUSE-SLE-SAP-12-SP2-2019-2299=1\n\nSUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-SP2-2019-2299=1\n\nSUSE Linux Enterprise Server 12-SP2-BCL:zypper in -t patch\nSUSE-SLE-SERVER-12-SP2-BCL-2019-2299=1\n\nSUSE Linux Enterprise High Availability 12-SP2:zypper in -t patch\nSUSE-SLE-HA-12-SP2-2019-2299=1\n\nSUSE Enterprise Storage 4:zypper in -t patch\nSUSE-Storage-4-2019-2299=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-15117\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-man\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_120-default\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/01/25\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/09/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/09/06\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP2\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_121-92_120-default-1-3.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"s390x\", reference:\"kernel-default-man-4.4.121-92.120.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-default-4.4.121-92.120.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-default-base-4.4.121-92.120.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-default-base-debuginfo-4.4.121-92.120.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-default-debuginfo-4.4.121-92.120.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-default-debugsource-4.4.121-92.120.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-default-devel-4.4.121-92.120.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-syms-4.4.121-92.120.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-10T16:08:08", "description": "The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed :\n\nCVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358).\n\nCVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045).\n\nCVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted.\nNOTE: QEMU creates the floppy device by default (bsc#1143189).\n\nCVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE:\nQEMU creates the floppy device by default (bsc#1143191).\n\nCVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399).\n\nCVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c (bnc#1142254).\n\nCVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023).\n\nCVE-2019-15118: Fixed kernel stack exhaustion in check_input_term in sound/usb/mixer.c via mishandled recursion (bnc#1145922).\n\nCVE-2019-15117: Fixed out-of-bounds memory access in parse_audio_mixer_unit in sound/usb/mixer.c via mishandled short descriptor (bnc#1145920).\n\nCVE-2019-3819: A flaw was fixed in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may have enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') could have caused a system lock up and a denial of service (bnc#1123161).\n\nCVE-2019-10207: Check for missing tty operations in bluetooth/hci_uart (bsc#1142857).\n\nCVE-2018-20856: Fixed a use-after-free issue in block/blk-core.c, where certain error case are mishandled (bnc#1143048).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-09-03T00:00:00", "type": "nessus", "title": "SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2263-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-20855", "CVE-2018-20856", "CVE-2019-10207", "CVE-2019-1125", "CVE-2019-11810", "CVE-2019-13631", "CVE-2019-13648", "CVE-2019-14283", "CVE-2019-14284", "CVE-2019-15117", "CVE-2019-15118", "CVE-2019-3819"], "modified": "2021-01-13T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-default", "p-cpe:/a:novell:suse_linux:kernel-default-base", "p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debugsource", "p-cpe:/a:novell:suse_linux:kernel-default-devel", "p-cpe:/a:novell:suse_linux:kernel-default-man", "p-cpe:/a:novell:suse_linux:kernel-syms", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_103-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_103-default-debuginfo", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2019-2263-1.NASL", "href": "https://www.tenable.com/plugins/nessus/128470", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:2263-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(128470);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/13\");\n\n script_cve_id(\"CVE-2018-20855\", \"CVE-2018-20856\", \"CVE-2019-10207\", \"CVE-2019-1125\", \"CVE-2019-11810\", \"CVE-2019-13631\", \"CVE-2019-13648\", \"CVE-2019-14283\", \"CVE-2019-14284\", \"CVE-2019-15117\", \"CVE-2019-15118\", \"CVE-2019-3819\");\n\n script_name(english:\"SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2263-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various\nsecurity and bugfixes.\n\nThe following security bugs were fixed :\n\nCVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358).\n\nCVE-2018-20855: An issue was discovered in create_qp_common in\ndrivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never\ninitialized, resulting in a leak of stack memory to userspace\n(bsc#1143045).\n\nCVE-2019-14284: The drivers/block/floppy.c allowed a denial of service\nby setup_format_params division-by-zero. Two consecutive ioctls can\ntrigger the bug: the first one should set the drive geometry with\n.sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the\nfloppy format operation should be called. It can be triggered by an\nunprivileged local user even when a floppy disk has not been inserted.\nNOTE: QEMU creates the floppy device by default (bsc#1143189).\n\nCVE-2019-14283: The function set_geometry in drivers/block/floppy.c\ndid not validate the sect and head fields, as demonstrated by an\ninteger overflow and out-of-bounds read. It can be triggered by an\nunprivileged local user when a floppy disk has been inserted. NOTE:\nQEMU creates the floppy device by default (bsc#1143191).\n\nCVE-2019-11810: A NULL pointer dereference can occur when\nmegasas_create_frame_pool() fails in megasas_alloc_cmds() in\ndrivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of\nService, related to a use-after-free (bsc#1134399).\n\nCVE-2019-13648: In the Linux kernel on the powerpc platform, when\nhardware transactional memory is disabled, a local user can cause a\ndenial of service (TM Bad Thing exception and system crash) via a\nsigreturn() system call that sends a crafted signal frame. This\naffects arch/powerpc/kernel/signal_32.c and\narch/powerpc/kernel/signal_64.c (bnc#1142254).\n\nCVE-2019-13631: In parse_hid_report_descriptor in\ndrivers/input/tablet/gtco.c, a malicious USB device can send an HID\nreport that triggers an out-of-bounds write during generation of\ndebugging messages (bsc#1142023).\n\nCVE-2019-15118: Fixed kernel stack exhaustion in check_input_term in\nsound/usb/mixer.c via mishandled recursion (bnc#1145922).\n\nCVE-2019-15117: Fixed out-of-bounds memory access in\nparse_audio_mixer_unit in sound/usb/mixer.c via mishandled short\ndescriptor (bnc#1145920).\n\nCVE-2019-3819: A flaw was fixed in the function\nhid_debug_events_read() in drivers/hid/hid-debug.c file which may have\nenter an infinite loop with certain parameters passed from a\nuserspace. A local privileged user ('root') could have caused a system\nlock up and a denial of service (bnc#1123161).\n\nCVE-2019-10207: Check for missing tty operations in bluetooth/hci_uart\n(bsc#1142857).\n\nCVE-2018-20856: Fixed a use-after-free issue in block/blk-core.c,\nwhere certain error case are mishandled (bnc#1143048).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106061\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123161\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125674\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127034\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128977\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1130972\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1133860\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1134399\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1135335\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1135365\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1137584\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1139358\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1139826\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1140652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1140903\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1140945\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1141181\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1141401\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1141402\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1141452\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1141453\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1141454\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1142023\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1142254\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1142857\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1143045\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1143048\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1143189\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1143191\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1143333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1144257\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1144273\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1144288\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1144920\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1145920\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1145922\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-20855/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-20856/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-10207/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-1125/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-11810/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-13631/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-13648/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-14283/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-14284/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-15117/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-15118/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-3819/\"\n );\n # https://www.suse.com/support/update/announcement/2019/suse-su-20192263-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?144f001a\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE OpenStack Cloud Crowbar 8:zypper in -t patch\nSUSE-OpenStack-Cloud-Crowbar-8-2019-2263=1\n\nSUSE OpenStack Cloud 8:zypper in -t patch\nSUSE-OpenStack-Cloud-8-2019-2263=1\n\nSUSE Linux Enterprise Server for SAP 12-SP3:zypper in -t patch\nSUSE-SLE-SAP-12-SP3-2019-2263=1\n\nSUSE Linux Enterprise Server 12-SP3-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-SP3-2019-2263=1\n\nSUSE Linux Enterprise Server 12-SP3-BCL:zypper in -t patch\nSUSE-SLE-SERVER-12-SP3-BCL-2019-2263=1\n\nSUSE Linux Enterprise High Availability 12-SP3:zypper in -t patch\nSUSE-SLE-HA-12-SP3-2019-2263=1\n\nSUSE Enterprise Storage 5:zypper in -t patch\nSUSE-Storage-5-2019-2263=1\n\nSUSE CaaS Platform 3.0 :\n\nTo install this update, use the SUSE CaaS Platform Velum dashboard. It\nwill inform you if it detects new updates and let you then trigger\nupdating of the complete cluster in a controlled way.\n\nHPE Helion Openstack 8:zypper in -t patch\nHPE-Helion-OpenStack-8-2019-2263=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-15117\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-man\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_103-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_103-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/01/25\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/09/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/09/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP3\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_180-94_103-default-1-4.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_180-94_103-default-debuginfo-1-4.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"s390x\", reference:\"kernel-default-man-4.4.180-94.103.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-default-4.4.180-94.103.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-default-base-4.4.180-94.103.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-default-base-debuginfo-4.4.180-94.103.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-default-debuginfo-4.4.180-94.103.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-default-debugsource-4.4.180-94.103.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-default-devel-4.4.180-94.103.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-syms-4.4.180-94.103.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-10T15:45:45", "description": "The SUSE Linux Enterprise Server 12 SP4 Azure kernel was updated to fix various issues.\n\nThe following security bugs were fixed :\n\nCVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).\n\nCVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166 1128378 1129016).\n\nCVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).\n\nCVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).\n\nCVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which led to a use-after-free in sockfs_setattr (bnc#1125907 1126284).\n\nCVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).\n\nCVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).\n\nCVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).\n\nCVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).\n\nCVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).\n\nCVE-2018-20669: An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c where a local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation (bnc#1122971).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 8.1, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-03-28T00:00:00", "type": "nessus", "title": "SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0767-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-20669", "CVE-2019-2024", "CVE-2019-3459", "CVE-2019-3460", "CVE-2019-3819", "CVE-2019-6974", "CVE-2019-7221", "CVE-2019-7222", "CVE-2019-7308", "CVE-2019-8912", "CVE-2019-8980", "CVE-2019-9213"], "modified": "2022-05-20T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-azure", "p-cpe:/a:novell:suse_linux:kernel-azure-base", "p-cpe:/a:novell:suse_linux:kernel-azure-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-azure-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-azure-debugsource", "p-cpe:/a:novell:suse_linux:kernel-azure-devel", "p-cpe:/a:novell:suse_linux:kernel-syms-azure", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2019-0767-1.NASL", "href": "https://www.tenable.com/plugins/nessus/123445", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:0767-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(123445);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/20\");\n\n script_cve_id(\n \"CVE-2018-20669\",\n \"CVE-2019-2024\",\n \"CVE-2019-3459\",\n \"CVE-2019-3460\",\n \"CVE-2019-3819\",\n \"CVE-2019-6974\",\n \"CVE-2019-7221\",\n \"CVE-2019-7222\",\n \"CVE-2019-7308\",\n \"CVE-2019-8912\",\n \"CVE-2019-8980\",\n \"CVE-2019-9213\"\n );\n\n script_name(english:\"SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0767-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The SUSE Linux Enterprise Server 12 SP4 Azure kernel was updated to\nfix various issues.\n\nThe following security bugs were fixed :\n\nCVE-2019-2024: A use-after-free when disconnecting a source was fixed\nwhich could lead to crashes. bnc#1129179).\n\nCVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the\nmmap minimum address, which made it easier for attackers to exploit\nkernel NULL pointer dereferences on non-SMAP platforms. This is\nrelated to a capability check for the wrong task (bnc#1128166 1128378\n1129016).\n\nCVE-2019-8980: A memory leak in the kernel_read_file function in\nfs/exec.c allowed attackers to cause a denial of service (memory\nconsumption) by triggering vfs_read failures (bnc#1126209).\n\nCVE-2019-3819: A flaw was found in the function\nhid_debug_events_read() in drivers/hid/hid-debug.c file which may\nenter an infinite loop with certain parameters passed from a\nuserspace. A local privileged user ('root') can cause a system lock up\nand a denial of service. (bnc#1123161).\n\nCVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a\nNULL value for a certain structure member, which led to a\nuse-after-free in sockfs_setattr (bnc#1125907 1126284).\n\nCVE-2019-7308: kernel/bpf/verifier.c performed undesirable\nout-of-bounds speculation on pointer arithmetic in various cases,\nincluding cases of different branches with different state or limits\nto sanitize, leading to side-channel attacks (bnc#1124055).\n\nCVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two\nremote information leak vulnerabilities in the code that handles\nincoming L2cap configuration packets (bsc#1120758).\n\nCVE-2019-7221: Fixed a use-after-free vulnerability in the KVM\nhypervisor related to the emulation of a preemption timer, allowing an\nguest user/process to crash the host kernel. (bsc#1124732).\n\nCVE-2019-7222: Fixed an information leakage in the KVM hypervisor\nrelated to handling page fault exceptions, which allowed a guest\nuser/process to use this flaw to leak the host's stack memory contents\nto a guest (bsc#1124735).\n\nCVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c\nmishandled reference counting because of a race condition, leading to\na use-after-free (bnc#1124728).\n\nCVE-2018-20669: An issue where a provided address with access_ok() is\nnot checked was discovered in i915_gem_execbuffer2_ioctl in\ndrivers/gpu/drm/i915/i915_gem_execbuffer.c where a local attacker can\ncraft a malicious IOCTL function call to overwrite arbitrary kernel\nmemory, resulting in a Denial of Service or privilege escalation\n(bnc#1122971).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1046305\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1046306\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1050252\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1050549\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1051510\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1054610\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1055121\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056658\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056662\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056787\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1060463\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063638\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065600\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070995\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071995\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1078355\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1082943\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1083548\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1083647\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1084216\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086095\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086282\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086301\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086313\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086314\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086323\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1087082\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1087092\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1088133\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1094555\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098382\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098425\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098995\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1103429\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1104353\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106105\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106434\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106811\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1107078\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1107665\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1108101\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1108870\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1109695\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110096\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110705\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1111666\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113042\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113712\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113722\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113939\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1114279\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1114585\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1114893\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117108\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117155\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117645\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117947\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1118338\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1119019\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1119086\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1119766\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1119843\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120008\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120601\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120758\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120854\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120902\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120909\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120955\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1121317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1121726\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1121789\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1121805\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122159\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122192\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122324\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122554\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122662\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122764\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122779\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122822\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122885\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122927\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122944\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122971\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122982\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123060\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123061\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123161\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123348\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123357\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123456\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123538\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123697\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123882\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123933\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124055\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124204\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124235\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124579\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124589\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124728\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124732\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124735\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124969\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124974\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124975\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124976\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124978\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124979\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124980\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124981\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124982\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124984\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124985\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125109\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125125\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125252\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125315\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125614\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125728\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125780\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125797\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125799\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125800\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125907\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125947\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126131\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126209\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126284\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126389\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126393\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126476\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126480\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126481\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126488\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126495\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126555\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126579\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126789\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126790\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126802\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126803\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126804\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126805\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126806\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126807\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127042\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127062\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127081\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127082\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127154\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127285\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127286\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127307\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127363\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127493\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127494\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127495\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127496\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127497\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127498\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127534\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127561\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127567\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127577\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127595\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127603\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127682\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127731\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127750\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127836\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127961\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128094\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128166\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128351\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128378\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128451\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128895\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129016\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129046\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129080\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129163\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129179\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129181\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129182\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129183\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129184\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129205\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129281\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129284\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129285\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129291\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129292\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129293\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129294\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129295\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129296\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129326\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129327\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129330\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129363\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129366\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129497\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129519\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129543\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129547\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129551\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129581\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129625\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129664\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129739\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129923\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=807502\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=828192\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2018-20669/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-2024/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-3459/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-3460/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-3819/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-6974/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-7221/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-7222/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-7308/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8912/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8980/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-9213/\");\n # https://www.suse.com/support/update/announcement/2019/suse-su-20190767-1/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?542ed9f0\");\n script_set_attribute(attribute:\"solution\", value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-SP4:zypper in -t patch\nSUSE-SLE-SERVER-12-SP4-2019-767=1\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8912\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-6974\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/01/25\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/03/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/03/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-azure-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-azure-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-azure-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-azure-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-azure-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"x86_64\") audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-azure-4.12.14-6.9.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-azure-base-4.12.14-6.9.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-azure-base-debuginfo-4.12.14-6.9.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-azure-debuginfo-4.12.14-6.9.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-azure-debugsource-4.12.14-6.9.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-azure-devel-4.12.14-6.9.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-syms-azure-4.12.14-6.9.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-08-10T15:45:09", "description": "The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed :\n\nCVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).\n\nCVE-2019-9213: expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).\n\nCVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).\n\nCVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable (bnc#1123161).\n\nCVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).\n\nCVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).\n\nCVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).\n\nCVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).\n\nCVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).\n\nCVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).\n\nCVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks.\n(bnc#1122971).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 8.1, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-03-29T00:00:00", "type": "nessus", "title": "SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:0784-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-20669", "CVE-2019-2024", "CVE-2019-3459", "CVE-2019-3460", "CVE-2019-3819", "CVE-2019-6974", "CVE-2019-7221", "CVE-2019-7222", "CVE-2019-7308", "CVE-2019-8912", "CVE-2019-8980", "CVE-2019-9213"], "modified": "2022-05-20T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-default", "p-cpe:/a:novell:suse_linux:kernel-default-base", "p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debugsource", "p-cpe:/a:novell:suse_linux:kernel-default-devel", "p-cpe:/a:novell:suse_linux:kernel-default-devel-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-man", "p-cpe:/a:novell:suse_linux:kernel-obs-build", "p-cpe:/a:novell:suse_linux:kernel-obs-build-debugsource", "p-cpe:/a:novell:suse_linux:kernel-obs-qa", "p-cpe:/a:novell:suse_linux:kernel-syms", "p-cpe:/a:novell:suse_linux:kernel-vanilla-base", "p-cpe:/a:novell:suse_linux:kernel-vanilla-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-vanilla-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-vanilla-debugsource", "p-cpe:/a:novell:suse_linux:kernel-zfcpdump", "p-cpe:/a:novell:suse_linux:kernel-zfcpdump-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-zfcpdump-debugsource", "p-cpe:/a:novell:suse_linux:kselftests-kmp-default", "p-cpe:/a:novell:suse_linux:kselftests-kmp-default-debuginfo", "p-cpe:/a:novell:suse_linux:reiserfs-kmp-default", "p-cpe:/a:novell:suse_linux:reiserfs-kmp-default-debuginfo", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2019-0784-1.NASL", "href": "https://www.tenable.com/plugins/nessus/123496", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:0784-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(123496);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/20\");\n\n script_cve_id(\n \"CVE-2018-20669\",\n \"CVE-2019-2024\",\n \"CVE-2019-3459\",\n \"CVE-2019-3460\",\n \"CVE-2019-3819\",\n \"CVE-2019-6974\",\n \"CVE-2019-7221\",\n \"CVE-2019-7222\",\n \"CVE-2019-7308\",\n \"CVE-2019-8912\",\n \"CVE-2019-8980\",\n \"CVE-2019-9213\"\n );\n\n script_name(english:\"SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:0784-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The SUSE Linux Enterprise 15 kernel was updated to receive various\nsecurity and bugfixes.\n\nThe following security bugs were fixed :\n\nCVE-2019-2024: A use-after-free when disconnecting a source was fixed\nwhich could lead to crashes. bnc#1129179).\n\nCVE-2019-9213: expand_downwards in mm/mmap.c lacks a check for the\nmmap minimum address, which made it easier for attackers to exploit\nkernel NULL pointer dereferences on non-SMAP platforms. This is\nrelated to a capability check for the wrong task (bnc#1128166).\n\nCVE-2019-8980: A memory leak in the kernel_read_file function in\nfs/exec.c allowed attackers to cause a denial of service (memory\nconsumption) by triggering vfs_read failures (bnc#1126209).\n\nCVE-2019-3819: A flaw was found in the function\nhid_debug_events_read() in drivers/hid/hid-debug.c file which may\nenter an infinite loop with certain parameters passed from a\nuserspace. A local privileged user ('root') can cause a system lock up\nand a denial of service. Versions from v4.18 and newer are vulnerable\n(bnc#1123161).\n\nCVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a\nNULL value for a certain structure member, which leads to a\nuse-after-free in sockfs_setattr (bnc#1125907).\n\nCVE-2019-7308: kernel/bpf/verifier.c performed undesirable\nout-of-bounds speculation on pointer arithmetic in various cases,\nincluding cases of different branches with different state or limits\nto sanitize, leading to side-channel attacks (bnc#1124055).\n\nCVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two\nremote information leak vulnerabilities in the code that handles\nincoming L2cap configuration packets (bsc#1120758).\n\nCVE-2019-7221: Fixed a user-after-free vulnerability in the KVM\nhypervisor related to the emulation of a preemption timer, allowing an\nguest user/process to crash the host kernel. (bsc#1124732).\n\nCVE-2019-7222: Fixed an information leakage in the KVM hypervisor\nrelated to handling page fault exceptions, which allowed a guest\nuser/process to use this flaw to leak the host's stack memory contents\nto a guest (bsc#1124735).\n\nCVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c\nmishandled reference counting because of a race condition, leading to\na use-after-free (bnc#1124728).\n\nCVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915\ndriver were fixed which might have lead to information leaks.\n(bnc#1122971).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1046305\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1046306\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1050252\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1050549\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1051510\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1054610\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1055121\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056658\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056662\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056787\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1060463\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063638\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065600\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070995\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071995\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1078355\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1082943\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1083548\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1083647\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1084216\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086095\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086282\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086301\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086313\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086314\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086323\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1087082\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1087092\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1088133\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1094555\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098382\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098425\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098995\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1103429\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1104353\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106105\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106434\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106811\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1107078\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1107665\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1108101\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1108870\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1109695\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110096\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110705\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1111666\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113042\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113712\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113722\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113939\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1114279\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1114585\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117108\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117155\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117645\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1118338\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1119019\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1119086\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1119766\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1119843\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120008\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120601\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120758\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120854\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120902\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120909\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120955\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1121317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1121726\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1121789\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1121805\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122019\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122192\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122324\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122554\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122662\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122764\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122779\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122822\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122885\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122927\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122944\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122971\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122982\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123060\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123061\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123161\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123348\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123357\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123456\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123538\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123697\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123882\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123933\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124055\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124204\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124235\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124579\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124589\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124728\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124732\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124735\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124969\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124974\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124975\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124976\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124978\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124979\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124980\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124981\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124982\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124984\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124985\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125109\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125125\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125252\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125315\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125614\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125728\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125780\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125797\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125799\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125800\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125907\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125947\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126131\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126209\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126389\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126393\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126476\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126480\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126481\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126488\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126495\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126555\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126579\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126789\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126790\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126802\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126803\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126804\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126805\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126806\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126807\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127042\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127062\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127082\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127154\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127285\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127286\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127307\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127363\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127493\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127494\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127495\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127496\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127497\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127498\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127534\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127561\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127567\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127595\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127603\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127682\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127731\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127750\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127836\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127961\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128094\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128166\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128351\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128451\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128895\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129046\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129080\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129163\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129179\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129181\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129182\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129183\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129184\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129205\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129281\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129284\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129285\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129291\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129292\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129293\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129294\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129295\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129296\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129326\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129327\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129330\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129363\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129366\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129497\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129519\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129543\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129547\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129551\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129581\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129625\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129664\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129739\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129923\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=824948\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2018-20669/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-2024/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-3459/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-3460/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-3819/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-6974/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-7221/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-7222/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-7308/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8912/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8980/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-9213/\");\n # https://www.suse.com/support/update/announcement/2019/suse-su-20190784-1/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?c8e3e6e7\");\n script_set_attribute(attribute:\"solution\", value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Workstation Extension 15:zypper in -t patch\nSUSE-SLE-Product-WE-15-2019-784=1\n\nSUSE Linux Enterprise Module for Open Buildservice Development Tools\n15:zypper in -t patch\nSUSE-SLE-Module-Development-Tools-OBS-15-2019-784=1\n\nSUSE Linux Enterprise Module for Live Patching 15:zypper in -t patch\nSUSE-SLE-Module-Live-Patching-15-2019-784=1\n\nSUSE Linux Enterprise Module for Legacy Software 15:zypper in -t patch\nSUSE-SLE-Module-Legacy-15-2019-784=1\n\nSUSE Linux Enterprise Module for Development Tools 15:zypper in -t\npatch SUSE-SLE-Module-Development-Tools-15-2019-784=1\n\nSUSE Linux Enterprise Module for Basesystem 15:zypper in -t patch\nSUSE-SLE-Module-Basesystem-15-2019-784=1\n\nSUSE Linux Enterprise High Availability 15:zypper in -t patch\nSUSE-SLE-Product-HA-15-2019-784=1\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8912\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-6974\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/01/25\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/03/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/03/29\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-man\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-obs-build\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-obs-build-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-obs-qa\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-vanilla-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-vanilla-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-vanilla-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-vanilla-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-zfcpdump\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-zfcpdump-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-zfcpdump-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kselftests-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kselftests-kmp-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:reiserfs-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:reiserfs-kmp-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED15|SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED15 / SLES15\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES15 SP0\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED15\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED15 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"kernel-default-man-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"kernel-zfcpdump-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"kernel-zfcpdump-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"kernel-zfcpdump-debugsource-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-default-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-default-base-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-default-base-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-default-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-default-debugsource-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-default-devel-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-default-devel-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-obs-build-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-obs-build-debugsource-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-obs-qa-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-syms-4.12.14-150.14.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-vanilla-base-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-vanilla-base-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-vanilla-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kernel-vanilla-debugsource-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kselftests-kmp-default-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"kselftests-kmp-default-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"reiserfs-kmp-default-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"reiserfs-kmp-default-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", cpu:\"s390x\", reference:\"kernel-default-man-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", cpu:\"s390x\", reference:\"kernel-zfcpdump-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", cpu:\"s390x\", reference:\"kernel-zfcpdump-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", cpu:\"s390x\", reference:\"kernel-zfcpdump-debugsource-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-default-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-default-base-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-default-base-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-default-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-default-debugsource-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-default-devel-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-default-devel-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-obs-build-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-obs-build-debugsource-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-obs-qa-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-syms-4.12.14-150.14.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-vanilla-base-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-vanilla-base-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-vanilla-debuginfo-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kernel-vanilla-debugsource-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kselftests-kmp-default-4.12.14-150.14.2\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"kselftests-kmp-default-debuginfo-4.12.14-150.14.2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-06-16T16:19:17", "description": "The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed :\n\nCVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks.\n(bnc#1122971).\n\nCVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).\n\nCVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).\n\nCVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728 ).\n\nCVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).\n\nCVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).\n\nCVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).\n\nCVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).\n\nCVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).\n\nCVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).\n\nCVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 8.1, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-03-27T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:0765-1) (Spectre)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-5753", "CVE-2018-20669", "CVE-2019-2024", "CVE-2019-3459", "CVE-2019-3460", "CVE-2019-3819", "CVE-2019-6974", "CVE-2019-7221", "CVE-2019-7222", "CVE-2019-7308", "CVE-2019-8912", "CVE-2019-8980", "CVE-2019-9213"], "modified": "2022-05-20T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-default", "p-cpe:/a:novell:suse_linux:kernel-default-base", "p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debugsource", "p-cpe:/a:novell:suse_linux:kernel-default-devel", "p-cpe:/a:novell:suse_linux:kernel-default-devel-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-extra", "p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-man", "p-cpe:/a:novell:suse_linux:kernel-syms", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2019-0765-1.NASL", "href": "https://www.tenable.com/plugins/nessus/123413", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:0765-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(123413);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/20\");\n\n script_cve_id(\n \"CVE-2017-5753\",\n \"CVE-2018-20669\",\n \"CVE-2019-2024\",\n \"CVE-2019-3459\",\n \"CVE-2019-3460\",\n \"CVE-2019-3819\",\n \"CVE-2019-6974\",\n \"CVE-2019-7221\",\n \"CVE-2019-7222\",\n \"CVE-2019-7308\",\n \"CVE-2019-8912\",\n \"CVE-2019-8980\",\n \"CVE-2019-9213\"\n );\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:0765-1) (Spectre)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various\nsecurity and bugfixes.\n\nThe following security bugs were fixed :\n\nCVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915\ndriver were fixed which might have lead to information leaks.\n(bnc#1122971).\n\nCVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two\nremote information leak vulnerabilities in the code that handles\nincoming L2cap configuration packets (bsc#1120758).\n\nCVE-2019-3819: A flaw was found in the function\nhid_debug_events_read() in drivers/hid/hid-debug.c file which may\nenter an infinite loop with certain parameters passed from a\nuserspace. A local privileged user ('root') can cause a system lock up\nand a denial of service. (bnc#1123161).\n\nCVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c\nmishandled reference counting because of a race condition, leading to\na use-after-free (bnc#1124728 ).\n\nCVE-2019-7221: Fixed a use-after-free vulnerability in the KVM\nhypervisor related to the emulation of a preemption timer, allowing an\nguest user/process to crash the host kernel. (bsc#1124732).\n\nCVE-2019-7222: Fixed an information leakage in the KVM hypervisor\nrelated to handling page fault exceptions, which allowed a guest\nuser/process to use this flaw to leak the host's stack memory contents\nto a guest (bsc#1124735).\n\nCVE-2019-7308: kernel/bpf/verifier.c performed undesirable\nout-of-bounds speculation on pointer arithmetic in various cases,\nincluding cases of different branches with different state or limits\nto sanitize, leading to side-channel attacks (bnc#1124055).\n\nCVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a\nNULL value for a certain structure member, which leads to a\nuse-after-free in sockfs_setattr (bnc#1125907).\n\nCVE-2019-8980: A memory leak in the kernel_read_file function in\nfs/exec.c allowed attackers to cause a denial of service (memory\nconsumption) by triggering vfs_read failures (bnc#1126209).\n\nCVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the\nmmap minimum address, which made it easier for attackers to exploit\nkernel NULL pointer dereferences on non-SMAP platforms. This is\nrelated to a capability check for the wrong task (bnc#1128166).\n\nCVE-2019-2024: A use-after-free when disconnecting a source was fixed\nwhich could lead to crashes. bnc#1129179).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1046305\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1046306\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1050252\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1050549\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1051510\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1054610\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1055121\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056658\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056662\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056787\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1060463\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063638\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065600\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1068032\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070995\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071995\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1074562\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1074578\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1074701\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1075006\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1075419\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1075748\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1078355\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1080039\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1082943\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1083548\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1083647\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1084216\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086095\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086282\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086301\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086313\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086314\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1086323\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1087082\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1087084\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1087092\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1087939\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1088133\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1094555\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098382\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098425\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098995\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1102055\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1103429\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1104353\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106105\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106434\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106811\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1107078\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1107665\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1108101\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1108870\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1109695\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110096\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110705\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1111666\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113042\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113712\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113722\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113769\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113939\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1114279\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1114585\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1114893\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117108\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117155\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117645\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117947\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1118338\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1119019\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1119086\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1119766\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1119843\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120008\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120601\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120758\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120854\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120902\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120909\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120955\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1121317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1121726\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1121789\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1121805\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122019\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122159\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122192\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122292\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122324\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122554\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122662\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122764\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122779\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122822\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122885\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122927\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122944\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122971\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1122982\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123060\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123061\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123161\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123348\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123357\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123456\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123538\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123697\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123882\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1123933\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124055\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124204\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124235\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124579\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124589\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124728\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124732\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124735\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124969\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124974\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124975\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124976\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124978\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124979\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124980\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124981\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124982\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124984\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1124985\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125109\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125125\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125252\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125315\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125614\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125728\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125780\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125797\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125799\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125800\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125907\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1125947\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126131\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126209\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126389\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126393\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126476\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126480\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126481\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126488\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126495\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126555\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126579\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126789\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126790\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126802\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126803\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126804\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126805\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126806\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1126807\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127042\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127062\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127082\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127154\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127285\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127286\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127307\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127363\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127493\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127494\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127495\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127496\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127497\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127498\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127534\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127561\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127567\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127595\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127603\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127682\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127731\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127750\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127836\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127961\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128094\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128166\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128351\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128451\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128895\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129046\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129080\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129163\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129179\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129181\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129182\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129183\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129184\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129205\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129281\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129284\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129285\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129291\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129292\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129293\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129294\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129295\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129296\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129326\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129327\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129330\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129363\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129366\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129497\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129519\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129543\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129547\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129551\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129581\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129625\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129664\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129739\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1129923\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=807502\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=824948\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=828192\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=925178\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2017-5753/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2018-20669/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-2024/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-3459/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-3460/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-3819/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-6974/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-7221/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-7222/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-7308/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8912/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8980/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-9213/\");\n # https://www.suse.com/support/update/announcement/2019/suse-su-20190765-1/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?7176d9bd\");\n script_set_attribute(attribute:\"solution\", value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Workstation Extension 12-SP4:zypper in -t patch\nSUSE-SLE-WE-12-SP4-2019-765=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP4:zypper in -t\npatch SUSE-SLE-SDK-12-SP4-2019-765=1\n\nSUSE Linux Enterprise Server 12-SP4:zypper in -t patch\nSUSE-SLE-SERVER-12-SP4-2019-765=1\n\nSUSE Linux Enterprise Live Patching 12-SP4:zypper in -t patch\nSUSE-SLE-Live-Patching-12-SP4-2019-765=1\n\nSUSE Linux Enterprise High Availability 12-SP4:zypper in -t patch\nSUSE-SLE-HA-12-SP4-2019-765=1\n\nSUSE Linux Enterprise Desktop 12-SP4:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP4-2019-765=1\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8912\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-6974\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/01/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/03/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/03/27\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-man\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP4\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-default-devel-debuginfo-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", cpu:\"s390x\", reference:\"kernel-default-man-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"kernel-default-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"kernel-default-base-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"kernel-default-base-debuginfo-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"kernel-default-debuginfo-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"kernel-default-debugsource-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"kernel-default-devel-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"kernel-syms-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-default-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-default-debuginfo-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-default-debugsource-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-default-devel-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-default-devel-debuginfo-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-default-extra-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-default-extra-debuginfo-4.12.14-95.13.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-syms-4.12.14-95.13.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-02-19T13:51:16", "description": "According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :\n\n - The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel handles the basic functions of the operating system:\n memory allocation, process allocation, device input and output, etc.Security Fix(es):An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.(CVE-2019-11815)A flaw was found in the Linux kernel's handle_rx() function in the vhost_net driver.\n A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.(CVE-2018-16880)A NULL pointer dereference security flaw was found in the Linux kernel in kvm_pv_send_ipi() in arch/x86/kvm/lapic.c. This allows local users with certain privileges to cause a denial of service via a crafted system call to the KVM subsystem.(CVE-2018-19406)The function hso_get_config_data in driverset/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space.(CVE-2018-19985)** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem.\n When the candidate has been publicized, the details for this candidate will be provided.(CVE-2019-3459)** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.(CVE-2019-3460)A flaw was found in the Linux kernel in the function hid_debug_events_read() in the drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service.(CVE-2019-3819)In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.(CVE-2019-9213)A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable.(CVE-2019-3882)An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.(CVE-2019-3900)It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.(CVE-2019-3837)A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls.\n This issue affects kernel versions before 4.8.\n (CVE-2019-3901)** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.(CVE-2019-8956)cipso_v4_validate in includeet/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310.(CVE-2013-7470)Note1:\n kernel-4.19.36-vhulk1907.1.0.h529 and earlier versions in EulerOS Virtualization for ARM 64 3.0.2.0 return incorrect time information when executing the uname -a command.Note2: The kernel version number naming format has been changed after 4.19.36-1.2.184.aarch64, the new version format is 4.19.36-vhulk1907.1.0.hxxx.aarch64, which may lead to false positives of this security advisory.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 8.1, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-05-30T00:00:00", "type": "nessus", "title": "EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2019-1636)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-7470", "CVE-2018-16880", "CVE-2018-19406", "CVE-2018-19985", "CVE-2019-11815", "CVE-2019-3459", "CVE-2019-3460", "CVE-2019-3819", "CVE-2019-3837", "CVE-2019-3882", "CVE-2019-3900", "CVE-2019-3901", "CVE-2019-8956", "CVE-2019-9213"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "p-cpe:/a:huawei:euleros:kernel-tools-libs-devel", "p-cpe:/a:huawei:euleros:perf", "p-cpe:/a:huawei:euleros:python-perf", "cpe:/o:huawei:euleros:uvp:3.0.2.0"], "id": "EULEROS_SA-2019-1636.NASL", "href": "https://www.tenable.com/plugins/nessus/125588", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(125588);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2013-7470\",\n \"CVE-2018-16880\",\n \"CVE-2018-19406\",\n \"CVE-2018-19985\",\n \"CVE-2019-11815\",\n \"CVE-2019-3459\",\n \"CVE-2019-3460\",\n \"CVE-2019-3819\",\n \"CVE-2019-3837\",\n \"CVE-2019-3882\",\n \"CVE-2019-3900\",\n \"CVE-2019-3901\",\n \"CVE-2019-8956\",\n \"CVE-2019-9213\"\n );\n\n script_name(english:\"EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2019-1636)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization for ARM 64 host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS Virtualization for ARM 64 installation on the remote host is\naffected by the following vulnerabilities :\n\n - The kernel package contains the Linux kernel (vmlinuz),\n the core of any Linux operating system. The kernel\n handles the basic functions of the operating system:\n memory allocation, process allocation, device input and\n output, etc.Security Fix(es):An issue was discovered in\n rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel\n before 5.0.8. There is a race condition leading to a\n use-after-free, related to net namespace\n cleanup.(CVE-2019-11815)A flaw was found in the Linux\n kernel's handle_rx() function in the vhost_net driver.\n A malicious virtual guest, under specific conditions,\n can trigger an out-of-bounds write in a kmalloc-8 slab\n on a virtual host which may lead to a kernel memory\n corruption and a system panic. Due to the nature of the\n flaw, privilege escalation cannot be fully ruled\n out.(CVE-2018-16880)A NULL pointer dereference security\n flaw was found in the Linux kernel in kvm_pv_send_ipi()\n in arch/x86/kvm/lapic.c. This allows local users with\n certain privileges to cause a denial of service via a\n crafted system call to the KVM\n subsystem.(CVE-2018-19406)The function\n hso_get_config_data in driverset/usb/hso.c in the Linux\n kernel through 4.19.8 reads if_num from the USB device\n (as a u8) and uses it to index a small array, resulting\n in an object out-of-bounds (OOB) read that potentially\n allows arbitrary read in the kernel address\n space.(CVE-2018-19985)** RESERVED ** This candidate has\n been reserved by an organization or individual that\n will use it when announcing a new security problem.\n When the candidate has been publicized, the details for\n this candidate will be provided.(CVE-2019-3459)**\n RESERVED ** This candidate has been reserved by an\n organization or individual that will use it when\n announcing a new security problem. When the candidate\n has been publicized, the details for this candidate\n will be provided.(CVE-2019-3460)A flaw was found in the\n Linux kernel in the function hid_debug_events_read() in\n the drivers/hid/hid-debug.c file which may enter an\n infinite loop with certain parameters passed from a\n userspace. A local privileged user ('root') can cause a\n system lock up and a denial of\n service.(CVE-2019-3819)In the Linux kernel before\n 4.20.14, expand_downwards in mm/mmap.c lacks a check\n for the mmap minimum address, which makes it easier for\n attackers to exploit kernel NULL pointer dereferences\n on non-SMAP platforms. This is related to a capability\n check for the wrong task.(CVE-2019-9213)A flaw was\n found in the Linux kernel's vfio interface\n implementation that permits violation of the user's\n locked memory limit. If a device is bound to a vfio\n driver, such as vfio-pci, and the local attacker is\n administratively granted ownership of the device, it\n may cause a system memory exhaustion and thus a denial\n of service (DoS). Versions 3.10, 4.14 and 4.18 are\n vulnerable.(CVE-2019-3882)An infinite loop issue was\n found in the vhost_net kernel module in Linux Kernel up\n to and including v5.1-rc6, while handling incoming\n packets in handle_rx(). It could occur if one end sends\n packets faster than the other end can process them. A\n guest user, maybe remote one, could use this flaw to\n stall the vhost_net kernel thread, resulting in a DoS\n scenario.(CVE-2019-3900)It was found that the net_dma\n code in tcp_recvmsg() in the 2.6.32 kernel as shipped\n in RHEL6 is thread-unsafe. So an unprivileged\n multi-threaded userspace application calling recvmsg()\n for the same network socket in parallel executed on\n ioatdma-enabled hardware with net_dma enabled can leak\n the memory, crash the host leading to a\n denial-of-service or cause a random memory\n corruption.(CVE-2019-3837)A race condition in\n perf_event_open() allows local attackers to leak\n sensitive data from setuid programs. As no relevant\n locks (in particular the cred_guard_mutex) are held\n during the ptrace_may_access() call, it is possible for\n the specified target task to perform an execve()\n syscall with setuid execution before perf_event_alloc()\n actually attaches to it, allowing an attacker to bypass\n the ptrace_may_access() check and the\n perf_event_exit_task(current) call that is performed in\n install_exec_creds() during privileged execve() calls.\n This issue affects kernel versions before 4.8.\n (CVE-2019-3901)** RESERVED ** This candidate has been\n reserved by an organization or individual that will use\n it when announcing a new security problem. When the\n candidate has been publicized, the details for this\n candidate will be\n provided.(CVE-2019-8956)cipso_v4_validate in\n includeet/cipso_ipv4.h in the Linux kernel before\n 3.11.7, when CONFIG_NETLABEL is disabled, allows\n attackers to cause a denial of service (infinite loop\n and crash), as demonstrated by icmpsic, a different\n vulnerability than CVE-2013-0310.(CVE-2013-7470)Note1:\n kernel-4.19.36-vhulk1907.1.0.h529 and earlier versions\n in EulerOS Virtualization for ARM 64 3.0.2.0 return\n incorrect time information when executing the uname -a\n command.Note2: The kernel version number naming format\n has been changed after 4.19.36-1.2.184.aarch64, the new\n version format is 4.19.36-vhulk1907.1.0.hxxx.aarch64,\n which may lead to false positives of this security\n advisory.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1636\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?5118fa2c\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/30\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.2.0\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.2.0\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-4.19.36-1.2.159\",\n \"kernel-devel-4.19.36-1.2.159\",\n \"kernel-headers-4.19.36-1.2.159\",\n \"kernel-tools-4.19.36-1.2.159\",\n \"kernel-tools-libs-4.19.36-1.2.159\",\n \"kernel-tools-libs-devel-4.19.36-1.2.159\",\n \"perf-4.19.36-1.2.159\",\n \"python-perf-4.19.36-1.2.159\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T12:27:07", "description": "Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.\n\nCVE-2018-14625\n\nA use-after-free bug was found in the vhost driver for the Virtual Socket protocol. If this driver is used to communicate with a malicious virtual machine guest, the guest could read sensitive information from the host kernel.\n\nCVE-2018-16884\n\nA flaw was found in the NFS 4.1 client implementation. Mounting NFS shares in multiple network namespaces at the same time could lead to a user-after-free. Local users might be able to use this for denial of service (memory corruption or crash) or possibly for privilege escalation.\n\nThis can be mitigated by disabling unprivileged users from creating user namespaces, which is the default in Debian.\n\nCVE-2018-19824\n\nHui Peng and Mathias Payer discovered a use-after-free bug in the USB audio driver. A physically present attacker able to attach a specially designed USB device could use this for privilege escalation.\n\nCVE-2018-19985\n\nHui Peng and Mathias Payer discovered a missing bounds check in the hso USB serial driver. A physically present user able to attach a specially designed USB device could use this to read sensitive information from the kernel or to cause a denial of service (crash).\n\nCVE-2018-20169\n\nHui Peng and Mathias Payer discovered missing bounds checks in the USB core. A physically present attacker able to attach a specially designed USB device could use this to cause a denial of service (crash) or possibly for privilege escalation.\n\nCVE-2018-1000026\n\nIt was discovered that Linux could forward aggregated network packets with a segmentation size too large for the output device. In the specific case of Broadcom NetXtremeII 10Gb adapters, this would result in a denial of service (firmware crash). This update adds a mitigation to the bnx2x driver for this hardware.\n\nCVE-2019-3459, CVE-2019-3460\n\nShlomi Oberman, Yuli Shapiro and Karamba Security Ltd. research team discovered missing range checks in the Bluetooth L2CAP implementation.\nIf Bluetooth is enabled, a nearby attacker could use these to read sensitive information from the kernel.\n\nCVE-2019-3701\n\nMuyu Yu and Marcus Meissner reported that the CAN gateway implementation allowed the frame length to be modified, typically resulting in out-of-bounds memory-mapped I/O writes. On a system with CAN devices present, a local user with CAP_NET_ADMIN capability in the initial net namespace could use this to cause a crash (oops) or other hardware-dependent impact.\n\nCVE-2019-3819\n\nA potential infinite loop was discovered in the HID debugfs interface exposed under /sys/kernel/debug/hid. A user with access to these files could use this for denial of service.\n\nThis interface is only accessible to root by default, which fully mitigates the issue.\n\nCVE-2019-6974\n\nJann Horn reported a use-after-free bug in KVM. A local user with access to /dev/kvm could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.\n\nCVE-2019-7221\n\nJim Mattson and Felix Wilhelm reported a user-after-free bug in KVM's nested VMX implementation. On systems with Intel CPUs, a local user with access to /dev/kvm could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.\n\nNested VMX is disabled by default, which fully mitigates the issue.\n\nCVE-2019-7222\n\nFelix Wilhelm reported an information leak in KVM for x86. A local user with access to /dev/kvm could use this to read sensitive information from the kernel.\n\nCVE-2019-8980\n\nA bug was discovered in the kernel_read_file() function used to load firmware files. In certain error conditions it could leak memory, which might lead to a denial of service. This is probbaly not exploitable in a Debian system.\n\nCVE-2019-9213\n\nJann Horn reported that privileged tasks could cause stack segments, including those in other processes, to grow downward to address 0. On systems lacking SMAP (x86) or PAN (ARM), this exacerbated other vulnerabilities: a NULL pointer dereference could be exploited for privilege escalation rather than only for denial of service.\n\nFor Debian 8 'Jessie', these problems have been fixed in version 4.9.168-1~deb8u1. This version also includes fixes for Debian bugs #904385, #918103, and #922306; and other fixes included in upstream stable updates.\n\nWe recommend that you upgrade your linux-4.9 and linux-latest-4.9 packages. You will need to use 'apt-get upgrade --with-new-pkgs' or 'apt upgrade' as the binary package names have changed.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 6.8, "vector": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-05-06T00:00:00", "type": "nessus", "title": "Debian DLA-1771-1 : linux-4.9 security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-1000026", "CVE-2018-14625", "CVE-2018-16884", "CVE-2018-19824", "CVE-2018-19985", "CVE-2018-20169", "CVE-2019-3459", "CVE-2019-3460", "CVE-2019-3701", "CVE-2019-3819", "CVE-2019-6974", "CVE-2019-7221", "CVE-2019-7222", "CVE-2019-8980", "CVE-2019-9213"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.9-arm", "p-cpe:/a:debian:debian_linux:linux-doc-4.9", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-686", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-686-pae", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-amd64", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-armel", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-armhf", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-i386", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-amd64", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-armmp", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-armmp-lpae", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-common", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-common-rt", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-marvell", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-rt-686-pae", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-rt-amd64", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-686", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-686-pae", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-686-pae-dbg", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-amd64", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-amd64-dbg", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-armmp", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-armmp-lpae", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-marvell", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-686-pae", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-686-pae-dbg", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-amd64", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-amd64-dbg", "p-cpe:/a:debian:debian_linux:linux-kbuild-4.9", "p-cpe:/a:debian:debian_linux:linux-manual-4.9", "p-cpe:/a:debian:debian_linux:linux-perf-4.9", "p-cpe:/a:debian:debian_linux:linux-source-4.9", "p-cpe:/a:debian:debian_linux:linux-support-4.9.0-0.bpo.7", "cpe:/o:debian:debian_linux:8.0"], "id": "DEBIAN_DLA-1771.NASL", "href": "https://www.tenable.com/plugins/nessus/124595", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-1771-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(124595);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2018-1000026\", \"CVE-2018-14625\", \"CVE-2018-16884\", \"CVE-2018-19824\", \"CVE-2018-19985\", \"CVE-2018-20169\", \"CVE-2019-3459\", \"CVE-2019-3460\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-6974\", \"CVE-2019-7221\", \"CVE-2019-7222\", \"CVE-2019-8980\", \"CVE-2019-9213\");\n\n script_name(english:\"Debian DLA-1771-1 : linux-4.9 security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2018-14625\n\nA use-after-free bug was found in the vhost driver for the Virtual\nSocket protocol. If this driver is used to communicate with a\nmalicious virtual machine guest, the guest could read sensitive\ninformation from the host kernel.\n\nCVE-2018-16884\n\nA flaw was found in the NFS 4.1 client implementation. Mounting NFS\nshares in multiple network namespaces at the same time could lead to a\nuser-after-free. Local users might be able to use this for denial of\nservice (memory corruption or crash) or possibly for privilege\nescalation.\n\nThis can be mitigated by disabling unprivileged users from\ncreating user namespaces, which is the default in Debian.\n\nCVE-2018-19824\n\nHui Peng and Mathias Payer discovered a use-after-free bug in the USB\naudio driver. A physically present attacker able to attach a specially\ndesigned USB device could use this for privilege escalation.\n\nCVE-2018-19985\n\nHui Peng and Mathias Payer discovered a missing bounds check in the\nhso USB serial driver. A physically present user able to attach a\nspecially designed USB device could use this to read sensitive\ninformation from the kernel or to cause a denial of service (crash).\n\nCVE-2018-20169\n\nHui Peng and Mathias Payer discovered missing bounds checks in the USB\ncore. A physically present attacker able to attach a specially\ndesigned USB device could use this to cause a denial of service\n(crash) or possibly for privilege escalation.\n\nCVE-2018-1000026\n\nIt was discovered that Linux could forward aggregated network packets\nwith a segmentation size too large for the output device. In the\nspecific case of Broadcom NetXtremeII 10Gb adapters, this would result\nin a denial of service (firmware crash). This update adds a mitigation\nto the bnx2x driver for this hardware.\n\nCVE-2019-3459, CVE-2019-3460\n\nShlomi Oberman, Yuli Shapiro and Karamba Security Ltd. research team\ndiscovered missing range checks in the Bluetooth L2CAP implementation.\nIf Bluetooth is enabled, a nearby attacker could use these to read\nsensitive information from the kernel.\n\nCVE-2019-3701\n\nMuyu Yu and Marcus Meissner reported that the CAN gateway\nimplementation allowed the frame length to be modified, typically\nresulting in out-of-bounds memory-mapped I/O writes. On a system with\nCAN devices present, a local user with CAP_NET_ADMIN capability in the\ninitial net namespace could use this to cause a crash (oops) or other\nhardware-dependent impact.\n\nCVE-2019-3819\n\nA potential infinite loop was discovered in the HID debugfs interface\nexposed under /sys/kernel/debug/hid. A user with access to these files\ncould use this for denial of service.\n\nThis interface is only accessible to root by default, which\nfully mitigates the issue.\n\nCVE-2019-6974\n\nJann Horn reported a use-after-free bug in KVM. A local user with\naccess to /dev/kvm could use this to cause a denial of service (memory\ncorruption or crash) or possibly for privilege escalation.\n\nCVE-2019-7221\n\nJim Mattson and Felix Wilhelm reported a user-after-free bug in KVM's\nnested VMX implementation. On systems with Intel CPUs, a local user\nwith access to /dev/kvm could use this to cause a denial of service\n(memory corruption or crash) or possibly for privilege escalation.\n\nNested VMX is disabled by default, which fully mitigates the\nissue.\n\nCVE-2019-7222\n\nFelix Wilhelm reported an information leak in KVM for x86. A local\nuser with access to /dev/kvm could use this to read sensitive\ninformation from the kernel.\n\nCVE-2019-8980\n\nA bug was discovered in the kernel_read_file() function used to load\nfirmware files. In certain error conditions it could leak memory,\nwhich might lead to a denial of service. This is probbaly not\nexploitable in a Debian system.\n\nCVE-2019-9213\n\nJann Horn reported that privileged tasks could cause stack segments,\nincluding those in other processes, to grow downward to address 0. On\nsystems lacking SMAP (x86) or PAN (ARM), this exacerbated other\nvulnerabilities: a NULL pointer dereference could be exploited for\nprivilege escalation rather than only for denial of service.\n\nFor Debian 8 'Jessie', these problems have been fixed in version\n4.9.168-1~deb8u1. This version also includes fixes for Debian bugs\n#904385, #918103, and #922306; and other fixes included in upstream\nstable updates.\n\nWe recommend that you upgrade your linux-4.9 and linux-latest-4.9\npackages. You will need to use 'apt-get upgrade --with-new-pkgs' or\n'apt upgrade' as the binary package names have changed.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/linux-4.9\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-20169\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.9-arm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-doc-4.9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-686\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-686-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-armel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-armhf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-i386\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-armmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-armmp-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-common-rt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-marvell\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-rt-686-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-rt-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-686\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-686-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-686-pae-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-amd64-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-armmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-armmp-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-marvell\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-686-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-686-pae-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-amd64-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-kbuild-4.9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-manual-4.9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-perf-4.9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-source-4.9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-support-4.9.0-0.bpo.7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/02/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/06\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"linux-compiler-gcc-4.9-arm\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-doc-4.9\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-686\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-686-pae\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-all\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-all-amd64\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-all-armel\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-all-armhf\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-all-i386\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-amd64\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-armmp\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-armmp-lpae\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-common\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-common-rt\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-marvell\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-rt-686-pae\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-rt-amd64\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-686\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-686-pae\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-686-pae-dbg\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-amd64\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-amd64-dbg\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-armmp\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-armmp-lpae\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-marvell\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-rt-686-pae\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-rt-686-pae-dbg\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-rt-amd64\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-rt-amd64-dbg\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-kbuild-4.9\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-manual-4.9\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-perf-4.9\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-source-4.9\", reference:\"4.9.168-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-support-4.9.0-0.bpo.7\", reference:\"4.9.168-1~deb8u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-08-10T15:48:28", "description": "It was discovered that a race condition existed in the f2fs file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2017-18249)\n\nWen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100, CVE-2018-14614, CVE-2018-14616)\n\nWen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not properly validate metadata.\nAn attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service (system crash).\n(CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613)\n\nVasily Averin and Evgenii Shatokhin discovered that a use-after-free vulnerability existed in the NFS41+ subsystem when multiple network namespaces are in use. A local attacker in a container could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-16884)\n\nIt was discovered that a use-after-free vulnerability existed in the PPP over L2TP implementation in the Linux kernel. A privileged local attacker could use this to possibly execute arbitrary code.\n(CVE-2018-9517)\n\nShlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel.\nAn attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)\n\nJann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)\n\nJim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)\n\nFelix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM).\n(CVE-2019-7222)\n\nJann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux kernel's HID subsystem did not properly validate passed parameters in some situations. A local privileged attacker could use this to cause a denial of service (infinite loop). (CVE-2019-3819).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 8.1, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-04-03T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS : linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities (USN-3932-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-18249", "CVE-2018-13097", "CVE-2018-13099", "CVE-2018-13100", "CVE-2018-14610", "CVE-2018-14611", "CVE-2018-14612", "CVE-2018-14613", "CVE-2018-14614", "CVE-2018-14616", "CVE-2018-16884", "CVE-2018-9517", "CVE-2019-3459", "CVE-2019-3460", "CVE-2019-3701", "CVE-2019-3819", "CVE-2019-6974", "CVE-2019-7221", "CVE-2019-7222", "CVE-2019-9213"], "modified": "2022-05-23T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon", "p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual", "cpe:/o:canonical:ubuntu_linux:16.04"], "id": "UBUNTU_USN-3932-1.NASL", "href": "https://www.tenable.com/plugins/nessus/123680", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3932-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(123680);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/23\");\n\n script_cve_id(\"CVE-2017-18249\", \"CVE-2018-13097\", \"CVE-2018-13099\", \"CVE-2018-13100\", \"CVE-2018-14610\", \"CVE-2018-14611\", \"CVE-2018-14612\", \"CVE-2018-14613\", \"CVE-2018-14614\", \"CVE-2018-14616\", \"CVE-2018-16884\", \"CVE-2018-9517\", \"CVE-2019-3459\", \"CVE-2019-3460\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-6974\", \"CVE-2019-7221\", \"CVE-2019-7222\", \"CVE-2019-9213\");\n script_xref(name:\"USN\", value:\"3932-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS : linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities (USN-3932-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"It was discovered that a race condition existed in the f2fs file\nsystem implementation in the Linux kernel. A local attacker could use\nthis to cause a denial of service. (CVE-2017-18249)\n\nWen Xu discovered that the f2fs file system implementation in the\nLinux kernel did not properly validate metadata. An attacker could use\nthis to construct a malicious f2fs image that, when mounted, could\ncause a denial of service (system crash). (CVE-2018-13097,\nCVE-2018-13099, CVE-2018-13100, CVE-2018-14614, CVE-2018-14616)\n\nWen Xu and Po-Ning Tseng discovered that btrfs file system\nimplementation in the Linux kernel did not properly validate metadata.\nAn attacker could use this to construct a malicious btrfs image that,\nwhen mounted, could cause a denial of service (system crash).\n(CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613)\n\nVasily Averin and Evgenii Shatokhin discovered that a use-after-free\nvulnerability existed in the NFS41+ subsystem when multiple network\nnamespaces are in use. A local attacker in a container could use this\nto cause a denial of service (system crash) or possibly execute\narbitrary code. (CVE-2018-16884)\n\nIt was discovered that a use-after-free vulnerability existed in the\nPPP over L2TP implementation in the Linux kernel. A privileged local\nattacker could use this to possibly execute arbitrary code.\n(CVE-2018-9517)\n\nShlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an\ninformation leak in the Bluetooth implementation of the Linux kernel.\nAn attacker within Bluetooth range could use this to expose sensitive\ninformation (kernel memory). (CVE-2019-3459, CVE-2019-3460)\n\nJann Horn discovered that the KVM implementation in the Linux kernel\ncontained a use-after-free vulnerability. An attacker in a guest VM\nwith access to /dev/kvm could use this to cause a denial of service\n(guest VM crash). (CVE-2019-6974)\n\nJim Mattson and Felix Wilhelm discovered a use-after-free\nvulnerability in the KVM subsystem of the Linux kernel, when using\nnested virtual machines. A local attacker in a guest VM could use this\nto cause a denial of service (system crash) or possibly execute\narbitrary code in the host system. (CVE-2019-7221)\n\nFelix Wilhelm discovered that an information leak vulnerability\nexisted in the KVM subsystem of the Linux kernel, when nested\nvirtualization is used. A local attacker could use this to expose\nsensitive information (host system memory to a guest VM).\n(CVE-2019-7222)\n\nJann Horn discovered that the mmap implementation in the Linux kernel\ndid not properly check for the mmap minimum address in some\nsituations. A local attacker could use this to assist exploiting a\nkernel NULL pointer dereference vulnerability. (CVE-2019-9213)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in\nsome situations did not properly restrict the field size when\nprocessing outgoing frames. A local attacker with CAP_NET_ADMIN\nprivileges could use this to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux\nkernel's HID subsystem did not properly validate passed parameters in\nsome situations. A local privileged attacker could use this to cause a\ndenial of service (infinite loop). (CVE-2019-3819).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3932-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-9517\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/03/26\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/04/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2019-2022 Canonical, Inc. / NASL script (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-18249\", \"CVE-2018-13097\", \"CVE-2018-13099\", \"CVE-2018-13100\", \"CVE-2018-14610\", \"CVE-2018-14611\", \"CVE-2018-14612\", \"CVE-2018-14613\", \"CVE-2018-14614\", \"CVE-2018-14616\", \"CVE-2018-16884\", \"CVE-2018-9517\", \"CVE-2019-3459\", \"CVE-2019-3460\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-6974\", \"CVE-2019-7221\", \"CVE-2019-7222\", \"CVE-2019-9213\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3932-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1043-kvm\", pkgver:\"4.4.0-1043.49\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1079-aws\", pkgver:\"4.4.0-1079.89\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1106-raspi2\", pkgver:\"4.4.0-1106.114\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1110-snapdragon\", pkgver:\"4.4.0-1110.115\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-145-generic\", pkgver:\"4.4.0-145.171\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-145-generic-lpae\", pkgver:\"4.4.0-145.171\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-145-lowlatency\", pkgver:\"4.4.0-145.171\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-aws\", pkgver:\"4.4.0.1079.82\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic\", pkgver:\"4.4.0.145.153\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-lpae\", pkgver:\"4.4.0.145.153\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-kvm\", pkgver:\"4.4.0.1043.43\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-lowlatency\", pkgver:\"4.4.0.145.153\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-raspi2\", pkgver:\"4.4.0.1106.106\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-snapdragon\", pkgver:\"4.4.0.1110.102\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-virtual\", pkgver:\"4.4.0.145.153\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-aws / linux-image-4.4-generic / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-08-10T15:47:06", "description": "USN-3932-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.\n\nIt was discovered that a race condition existed in the f2fs file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2017-18249)\n\nWen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100, CVE-2018-14614, CVE-2018-14616)\n\nWen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not properly validate metadata.\nAn attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service (system crash).\n(CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613)\n\nVasily Averin and Evgenii Shatokhin discovered that a use-after-free vulnerability existed in the NFS41+ subsystem when multiple network namespaces are in use. A local attacker in a container could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-16884)\n\nIt was discovered that a use-after-free vulnerability existed in the PPP over L2TP implementation in the Linux kernel. A privileged local attacker could use this to possibly execute arbitrary code.\n(CVE-2018-9517)\n\nShlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel.\nAn attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)\n\nJann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)\n\nJim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)\n\nFelix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM).\n(CVE-2019-7222)\n\nJann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux kernel's HID subsystem did not properly validate passed parameters in some situations. A local privileged attacker could use this to cause a denial of service (infinite loop). (CVE-2019-3819).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 8.1, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-04-03T00:00:00", "type": "nessus", "title": "Ubuntu 14.04 LTS : linux-lts-xenial, linux-aws vulnerabilities (USN-3932-2)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-18249", "CVE-2018-13097", "CVE-2018-13099", "CVE-2018-13100", "CVE-2018-14610", "CVE-2018-14611", "CVE-2018-14612", "CVE-2018-14613", "CVE-2018-14614", "CVE-2018-14616", "CVE-2018-16884", "CVE-2018-9517", "CVE-2019-3459", "CVE-2019-3460", "CVE-2019-3701", "CVE-2019-3819", "CVE-2019-6974", "CVE-2019-7221", "CVE-2019-7222", "CVE-2019-9213"], "modified": "2022-05-23T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-lts-xenial", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "UBUNTU_USN-3932-2.NASL", "href": "https://www.tenable.com/plugins/nessus/123681", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3932-2. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(123681);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/23\");\n\n script_cve_id(\"CVE-2017-18249\", \"CVE-2018-13097\", \"CVE-2018-13099\", \"CVE-2018-13100\", \"CVE-2018-14610\", \"CVE-2018-14611\", \"CVE-2018-14612\", \"CVE-2018-14613\", \"CVE-2018-14614\", \"CVE-2018-14616\", \"CVE-2018-16884\", \"CVE-2018-9517\", \"CVE-2019-3459\", \"CVE-2019-3460\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-6974\", \"CVE-2019-7221\", \"CVE-2019-7222\", \"CVE-2019-9213\");\n script_xref(name:\"USN\", value:\"3932-2\");\n\n script_name(english:\"Ubuntu 14.04 LTS : linux-lts-xenial, linux-aws vulnerabilities (USN-3932-2)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN-3932-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu\n14.04 LTS.\n\nIt was discovered that a race condition existed in the f2fs file\nsystem implementation in the Linux kernel. A local attacker could use\nthis to cause a denial of service. (CVE-2017-18249)\n\nWen Xu discovered that the f2fs file system implementation in the\nLinux kernel did not properly validate metadata. An attacker could use\nthis to construct a malicious f2fs image that, when mounted, could\ncause a denial of service (system crash). (CVE-2018-13097,\nCVE-2018-13099, CVE-2018-13100, CVE-2018-14614, CVE-2018-14616)\n\nWen Xu and Po-Ning Tseng discovered that btrfs file system\nimplementation in the Linux kernel did not properly validate metadata.\nAn attacker could use this to construct a malicious btrfs image that,\nwhen mounted, could cause a denial of service (system crash).\n(CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613)\n\nVasily Averin and Evgenii Shatokhin discovered that a use-after-free\nvulnerability existed in the NFS41+ subsystem when multiple network\nnamespaces are in use. A local attacker in a container could use this\nto cause a denial of service (system crash) or possibly execute\narbitrary code. (CVE-2018-16884)\n\nIt was discovered that a use-after-free vulnerability existed in the\nPPP over L2TP implementation in the Linux kernel. A privileged local\nattacker could use this to possibly execute arbitrary code.\n(CVE-2018-9517)\n\nShlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an\ninformation leak in the Bluetooth implementation of the Linux kernel.\nAn attacker within Bluetooth range could use this to expose sensitive\ninformation (kernel memory). (CVE-2019-3459, CVE-2019-3460)\n\nJann Horn discovered that the KVM implementation in the Linux kernel\ncontained a use-after-free vulnerability. An attacker in a guest VM\nwith access to /dev/kvm could use this to cause a denial of service\n(guest VM crash). (CVE-2019-6974)\n\nJim Mattson and Felix Wilhelm discovered a use-after-free\nvulnerability in the KVM subsystem of the Linux kernel, when using\nnested virtual machines. A local attacker in a guest VM could use this\nto cause a denial of service (system crash) or possibly execute\narbitrary code in the host system. (CVE-2019-7221)\n\nFelix Wilhelm discovered that an information leak vulnerability\nexisted in the KVM subsystem of the Linux kernel, when nested\nvirtualization is used. A local attacker could use this to expose\nsensitive information (host system memory to a guest VM).\n(CVE-2019-7222)\n\nJann Horn discovered that the mmap implementation in the Linux kernel\ndid not properly check for the mmap minimum address in some\nsituations. A local attacker could use this to assist exploiting a\nkernel NULL pointer dereference vulnerability. (CVE-2019-9213)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in\nsome situations did not properly restrict the field size when\nprocessing outgoing frames. A local attacker with CAP_NET_ADMIN\nprivileges could use this to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux\nkernel's HID subsystem did not properly validate passed parameters in\nsome situations. A local privileged attacker could use this to cause a\ndenial of service (infinite loop). (CVE-2019-3819).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3932-2/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-9517\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/03/26\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/04/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2019-2022 Canonical, Inc. / NASL script (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(14\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 14.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-18249\", \"CVE-2018-13097\", \"CVE-2018-13099\", \"CVE-2018-13100\", \"CVE-2018-14610\", \"CVE-2018-14611\", \"CVE-2018-14612\", \"CVE-2018-14613\", \"CVE-2018-14614\", \"CVE-2018-14616\", \"CVE-2018-16884\", \"CVE-2018-9517\", \"CVE-2019-3459\", \"CVE-2019-3460\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-6974\", \"CVE-2019-7221\", \"CVE-2019-7222\", \"CVE-2019-9213\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3932-2\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-1040-aws\", pkgver:\"4.4.0-1040.43\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-144-generic\", pkgver:\"4.4.0-144.170~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-144-generic-lpae\", pkgver:\"4.4.0-144.170~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-144-lowlatency\", pkgver:\"4.4.0-144.170~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-aws\", pkgver:\"4.4.0.1040.41\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lpae-lts-xenial\", pkgver:\"4.4.0.144.127\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lts-xenial\", pkgver:\"4.4.0.144.127\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-lowlatency-lts-xenial\", pkgver:\"4.4.0.144.127\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-virtual-lts-xenial\", pkgver:\"4.4.0.144.127\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-aws / linux-image-4.4-generic / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-06-16T16:18:47", "description": "The linux update issued as DLA-1731-1 caused a regression in the vmxnet3 (VMware virtual network adapter) driver. This update corrects that regression, and an earlier regression in the CIFS network filesystem implementation introduced in DLA-1422-1. For reference the original advisory text follows.\n\nSeveral vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.\n\nCVE-2016-10741\n\nA race condition was discovered in XFS that would result in a crash (BUG). A local user permitted to write to an XFS volume could use this for denial of service.\n\nCVE-2017-5753\n\nFurther instances of code that was vulnerable to Spectre variant 1 (bounds-check bypass) have been mitigated.\n\nCVE-2017-13305\n\nA memory over-read was discovered in the keys subsystem's encrypted key type. A local user could use this for denial of service or possibly to read sensitive information.\n\nCVE-2018-3639 (SSB)\n\nMultiple researchers have discovered that Speculative Store Bypass (SSB), a feature implemented in many processors, could be used to read sensitive information from another context. In particular, code in a software sandbox may be able to read sensitive information from outside the sandbox. This issue is also known as Spectre variant 4.\n\nThis update fixes bugs in the mitigations for SSB for AMD processors.\n\nCVE-2018-5848\n\nThe wil6210 wifi driver did not properly validate lengths in scan and connection requests, leading to a possible buffer overflow. On systems using this driver, a local user with the CAP_NET_ADMIN capability could use this for denial of service (memory corruption or crash) or potentially for privilege escalation.\n\nCVE-2018-5953\n\nThe swiotlb subsystem printed kernel memory addresses to the system log, which could help a local attacker to exploit other vulnerabilities.\n\nCVE-2018-12896, CVE-2018-13053\n\nTeam OWL337 reported possible integer overflows in the POSIX timer implementation. These might have some security impact.\n\nCVE-2018-16862\n\nVasily Averin and Pavel Tikhomirov from Virtuozzo Kernel Team discovered that the cleancache memory management feature did not invalidate cached data for deleted files. On Xen guests using the tmem driver, local users could potentially read data from other users' deleted files if they were able to create new files on the same volume.\n\nCVE-2018-16884\n\nA flaw was found in the NFS 4.1 client implementation. Mounting NFS shares in multiple network namespaces at the same time could lead to a user-after-free. Local users might be able to use this for denial of service (memory corruption or crash) or possibly for privilege escalation.\n\nThis can be mitigated by disabling unprivileged users from creating user namespaces, which is the default in Debian.\n\nCVE-2018-17972\n\nJann Horn reported that the /proc/*/stack files in procfs leaked sensitive data from the kernel. These files are now only readable by users with the CAP_SYS_ADMIN capability (usually only root)\n\nCVE-2018-18281\n\nJann Horn reported a race condition in the virtual memory manager that can result in a process briefly having access to memory after it is freed and reallocated. A local user permitted to create containers could possibly exploit this for denial of service (memory corruption) or for privilege escalation.\n\nCVE-2018-18690\n\nKanda Motohiro reported that XFS did not correctly handle some xattr (extended attribute) writes that require changing the disk format of the xattr. A user with access to an XFS volume could use this for denial of service.\n\nCVE-2018-18710\n\nIt was discovered that the cdrom driver does not correctly validate the parameter to the CDROM_SELECT_DISC ioctl. A user with access to a cdrom device could use this to read sensitive information from the kernel or to cause a denial of service (crash).\n\nCVE-2018-19824\n\nHui Peng and Mathias Payer discovered a use-after-free bug in the USB audio driver. A physically present attacker able to attach a specially designed USB device could use this for privilege escalation.\n\nCVE-2018-19985\n\nHui Peng and Mathias Payer discovered a missing bounds check in the hso USB serial driver. A physically present user able to attach a specially designed USB device could use this to read sensitive information from the kernel or to cause a denial of service (crash).\n\nCVE-2018-20169\n\nHui Peng and Mathias Payer discovered missing bounds checks in the USB core. A physically present attacker able to attach a specially designed USB device could use this to cause a denial of service (crash) or possibly for privilege escalation.\n\nCVE-2018-20511\n\nInfoSect reported an information leak in the AppleTalk IP/DDP implemntation. A local user with CAP_NET_ADMIN capability could use this to read sensitive information from the kernel.\n\nCVE-2019-3701\n\nMuyu Yu and Marcus Meissner reported that the CAN gateway implementation allowed the frame length to be modified, typically resulting in out-of-bounds memory-mapped I/O writes. On a system with CAN devices present, a local user with CAP_NET_ADMIN capability in the initial net namespace could use this to cause a crash (oops) or other hardware-dependent impact.\n\nCVE-2019-3819\n\nA potential infinite loop was discovered in the HID debugfs interface exposed under /sys/kernel/debug/hid. A user with access to these files could use this for denial of service.\n\nThis interface is only accessible to root by default, which fully mitigates the issue.\n\nCVE-2019-6974\n\nJann Horn reported a use-after-free bug in KVM. A local user with access to /dev/kvm could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.\n\nCVE-2019-7221\n\nJim Mattson and Felix Wilhelm reported a user-after-free bug in KVM's nested VMX implementation. On systems with Intel CPUs, a local user with access to /dev/kvm could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.\n\nNested VMX is disabled by default, which fully mitigates the issue.\n\nCVE-2019-7222\n\nFelix Wilhelm reported an information leak in KVM for x86. A local user with access to /dev/kvm could use this to read sensitive information from the kernel.\n\nCVE-2019-9213\n\nJann Horn reported that privileged tasks could cause stack segments, including those in other processes, to grow downward to address 0. On systems lacking SMAP (x86) or PAN (ARM), this exacerbated other vulnerabilities: a NULL pointer dereference could be exploited for privilege escalation rather than only for denial of service.\n\nFor Debian 8 'Jessie', these problems have been fixed in version 3.16.64-1.\n\nWe recommend that you upgrade your linux packages.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 6.8, "vector": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-03-28T00:00:00", "type": "nessus", "title": "Debian DLA-1731-2 : linux regression update (Spectre)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-10741", "CVE-2017-13305", "CVE-2017-5753", "CVE-2018-12896", "CVE-2018-13053", "CVE-2018-16862", "CVE-2018-16884", "CVE-2018-17972", "CVE-2018-18281", "CVE-2018-18690", "CVE-2018-18710", "CVE-2018-19824", "CVE-2018-19985", "CVE-2018-20169", "CVE-2018-20511", "CVE-2018-3639", "CVE-2018-5848", "CVE-2018-5953", "CVE-2019-3701", "CVE-2019-3819", "CVE-2019-6974", "CVE-2019-7221", "CVE-2019-7222", "CVE-2019-9213"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.8-arm", "p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.8-x86", "p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.9-x86", "p-cpe:/a:debian:debian_linux:linux-doc-3.16", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-586", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-686-pae", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-amd64", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-armel", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-armhf", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-i386", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-amd64", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-armmp", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-armmp-lpae", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-common", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-ixp4xx", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-kirkwood", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-orion5x", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-versatile", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-586", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-686-pae", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-686-pae-dbg", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-amd64", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-amd64-dbg", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-armmp", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-armmp-lpae", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-ixp4xx", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-kirkwood", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-orion5x", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-versatile", "p-cpe:/a:debian:debian_linux:linux-libc-dev", "p-cpe:/a:debian:debian_linux:linux-manual-3.16", "p-cpe:/a:debian:debian_linux:linux-source-3.16", "p-cpe:/a:debian:debian_linux:linux-support-3.16.0-9", "p-cpe:/a:debian:debian_linux:xen-linux-system-3.16.0-9-amd64", "cpe:/o:debian:debian_linux:8.0"], "id": "DEBIAN_DLA-1731.NASL", "href": "https://www.tenable.com/plugins/nessus/123420", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-1731-2. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(123420);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-10741\", \"CVE-2017-13305\", \"CVE-2017-5753\", \"CVE-2018-12896\", \"CVE-2018-13053\", \"CVE-2018-16862\", \"CVE-2018-16884\", \"CVE-2018-17972\", \"CVE-2018-18281\", \"CVE-2018-18690\", \"CVE-2018-18710\", \"CVE-2018-19824\", \"CVE-2018-19985\", \"CVE-2018-20169\", \"CVE-2018-20511\", \"CVE-2018-3639\", \"CVE-2018-5848\", \"CVE-2018-5953\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-6974\", \"CVE-2019-7221\", \"CVE-2019-7222\", \"CVE-2019-9213\");\n\n script_name(english:\"Debian DLA-1731-2 : linux regression update (Spectre)\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The linux update issued as DLA-1731-1 caused a regression in the\nvmxnet3 (VMware virtual network adapter) driver. This update corrects\nthat regression, and an earlier regression in the CIFS network\nfilesystem implementation introduced in DLA-1422-1. For reference the\noriginal advisory text follows.\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2016-10741\n\nA race condition was discovered in XFS that would result in a crash\n(BUG). A local user permitted to write to an XFS volume could use this\nfor denial of service.\n\nCVE-2017-5753\n\nFurther instances of code that was vulnerable to Spectre variant 1\n(bounds-check bypass) have been mitigated.\n\nCVE-2017-13305\n\nA memory over-read was discovered in the keys subsystem's encrypted\nkey type. A local user could use this for denial of service or\npossibly to read sensitive information.\n\nCVE-2018-3639 (SSB)\n\nMultiple researchers have discovered that Speculative Store Bypass\n(SSB), a feature implemented in many processors, could be used to read\nsensitive information from another context. In particular, code in a\nsoftware sandbox may be able to read sensitive information from\noutside the sandbox. This issue is also known as Spectre variant 4.\n\nThis update fixes bugs in the mitigations for SSB for AMD\nprocessors.\n\nCVE-2018-5848\n\nThe wil6210 wifi driver did not properly validate lengths in scan and\nconnection requests, leading to a possible buffer overflow. On systems\nusing this driver, a local user with the CAP_NET_ADMIN capability\ncould use this for denial of service (memory corruption or crash) or\npotentially for privilege escalation.\n\nCVE-2018-5953\n\nThe swiotlb subsystem printed kernel memory addresses to the system\nlog, which could help a local attacker to exploit other\nvulnerabilities.\n\nCVE-2018-12896, CVE-2018-13053\n\nTeam OWL337 reported possible integer overflows in the POSIX timer\nimplementation. These might have some security impact.\n\nCVE-2018-16862\n\nVasily Averin and Pavel Tikhomirov from Virtuozzo Kernel Team\ndiscovered that the cleancache memory management feature did not\ninvalidate cached data for deleted files. On Xen guests using the tmem\ndriver, local users could potentially read data from other users'\ndeleted files if they were able to create new files on the same\nvolume.\n\nCVE-2018-16884\n\nA flaw was found in the NFS 4.1 client implementation. Mounting NFS\nshares in multiple network namespaces at the same time could lead to a\nuser-after-free. Local users might be able to use this for denial of\nservice (memory corruption or crash) or possibly for privilege\nescalation.\n\nThis can be mitigated by disabling unprivileged users from\ncreating user namespaces, which is the default in Debian.\n\nCVE-2018-17972\n\nJann Horn reported that the /proc/*/stack files in procfs leaked\nsensitive data from the kernel. These files are now only readable by\nusers with the CAP_SYS_ADMIN capability (usually only root)\n\nCVE-2018-18281\n\nJann Horn reported a race condition in the virtual memory manager that\ncan result in a process briefly having access to memory after it is\nfreed and reallocated. A local user permitted to create containers\ncould possibly exploit this for denial of service (memory corruption)\nor for privilege escalation.\n\nCVE-2018-18690\n\nKanda Motohiro reported that XFS did not correctly handle some xattr\n(extended attribute) writes that require changing the disk format of\nthe xattr. A user with access to an XFS volume could use this for\ndenial of service.\n\nCVE-2018-18710\n\nIt was discovered that the cdrom driver does not correctly validate\nthe parameter to the CDROM_SELECT_DISC ioctl. A user with access to a\ncdrom device could use this to read sensitive information from the\nkernel or to cause a denial of service (crash).\n\nCVE-2018-19824\n\nHui Peng and Mathias Payer discovered a use-after-free bug in the USB\naudio driver. A physically present attacker able to attach a specially\ndesigned USB device could use this for privilege escalation.\n\nCVE-2018-19985\n\nHui Peng and Mathias Payer discovered a missing bounds check in the\nhso USB serial driver. A physically present user able to attach a\nspecially designed USB device could use this to read sensitive\ninformation from the kernel or to cause a denial of service (crash).\n\nCVE-2018-20169\n\nHui Peng and Mathias Payer discovered missing bounds checks in the USB\ncore. A physically present attacker able to attach a specially\ndesigned USB device could use this to cause a denial of service\n(crash) or possibly for privilege escalation.\n\nCVE-2018-20511\n\nInfoSect reported an information leak in the AppleTalk IP/DDP\nimplemntation. A local user with CAP_NET_ADMIN capability could use\nthis to read sensitive information from the kernel.\n\nCVE-2019-3701\n\nMuyu Yu and Marcus Meissner reported that the CAN gateway\nimplementation allowed the frame length to be modified, typically\nresulting in out-of-bounds memory-mapped I/O writes. On a system with\nCAN devices present, a local user with CAP_NET_ADMIN capability in the\ninitial net namespace could use this to cause a crash (oops) or other\nhardware-dependent impact.\n\nCVE-2019-3819\n\nA potential infinite loop was discovered in the HID debugfs interface\nexposed under /sys/kernel/debug/hid. A user with access to these files\ncould use this for denial of service.\n\nThis interface is only accessible to root by default, which\nfully mitigates the issue.\n\nCVE-2019-6974\n\nJann Horn reported a use-after-free bug in KVM. A local user with\naccess to /dev/kvm could use this to cause a denial of service (memory\ncorruption or crash) or possibly for privilege escalation.\n\nCVE-2019-7221\n\nJim Mattson and Felix Wilhelm reported a user-after-free bug in KVM's\nnested VMX implementation. On systems with Intel CPUs, a local user\nwith access to /dev/kvm could use this to cause a denial of service\n(memory corruption or crash) or possibly for privilege escalation.\n\nNested VMX is disabled by default, which fully mitigates the\nissue.\n\nCVE-2019-7222\n\nFelix Wilhelm reported an information leak in KVM for x86. A local\nuser with access to /dev/kvm could use this to read sensitive\ninformation from the kernel.\n\nCVE-2019-9213\n\nJann Horn reported that privileged tasks could cause stack segments,\nincluding those in other processes, to grow downward to address 0. On\nsystems lacking SMAP (x86) or PAN (ARM), this exacerbated other\nvulnerabilities: a NULL pointer dereference could be exploited for\nprivilege escalation rather than only for denial of service.\n\nFor Debian 8 'Jessie', these problems have been fixed in version\n3.16.64-1.\n\nWe recommend that you upgrade your linux packages.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/linux\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-20169\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.8-arm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.8-x86\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.9-x86\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-doc-3.16\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-586\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-686-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-armel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-armhf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-i386\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-armmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-armmp-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-ixp4xx\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-kirkwood\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-orion5x\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-versatile\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-586\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-686-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-686-pae-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-amd64-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-armmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-armmp-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-ixp4xx\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-kirkwood\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-orion5x\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-versatile\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-libc-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-manual-3.16\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-source-3.16\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-support-3.16.0-9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:xen-linux-system-3.16.0-9-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/01/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/03/28\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"linux-compiler-gcc-4.8-arm\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-compiler-gcc-4.8-x86\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-compiler-gcc-4.9-x86\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-doc-3.16\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-586\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-686-pae\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all-amd64\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all-armel\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all-armhf\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all-i386\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-amd64\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-armmp\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-armmp-lpae\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-common\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-ixp4xx\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-kirkwood\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-orion5x\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-versatile\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-586\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-686-pae\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-686-pae-dbg\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-amd64\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-amd64-dbg\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-armmp\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-armmp-lpae\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-ixp4xx\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-kirkwood\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-orion5x\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-versatile\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-libc-dev\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-manual-3.16\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-source-3.16\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-support-3.16.0-9\", reference:\"3.16.64-2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"xen-linux-system-3.16.0-9-amd64\", reference:\"3.16.64-2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-08-10T16:08:06", "description": "USN 4115-1 fixed vulnerabilities in the Linux 4.15 kernel for Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. Unfortunately, as part of the update, a regression was introduced that caused a kernel crash when handling fragmented packets in some situations. This update addresses the issue.\n\nWe apologize for the inconvenience.\n\nHui Peng and Mathias Payer discovered that the Option USB High Speed driver in the Linux kernel did not properly validate metadata received from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19985)\n\nZhipeng Xie discovered that an infinite loop could triggered in the CFS Linux kernel process scheduler. A local attacker could possibly use this to cause a denial of service. (CVE-2018-20784)\n\nIt was discovered that the Intel Wi-Fi device driver in the Linux kernel did not properly validate certain Tunneled Direct Link Setup (TDLS). A physically proximate attacker could use this to cause a denial of service (Wi-Fi disconnect). (CVE-2019-0136)\n\nIt was discovered that the Bluetooth UART implementation in the Linux kernel did not properly check for missing tty operations. A local attacker could use this to cause a denial of service. (CVE-2019-10207)\n\nAmit Klein and Benny Pinkas discovered that the Linux kernel did not sufficiently randomize IP ID values generated for connectionless networking protocols. A remote attacker could use this to track particular Linux devices. (CVE-2019-10638)\n\nAmit Klein and Benny Pinkas discovered that the location of kernel addresses could be exposed by the implementation of connection-less network protocols in the Linux kernel. A remote attacker could possibly use this to assist in the exploitation of another vulnerability in the Linux kernel. (CVE-2019-10639)\n\nIt was discovered that an integer overflow existed in the Linux kernel when reference counting pages, leading to potential use-after-free issues. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-11487)\n\nJann Horn discovered that a race condition existed in the Linux kernel when performing core dumps. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information.\n(CVE-2019-11599)\n\nIt was discovered that a NULL pointer dereference vulnerability existed in the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash).\n(CVE-2019-11810)\n\nIt was discovered that the GTCO tablet input driver in the Linux kernel did not properly bounds check the initial HID report sent by the device. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2019-13631)\n\nPraveen Pandey discovered that the Linux kernel did not properly validate sent signals in some situations on PowerPC systems with transactional memory disabled. A local attacker could use this to cause a denial of service. (CVE-2019-13648)\n\nIt was discovered that the floppy driver in the Linux kernel did not properly validate meta data, leading to a buffer overread. A local attacker could use this to cause a denial of service (system crash).\n(CVE-2019-14283)\n\nIt was discovered that the floppy driver in the Linux kernel did not properly validate ioctl() calls, leading to a division-by-zero. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-14284)\n\nTuba Yavuz discovered that a race condition existed in the DesignWare USB3 DRD Controller device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service.\n(CVE-2019-14763)\n\nIt was discovered that an out-of-bounds read existed in the QLogic QEDI iSCSI Initiator Driver in the Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2019-15090)\n\nIt was discovered that the Raremono AM/FM/SW radio device driver in the Linux kernel did not properly allocate memory, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code.\n(CVE-2019-15211)\n\nIt was discovered at a double-free error existed in the USB Rio 500 device driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service. (CVE-2019-15212)\n\nIt was discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel, leading to a potential use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15214)\n\nIt was discovered that a race condition existed in the CPiA2 video4linux device driver for the Linux kernel, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15215)\n\nIt was discovered that a race condition existed in the Softmac USB Prism54 device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash).\n(CVE-2019-15220)\n\nIt was discovered that a use-after-free vulnerability existed in the AppleTalk implementation in the Linux kernel if an error occurs during initialization. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-15292)\n\nJason Wang discovered that an infinite loop vulnerability existed in the virtio net driver in the Linux kernel. A local attacker in a guest VM could possibly use this to cause a denial of service in the host system. (CVE-2019-3900)\n\nDaniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen discovered that the Bluetooth protocol BR/EDR specification did not properly require sufficiently strong encryption key lengths. A physically proximate attacker could use this to expose sensitive information. (CVE-2019-9506)\n\nIt was discovered that a race condition existed in the USB YUREX device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash).\n(CVE-2019-15216)\n\nIt was discovered that the Siano USB MDTV receiver device driver in the Linux kernel made improper assumptions about the device characteristics. A physically proximate attacker could use this cause a denial of service (system crash). (CVE-2019-15218)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux kernel did not properly validate data size information from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15221)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux kernel's HID subsystem did not properly validate passed parameters in some situations. A local privileged attacker could use this to cause a denial of service (infinite loop). (CVE-2019-3819).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-09-11T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel regression (USN-4115-2)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-19985", "CVE-2018-20784", "CVE-2019-0136", "CVE-2019-10207", "CVE-2019-10638", "CVE-2019-10639", "CVE-2019-11487", "CVE-2019-11599", "CVE-2019-11810", "CVE-2019-13631", "CVE-2019-13648", "CVE-2019-14283", "CVE-2019-14284", "CVE-2019-14763", "CVE-2019-15090", "CVE-2019-15211", "CVE-2019-15212", "CVE-2019-15214", "CVE-2019-15215", "CVE-2019-15216", "CVE-2019-15218", "CVE-2019-15220", "CVE-2019-15221", "CVE-2019-15292", "CVE-2019-3701", "CVE-2019-3819", "CVE-2019-3900", "CVE-2019-9506"], "modified": "2020-09-17T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-azure", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-gcp", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-gke", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-oracle", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws-hwe", "p-cpe:/a:canonical:ubuntu_linux:linux-image-azure", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gcp", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gke", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gke-4.15", "p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-oem", "p-cpe:/a:canonical:ubuntu_linux:linux-image-oracle", "p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual", "p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-hwe-16.04", "cpe:/o:canonical:ubuntu_linux:16.04", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts"], "id": "UBUNTU_USN-4115-2.NASL", "href": "https://www.tenable.com/plugins/nessus/128680", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4115-2. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(128680);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/17\");\n\n script_cve_id(\"CVE-2018-19985\", \"CVE-2018-20784\", \"CVE-2019-0136\", \"CVE-2019-10207\", \"CVE-2019-10638\", \"CVE-2019-10639\", \"CVE-2019-11487\", \"CVE-2019-11599\", \"CVE-2019-11810\", \"CVE-2019-13631\", \"CVE-2019-13648\", \"CVE-2019-14283\", \"CVE-2019-14284\", \"CVE-2019-14763\", \"CVE-2019-15090\", \"CVE-2019-15211\", \"CVE-2019-15212\", \"CVE-2019-15214\", \"CVE-2019-15215\", \"CVE-2019-15216\", \"CVE-2019-15218\", \"CVE-2019-15220\", \"CVE-2019-15221\", \"CVE-2019-15292\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-3900\", \"CVE-2019-9506\");\n script_xref(name:\"USN\", value:\"4115-2\");\n\n script_name(english:\"Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel regression (USN-4115-2)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN 4115-1 fixed vulnerabilities in the Linux 4.15 kernel for Ubuntu\n18.04 LTS and Ubuntu 16.04 LTS. Unfortunately, as part of the update,\na regression was introduced that caused a kernel crash when handling\nfragmented packets in some situations. This update addresses the\nissue.\n\nWe apologize for the inconvenience.\n\nHui Peng and Mathias Payer discovered that the Option USB High Speed\ndriver in the Linux kernel did not properly validate metadata received\nfrom the device. A physically proximate attacker could use this to\ncause a denial of service (system crash). (CVE-2018-19985)\n\nZhipeng Xie discovered that an infinite loop could triggered in the\nCFS Linux kernel process scheduler. A local attacker could possibly\nuse this to cause a denial of service. (CVE-2018-20784)\n\nIt was discovered that the Intel Wi-Fi device driver in the Linux\nkernel did not properly validate certain Tunneled Direct Link Setup\n(TDLS). A physically proximate attacker could use this to cause a\ndenial of service (Wi-Fi disconnect). (CVE-2019-0136)\n\nIt was discovered that the Bluetooth UART implementation in the Linux\nkernel did not properly check for missing tty operations. A local\nattacker could use this to cause a denial of service. (CVE-2019-10207)\n\nAmit Klein and Benny Pinkas discovered that the Linux kernel did not\nsufficiently randomize IP ID values generated for connectionless\nnetworking protocols. A remote attacker could use this to track\nparticular Linux devices. (CVE-2019-10638)\n\nAmit Klein and Benny Pinkas discovered that the location of kernel\naddresses could be exposed by the implementation of connection-less\nnetwork protocols in the Linux kernel. A remote attacker could\npossibly use this to assist in the exploitation of another\nvulnerability in the Linux kernel. (CVE-2019-10639)\n\nIt was discovered that an integer overflow existed in the Linux kernel\nwhen reference counting pages, leading to potential use-after-free\nissues. A local attacker could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2019-11487)\n\nJann Horn discovered that a race condition existed in the Linux kernel\nwhen performing core dumps. A local attacker could use this to cause a\ndenial of service (system crash) or expose sensitive information.\n(CVE-2019-11599)\n\nIt was discovered that a NULL pointer dereference vulnerability\nexisted in the LSI Logic MegaRAID driver in the Linux kernel. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-11810)\n\nIt was discovered that the GTCO tablet input driver in the Linux\nkernel did not properly bounds check the initial HID report sent by\nthe device. A physically proximate attacker could use this to cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2019-13631)\n\nPraveen Pandey discovered that the Linux kernel did not properly\nvalidate sent signals in some situations on PowerPC systems with\ntransactional memory disabled. A local attacker could use this to\ncause a denial of service. (CVE-2019-13648)\n\nIt was discovered that the floppy driver in the Linux kernel did not\nproperly validate meta data, leading to a buffer overread. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-14283)\n\nIt was discovered that the floppy driver in the Linux kernel did not\nproperly validate ioctl() calls, leading to a division-by-zero. A\nlocal attacker could use this to cause a denial of service (system\ncrash). (CVE-2019-14284)\n\nTuba Yavuz discovered that a race condition existed in the DesignWare\nUSB3 DRD Controller device driver in the Linux kernel. A physically\nproximate attacker could use this to cause a denial of service.\n(CVE-2019-14763)\n\nIt was discovered that an out-of-bounds read existed in the QLogic\nQEDI iSCSI Initiator Driver in the Linux kernel. A local attacker\ncould possibly use this to expose sensitive information (kernel\nmemory). (CVE-2019-15090)\n\nIt was discovered that the Raremono AM/FM/SW radio device driver in\nthe Linux kernel did not properly allocate memory, leading to a\nuse-after-free. A physically proximate attacker could use this to\ncause a denial of service or possibly execute arbitrary code.\n(CVE-2019-15211)\n\nIt was discovered at a double-free error existed in the USB Rio 500\ndevice driver for the Linux kernel. A physically proximate attacker\ncould use this to cause a denial of service. (CVE-2019-15212)\n\nIt was discovered that a race condition existed in the Advanced Linux\nSound Architecture (ALSA) subsystem of the Linux kernel, leading to a\npotential use-after-free. A physically proximate attacker could use\nthis to cause a denial of service (system crash) or possibly execute\narbitrary code. (CVE-2019-15214)\n\nIt was discovered that a race condition existed in the CPiA2\nvideo4linux device driver for the Linux kernel, leading to a\nuse-after-free. A physically proximate attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2019-15215)\n\nIt was discovered that a race condition existed in the Softmac USB\nPrism54 device driver in the Linux kernel. A physically proximate\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-15220)\n\nIt was discovered that a use-after-free vulnerability existed in the\nAppleTalk implementation in the Linux kernel if an error occurs during\ninitialization. A local attacker could use this to cause a denial of\nservice (system crash). (CVE-2019-15292)\n\nJason Wang discovered that an infinite loop vulnerability existed in\nthe virtio net driver in the Linux kernel. A local attacker in a guest\nVM could possibly use this to cause a denial of service in the host\nsystem. (CVE-2019-3900)\n\nDaniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen\ndiscovered that the Bluetooth protocol BR/EDR specification did not\nproperly require sufficiently strong encryption key lengths. A\nphysically proximate attacker could use this to expose sensitive\ninformation. (CVE-2019-9506)\n\nIt was discovered that a race condition existed in the USB YUREX\ndevice driver in the Linux kernel. A physically proximate attacker\ncould use this to cause a denial of service (system crash).\n(CVE-2019-15216)\n\nIt was discovered that the Siano USB MDTV receiver device driver in\nthe Linux kernel made improper assumptions about the device\ncharacteristics. A physically proximate attacker could use this cause\na denial of service (system crash). (CVE-2019-15218)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux\nkernel did not properly validate data size information from the\ndevice. A physically proximate attacker could use this to cause a\ndenial of service (system crash). (CVE-2019-15221)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in\nsome situations did not properly restrict the field size when\nprocessing outgoing frames. A local attacker with CAP_NET_ADMIN\nprivileges could use this to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux\nkernel's HID subsystem did not properly validate passed parameters in\nsome situations. A local privileged attacker could use this to cause a\ndenial of service (infinite loop). (CVE-2019-3819).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/4115-2/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-gcp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-gke\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-oracle\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws-hwe\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gcp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gke\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gke-4.15\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-oem\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-oracle\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/01/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/09/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/09/11\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04|18\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04 / 18.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2018-19985\", \"CVE-2018-20784\", \"CVE-2019-0136\", \"CVE-2019-10207\", \"CVE-2019-10638\", \"CVE-2019-10639\", \"CVE-2019-11487\", \"CVE-2019-11599\", \"CVE-2019-11810\", \"CVE-2019-13631\", \"CVE-2019-13648\", \"CVE-2019-14283\", \"CVE-2019-14284\", \"CVE-2019-14763\", \"CVE-2019-15090\", \"CVE-2019-15211\", \"CVE-2019-15212\", \"CVE-2019-15214\", \"CVE-2019-15215\", \"CVE-2019-15216\", \"CVE-2019-15218\", \"CVE-2019-15220\", \"CVE-2019-15221\", \"CVE-2019-15292\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-3900\", \"CVE-2019-9506\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-4115-2\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-1023-oracle\", pkgver:\"4.15.0-1023.26~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-1042-gcp\", pkgver:\"4.15.0-1042.44\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-1048-aws\", pkgver:\"4.15.0-1048.50~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-1057-azure\", pkgver:\"4.15.0-1057.62\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-62-generic\", pkgver:\"4.15.0-62.69~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-62-generic-lpae\", pkgver:\"4.15.0-62.69~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-62-lowlatency\", pkgver:\"4.15.0-62.69~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-aws-hwe\", pkgver:\"4.15.0.1048.48\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-azure\", pkgver:\"4.15.0.1057.60\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-gcp\", pkgver:\"4.15.0.1042.56\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-hwe-16.04\", pkgver:\"4.15.0.62.82\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-lpae-hwe-16.04\", pkgver:\"4.15.0.62.82\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-gke\", pkgver:\"4.15.0.1042.56\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-lowlatency-hwe-16.04\", pkgver:\"4.15.0.62.82\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-oem\", pkgver:\"4.15.0.62.82\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-oracle\", pkgver:\"4.15.0.1023.17\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-virtual-hwe-16.04\", pkgver:\"4.15.0.62.82\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1023-oracle\", pkgver:\"4.15.0-1023.26\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1042-gke\", pkgver:\"4.15.0-1042.44\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1044-kvm\", pkgver:\"4.15.0-1044.44\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1045-raspi2\", pkgver:\"4.15.0-1045.49\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1048-aws\", pkgver:\"4.15.0-1048.50\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-62-generic\", pkgver:\"4.15.0-62.69\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-62-generic-lpae\", pkgver:\"4.15.0-62.69\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-62-lowlatency\", pkgver:\"4.15.0-62.69\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-aws\", pkgver:\"4.15.0.1048.47\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-generic\", pkgver:\"4.15.0.62.64\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-generic-lpae\", pkgver:\"4.15.0.62.64\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-gke\", pkgver:\"4.15.0.1042.45\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-gke-4.15\", pkgver:\"4.15.0.1042.45\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-kvm\", pkgver:\"4.15.0.1044.44\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-lowlatency\", pkgver:\"4.15.0.62.64\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-oracle\", pkgver:\"4.15.0.1023.26\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-raspi2\", pkgver:\"4.15.0.1045.43\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-virtual\", pkgver:\"4.15.0.62.64\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.15-aws / linux-image-4.15-azure / etc\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-08-10T16:08:37", "description": "Hui Peng and Mathias Payer discovered that the Option USB High Speed driver in the Linux kernel did not properly validate metadata received from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19985)\n\nZhipeng Xie discovered that an infinite loop could triggered in the CFS Linux kernel process scheduler. A local attacker could possibly use this to cause a denial of service. (CVE-2018-20784)\n\nIt was discovered that the Intel wifi device driver in the Linux kernel did not properly validate certain Tunneled Direct Link Setup (TDLS). A physically proximate attacker could use this to cause a denial of service (wifi disconnect). (CVE-2019-0136)\n\nIt was discovered that the Bluetooth UART implementation in the Linux kernel did not properly check for missing tty operations. A local attacker could use this to cause a denial of service. (CVE-2019-10207)\n\nAmit Klein and Benny Pinkas discovered that the Linux kernel did not sufficiently randomize IP ID values generated for connectionless networking protocols. A remote attacker could use this to track particular Linux devices. (CVE-2019-10638)\n\nAmit Klein and Benny Pinkas discovered that the location of kernel addresses could exposed by the implementation of connection-less network protocols in the Linux kernel. A remote attacker could possibly use this to assist in the exploitation of another vulnerability in the Linux kernel. (CVE-2019-10639)\n\nIt was discovered that an integer overflow existed in the Linux kernel when reference counting pages, leading to potential use-after-free issues. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-11487)\n\nJann Horn discovered that a race condition existed in the Linux kernel when performing core dumps. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information.\n(CVE-2019-11599)\n\nIt was discovered that a NULL pointer dereference vulnerability existed in the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash).\n(CVE-2019-11810)\n\nIt was discovered that the GTCO tablet input driver in the Linux kernel did not properly bounds check the initial HID report sent by the device. A physically proximate attacker could use to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2019-13631)\n\nPraveen Pandey discovered that the Linux kernel did not properly validate sent signals in some situations on PowerPC systems with transactional memory disabled. A local attacker could use this to cause a denial of service. (CVE-2019-13648)\n\nIt was discovered that the floppy driver in the Linux kernel did not properly validate meta data, leading to a buffer overread. A local attacker could use this to cause a denial of service (system crash).\n(CVE-2019-14283)\n\nIt was discovered that the floppy driver in the Linux kernel did not properly validate ioctl() calls, leading to a division-by-zero. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-14284)\n\nTuba Yavuz discovered that a race condition existed in the DesignWare USB3 DRD Controller device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service.\n(CVE-2019-14763)\n\nIt was discovered that an out-of-bounds read existed in the QLogic QEDI iSCSI Initiator Driver in the Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2019-15090)\n\nIt was discovered that the Raremono AM/FM/SW radio device driver in the Linux kernel did not properly allocate memory, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code.\n(CVE-2019-15211)\n\nIt was discovered at a double-free error existed in the USB Rio 500 device driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service. (CVE-2019-15212)\n\nIt was discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel, leading to a potential use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) pro possibly execute arbitrary code. (CVE-2019-15214)\n\nIt was discovered that a race condition existed in the CPiA2 video4linux device driver for the Linux kernel, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15215)\n\nIt was discovered that a race condition existed in the Softmac USB Prism54 device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash).\n(CVE-2019-15220)\n\nIt was discovered that a use-after-free vulnerability existed in the Appletalk implementation in the Linux kernel if an error occurs during initialization. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-15292)\n\nJason Wang discovered that an infinite loop vulnerability existed in the virtio net driver in the Linux kernel. A local attacker in a guest VM could possibly use this to cause a denial of service in the host system. (CVE-2019-3900)\n\nDaniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen discovered that the Bluetooth protocol BR/EDR specification did not properly require sufficiently strong encryption key lengths. A physicall proximate attacker could use this to expose sensitive information. (CVE-2019-9506)\n\nIt was discovered that a race condition existed in the USB YUREX device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash).\n(CVE-2019-15216)\n\nIt was discovered that the Siano USB MDTV receiver device driver in the Linux kernel made improper assumptions about the device characteristics. A physically proximate attacker could use this cause a denial of service (system crash). (CVE-2019-15218)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux kernel did not properly validate data size information from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15221)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux kernel's HID subsystem did not properly validate passed parameters in some situations. A local privileged attacker could use this to cause a denial of service (infinite loop). (CVE-2019-3819).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-09-03T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS / 18.04 LTS : linux, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, (USN-4115-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-19985", "CVE-2018-20784", "CVE-2019-0136", "CVE-2019-10207", "CVE-2019-10638", "CVE-2019-10639", "CVE-2019-11487", "CVE-2019-11599", "CVE-2019-11810", "CVE-2019-13631", "CVE-2019-13648", "CVE-2019-14283", "CVE-2019-14284", "CVE-2019-14763", "CVE-2019-15090", "CVE-2019-15211", "CVE-2019-15212", "CVE-2019-15214", "CVE-2019-15215", "CVE-2019-15216", "CVE-2019-15218", "CVE-2019-15220", "CVE-2019-15221", "CVE-2019-15292", "CVE-2019-3701", "CVE-2019-3819", "CVE-2019-3900", "CVE-2019-9506"], "modified": "2019-09-24T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-azure", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-gcp", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-gke", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-oracle", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-azure", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gcp", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gke", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gke-4.15", "p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-oem", "p-cpe:/a:canonical:ubuntu_linux:linux-image-oracle", "p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual", "p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-hwe-16.04", "cpe:/o:canonical:ubuntu_linux:16.04", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts"], "id": "UBUNTU_USN-4115-1.NASL", "href": "https://www.tenable.com/plugins/nessus/128475", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4115-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(128475);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/09/24 11:01:33\");\n\n script_cve_id(\"CVE-2018-19985\", \"CVE-2018-20784\", \"CVE-2019-0136\", \"CVE-2019-10207\", \"CVE-2019-10638\", \"CVE-2019-10639\", \"CVE-2019-11487\", \"CVE-2019-11599\", \"CVE-2019-11810\", \"CVE-2019-13631\", \"CVE-2019-13648\", \"CVE-2019-14283\", \"CVE-2019-14284\", \"CVE-2019-14763\", \"CVE-2019-15090\", \"CVE-2019-15211\", \"CVE-2019-15212\", \"CVE-2019-15214\", \"CVE-2019-15215\", \"CVE-2019-15216\", \"CVE-2019-15218\", \"CVE-2019-15220\", \"CVE-2019-15221\", \"CVE-2019-15292\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-3900\", \"CVE-2019-9506\");\n script_xref(name:\"USN\", value:\"4115-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS / 18.04 LTS : linux, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, (USN-4115-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Hui Peng and Mathias Payer discovered that the Option USB High Speed\ndriver in the Linux kernel did not properly validate metadata received\nfrom the device. A physically proximate attacker could use this to\ncause a denial of service (system crash). (CVE-2018-19985)\n\nZhipeng Xie discovered that an infinite loop could triggered in the\nCFS Linux kernel process scheduler. A local attacker could possibly\nuse this to cause a denial of service. (CVE-2018-20784)\n\nIt was discovered that the Intel wifi device driver in the Linux\nkernel did not properly validate certain Tunneled Direct Link Setup\n(TDLS). A physically proximate attacker could use this to cause a\ndenial of service (wifi disconnect). (CVE-2019-0136)\n\nIt was discovered that the Bluetooth UART implementation in the Linux\nkernel did not properly check for missing tty operations. A local\nattacker could use this to cause a denial of service. (CVE-2019-10207)\n\nAmit Klein and Benny Pinkas discovered that the Linux kernel did not\nsufficiently randomize IP ID values generated for connectionless\nnetworking protocols. A remote attacker could use this to track\nparticular Linux devices. (CVE-2019-10638)\n\nAmit Klein and Benny Pinkas discovered that the location of kernel\naddresses could exposed by the implementation of connection-less\nnetwork protocols in the Linux kernel. A remote attacker could\npossibly use this to assist in the exploitation of another\nvulnerability in the Linux kernel. (CVE-2019-10639)\n\nIt was discovered that an integer overflow existed in the Linux kernel\nwhen reference counting pages, leading to potential use-after-free\nissues. A local attacker could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2019-11487)\n\nJann Horn discovered that a race condition existed in the Linux kernel\nwhen performing core dumps. A local attacker could use this to cause a\ndenial of service (system crash) or expose sensitive information.\n(CVE-2019-11599)\n\nIt was discovered that a NULL pointer dereference vulnerability\nexisted in the LSI Logic MegaRAID driver in the Linux kernel. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-11810)\n\nIt was discovered that the GTCO tablet input driver in the Linux\nkernel did not properly bounds check the initial HID report sent by\nthe device. A physically proximate attacker could use to cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2019-13631)\n\nPraveen Pandey discovered that the Linux kernel did not properly\nvalidate sent signals in some situations on PowerPC systems with\ntransactional memory disabled. A local attacker could use this to\ncause a denial of service. (CVE-2019-13648)\n\nIt was discovered that the floppy driver in the Linux kernel did not\nproperly validate meta data, leading to a buffer overread. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-14283)\n\nIt was discovered that the floppy driver in the Linux kernel did not\nproperly validate ioctl() calls, leading to a division-by-zero. A\nlocal attacker could use this to cause a denial of service (system\ncrash). (CVE-2019-14284)\n\nTuba Yavuz discovered that a race condition existed in the DesignWare\nUSB3 DRD Controller device driver in the Linux kernel. A physically\nproximate attacker could use this to cause a denial of service.\n(CVE-2019-14763)\n\nIt was discovered that an out-of-bounds read existed in the QLogic\nQEDI iSCSI Initiator Driver in the Linux kernel. A local attacker\ncould possibly use this to expose sensitive information (kernel\nmemory). (CVE-2019-15090)\n\nIt was discovered that the Raremono AM/FM/SW radio device driver in\nthe Linux kernel did not properly allocate memory, leading to a\nuse-after-free. A physically proximate attacker could use this to\ncause a denial of service or possibly execute arbitrary code.\n(CVE-2019-15211)\n\nIt was discovered at a double-free error existed in the USB Rio 500\ndevice driver for the Linux kernel. A physically proximate attacker\ncould use this to cause a denial of service. (CVE-2019-15212)\n\nIt was discovered that a race condition existed in the Advanced Linux\nSound Architecture (ALSA) subsystem of the Linux kernel, leading to a\npotential use-after-free. A physically proximate attacker could use\nthis to cause a denial of service (system crash) pro possibly execute\narbitrary code. (CVE-2019-15214)\n\nIt was discovered that a race condition existed in the CPiA2\nvideo4linux device driver for the Linux kernel, leading to a\nuse-after-free. A physically proximate attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2019-15215)\n\nIt was discovered that a race condition existed in the Softmac USB\nPrism54 device driver in the Linux kernel. A physically proximate\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-15220)\n\nIt was discovered that a use-after-free vulnerability existed in the\nAppletalk implementation in the Linux kernel if an error occurs during\ninitialization. A local attacker could use this to cause a denial of\nservice (system crash). (CVE-2019-15292)\n\nJason Wang discovered that an infinite loop vulnerability existed in\nthe virtio net driver in the Linux kernel. A local attacker in a guest\nVM could possibly use this to cause a denial of service in the host\nsystem. (CVE-2019-3900)\n\nDaniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen\ndiscovered that the Bluetooth protocol BR/EDR specification did not\nproperly require sufficiently strong encryption key lengths. A\nphysicall proximate attacker could use this to expose sensitive\ninformation. (CVE-2019-9506)\n\nIt was discovered that a race condition existed in the USB YUREX\ndevice driver in the Linux kernel. A physically proximate attacker\ncould use this to cause a denial of service (system crash).\n(CVE-2019-15216)\n\nIt was discovered that the Siano USB MDTV receiver device driver in\nthe Linux kernel made improper assumptions about the device\ncharacteristics. A physically proximate attacker could use this cause\na denial of service (system crash). (CVE-2019-15218)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux\nkernel did not properly validate data size information from the\ndevice. A physically proximate attacker could use this to cause a\ndenial of service (system crash). (CVE-2019-15221)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in\nsome situations did not properly restrict the field size when\nprocessing outgoing frames. A local attacker with CAP_NET_ADMIN\nprivileges could use this to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux\nkernel's HID subsystem did not properly validate passed parameters in\nsome situations. A local privileged attacker could use this to cause a\ndenial of service (infinite loop). (CVE-2019-3819).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/4115-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-gcp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-gke\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-oracle\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gcp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gke\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gke-4.15\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-oem\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-oracle\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/01/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/09/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/09/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04|18\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04 / 18.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2018-19985\", \"CVE-2018-20784\", \"CVE-2019-0136\", \"CVE-2019-10207\", \"CVE-2019-10638\", \"CVE-2019-10639\", \"CVE-2019-11487\", \"CVE-2019-11599\", \"CVE-2019-11810\", \"CVE-2019-13631\", \"CVE-2019-13648\", \"CVE-2019-14283\", \"CVE-2019-14284\", \"CVE-2019-14763\", \"CVE-2019-15090\", \"CVE-2019-15211\", \"CVE-2019-15212\", \"CVE-2019-15214\", \"CVE-2019-15215\", \"CVE-2019-15216\", \"CVE-2019-15218\", \"CVE-2019-15220\", \"CVE-2019-15221\", \"CVE-2019-15292\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-3900\", \"CVE-2019-9506\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-4115-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-1022-oracle\", pkgver:\"4.15.0-1022.25~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-1041-gcp\", pkgver:\"4.15.0-1041.43\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-1056-azure\", pkgver:\"4.15.0-1056.61\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-60-generic\", pkgver:\"4.15.0-60.67~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-60-generic-lpae\", pkgver:\"4.15.0-60.67~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-60-lowlatency\", pkgver:\"4.15.0-60.67~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-azure\", pkgver:\"4.15.0.1056.59\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-gcp\", pkgver:\"4.15.0.1041.55\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-hwe-16.04\", pkgver:\"4.15.0.60.81\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-lpae-hwe-16.04\", pkgver:\"4.15.0.60.81\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-gke\", pkgver:\"4.15.0.1041.55\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-lowlatency-hwe-16.04\", pkgver:\"4.15.0.60.81\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-oem\", pkgver:\"4.15.0.60.81\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-oracle\", pkgver:\"4.15.0.1022.16\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-virtual-hwe-16.04\", pkgver:\"4.15.0.60.81\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1022-oracle\", pkgver:\"4.15.0-1022.25\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1041-gke\", pkgver:\"4.15.0-1041.43\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1043-kvm\", pkgver:\"4.15.0-1043.43\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1044-raspi2\", pkgver:\"4.15.0-1044.47\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-60-generic\", pkgver:\"4.15.0-60.67\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-60-generic-lpae\", pkgver:\"4.15.0-60.67\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-60-lowlatency\", pkgver:\"4.15.0-60.67\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-generic\", pkgver:\"4.15.0.60.62\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-generic-lpae\", pkgver:\"4.15.0.60.62\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-gke\", pkgver:\"4.15.0.1041.44\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-gke-4.15\", pkgver:\"4.15.0.1041.44\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-kvm\", pkgver:\"4.15.0.1043.43\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-lowlatency\", pkgver:\"4.15.0.60.62\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-oracle\", pkgver:\"4.15.0.1022.25\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-raspi2\", pkgver:\"4.15.0.1044.42\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-virtual\", pkgver:\"4.15.0.60.62\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.15-azure / linux-image-4.15-gcp / etc\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-12-23T02:02:14", "description": "According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel handles the basic functions of the operating system:\n memory allocation, process allocation, device input and output, etc.Security Fix(es):Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.(CVE-2012-3400)The mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning CD-ROM drive.(CVE-2013-2164)The sctp_sf_do_5_2_4_dupcook function in net/sctp/sm_statefuns.c in the SCTP implementation in the Linux kernel before 3.8.5 does not properly handle associations during the processing of a duplicate COOKIE ECHO chunk, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted SCTP traffic.(CVE-2013-2206)The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.(CVE-2013-6282)An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free.(CVE-2018-20836)The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions.(CVE-2019-11486)The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests.(CVE-2019-11487)The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls.\n This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.(CVE-2019-11599)A n issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free.(CVE-2019-11810)An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module is removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c.(CVE-2019-11811)A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.(CVE-2018-16880)An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.(CVE-2019-11815)A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable.(CVE-2019-3819)A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable.(CVE-2019-3882)An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.(CVE-2019-3900)In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the 'sctp_sendmsg()' function (net/sctp/socket.c) when handling SCTP_SENDALL flag can be exploited to corrupt memory.(CVE-2019-8956)A flaw was found in the Linux kernel's implementation of ext4 extent management. The kernel doesn't correctly initialize memory regions in the extent tree block which may be exported to a local user to obtain sensitive information by reading empty/uninitialized data from the filesystem.(CVE-2019-11833)An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5. There is an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).\n NOTE: The vendor disputes this issues as not being a vulnerability because kstrdup() returning NULL is handled sufficiently and there is no chance for a NULL pointer dereference.(CVE-2019-12382)An issue was discovered in the efi subsystem in the Linux kernel through 5.1.5. phys_efi_set_virtual_address_map in arch/x86/platform/efi/efi.c and efi_call_phys_prolog in arch/x86/platform/efi/efi_64.c mishandle memory allocation failures. NOTE: This id is disputed as not being an issue because ?All the code touched by the referenced commit runs only at boot, before any user processes are started. Therefore, there is no possibility for an unprivileged user to control it.(CVE-2019-12380)An issue was discovered in the Linux kernel before 5.2.3. An out of bounds access exists in the function hclge_tm_schd_mode_vnet_base_cfg in the file drivers et/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c.(CVE-2019- 15925)An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup of prop-i1/4zname, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).(CVE-2019-12614)An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/syset/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6.(CVE-2019-18805)A flaw was found in the way PTRACE_TRACEME functionality was handled in the Linux kernel. The kernel's implementation of ptrace can inadvertently grant elevated permissions to an attacker who can then abuse the relationship between the tracer and the process being traced. This flaw could allow a local, unprivileged user to increase their privileges on the system or cause a denial of service.(CVE-2019-13272)An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).\n NOTE: This has been disputed as not an issue.(CVE-2019-12378)An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).\n NOTE: this is disputed because new_ra is never used if it is NULL.(CVE-2019-12381)An issue was discovered in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c in the Linux kernel through 5.1.5. There is an unchecked kstrndup of derived_name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: This id is disputed as not being an issue because 'The memory allocation that was not checked is part of a code that only runs at boot time, before user processes are started. Therefore, there is no possibility for an unprivileged user to control it, and no denial of service.'.(CVE-2019-12455)An issue was discovered in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux kernel through 5.1.5. It allows local users to cause a denial of service or possibly have unspecified other impact by changing the value of ioc_number between two kernel reads of that value, aka a ''double fetch'' vulnerability. NOTE: a third party reports that this is unexploitable because the doubly fetched value is not used.(CVE-2019-12456)An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup_const of node_info-i1/4zvdev_port.name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).(CVE-2019-12615)In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages.(CVE-2019-13631)A vulnerability was found in the Linux kernelaEURtms floppy disk driver implementation. A local attacker with access to the floppy device could call set_geometry in drivers/block/floppy.c, which does not validate the sect and head fields, causing an integer overflow and out-of-bounds read. This flaw may crash the system or allow an attacker to gather information causing subsequent successful attacks.(CVE-2019-14283)check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion.(CVE-2019-15118)An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c does not properly allocate memory.(CVE-2019-15211)An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c.(CVE-2019-15214)An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/siano/smsusb.c driver.(CVE-2019-15218)An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/sisusbvga/sisusb.c driver.(CVE-2019-15219)An issue was discovered in the Linux kernel before 5.2.1. There is a use-after-free caused by a malicious USB device in the driverset/wireless/intersil/p54/p54usb.c driver.(CVE-2019-15220)An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/pcm.c driver.(CVE-2019-15221)An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit, related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c.(CVE-2019-15292)An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9.\n XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.(CVE-2019-15538)An issue was discovered in the Linux kernel before 5.0.19. There is an out-of-bounds array access in __xfrm_policy_unlink, which will cause denial of service, because verify_newpolicy_info in net/xfrm/xfrm_user.c mishandles directory validation.(CVE-2019-15666)In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will cause a BUG and denial of service.(CVE-2019-15807)An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c.(CVE-2019-15917)An issue was discovered in the Linux kernel before 5.0.10.\n SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.(CVE-2019-15919)An issue was discovered in the Linux kernel before 5.0.10. SMB2_read in fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was not fixed correctly in 5.0.10 see the 5.0.11 ChangeLog, which documents a memory leak.(CVE-2019-15920)An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly, which causes an i_size_read() infinite loop and denial of service on SMP systems.(CVE-2019-16413)An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames. This is related to cgw_csum_xor_rel. An unprivileged user can trigger a system crash (general protection fault).(CVE-2019-3701)A flaw was found in the Linux kernel's Marvell wifi chip driver. A heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c allows remote attackers to cause a denial of service(system crash) or execute arbitrary code.(CVE-2019-3846)A new software page cache side channel attack scenario was discovered in operating systems that implement the very common 'page cache' caching mechanism. A malicious user/process could use 'in memory' page-cache knowledge to infer access timings to shared memory and gain knowledge which can be used to reduce effectiveness of cryptographic strength by monitoring algorithmic behavior, infer access patterns of memory to determine code paths taken, and exfiltrate data to a blinded attacker through page-granularity access times as a side-channel.(CVE-2019-5489)In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.(CVE-2019-9455)A vulnerability was found in the arch/x86/lib/insn-eval.c function in the Linux kernel. An attacker could corrupt the memory due to a flaw in use-after-free access to an LDT entry caused by a race condition between modify_ldt() and a #BR exception for an MPX bounds violation.(CVE-2019-13233)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-03-11T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1186)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2012-3400", "CVE-2013-2164", "CVE-2013-2206", "CVE-2013-6282", "CVE-2018-16880", "CVE-2018-20836", "CVE-2019-11486", "CVE-2019-11487", "CVE-2019-11599", "CVE-2019-11810", "CVE-2019-11811", "CVE-2019-11815", "CVE-2019-11833", "CVE-2019-12378", "CVE-2019-12380", "CVE-2019-12381", "CVE-2019-12382", "CVE-2019-12455", "CVE-2019-12456", "CVE-2019-12614", "CVE-2019-12615", "CVE-2019-13233", "CVE-2019-13272", "CVE-2019-13631", "CVE-2019-14283", "CVE-2019-15118", "CVE-2019-15211", "CVE-2019-15214", "CVE-2019-15218", "CVE-2019-15219", "CVE-2019-15220", "CVE-2019-15221", "CVE-2019-15292", "CVE-2019-15538", "CVE-2019-15666", "CVE-2019-15807", "CVE-2019-15917", "CVE-2019-15919", "CVE-2019-15920", "CVE-2019-15925", "CVE-2019-16413", "CVE-2019-18805", "CVE-2019-3701", "CVE-2019-3819", "CVE-2019-3846", "CVE-2019-3882", "CVE-2019-3900", "CVE-2019-5489", "CVE-2019-8956", "CVE-2019-9455"], "modified": "2021-12-20T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:bpftool", "p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-source", "p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "p-cpe:/a:huawei:euleros:perf", "p-cpe:/a:huawei:euleros:python-perf", "p-cpe:/a:huawei:euleros:python3-perf", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2020-1186.NASL", "href": "https://www.tenable.com/plugins/nessus/134387", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(134387);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/12/20\");\n\n script_cve_id(\n \"CVE-2012-3400\",\n \"CVE-2013-2164\",\n \"CVE-2013-2206\",\n \"CVE-2013-6282\",\n \"CVE-2018-16880\",\n \"CVE-2018-20836\",\n \"CVE-2019-11486\",\n \"CVE-2019-11487\",\n \"CVE-2019-11599\",\n \"CVE-2019-11810\",\n \"CVE-2019-11811\",\n \"CVE-2019-11815\",\n \"CVE-2019-11833\",\n \"CVE-2019-12378\",\n \"CVE-2019-12380\",\n \"CVE-2019-12381\",\n \"CVE-2019-12382\",\n \"CVE-2019-12455\",\n \"CVE-2019-12456\",\n \"CVE-2019-12614\",\n \"CVE-2019-12615\",\n \"CVE-2019-13233\",\n \"CVE-2019-13272\",\n \"CVE-2019-13631\",\n \"CVE-2019-14283\",\n \"CVE-2019-15118\",\n \"CVE-2019-15211\",\n \"CVE-2019-15214\",\n \"CVE-2019-15218\",\n \"CVE-2019-15219\",\n \"CVE-2019-15220\",\n \"CVE-2019-15221\",\n \"CVE-2019-15292\",\n \"CVE-2019-15538\",\n \"CVE-2019-15666\",\n \"CVE-2019-15807\",\n \"CVE-2019-15917\",\n \"CVE-2019-15919\",\n \"CVE-2019-15920\",\n \"CVE-2019-15925\",\n \"CVE-2019-16413\",\n \"CVE-2019-18805\",\n \"CVE-2019-3701\",\n \"CVE-2019-3819\",\n \"CVE-2019-3846\",\n \"CVE-2019-3882\",\n \"CVE-2019-3900\",\n \"CVE-2019-5489\",\n \"CVE-2019-8956\",\n \"CVE-2019-9455\"\n );\n script_bugtraq_id(\n 54279,\n 60375,\n 60715,\n 63734\n );\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/10\");\n\n script_name(english:\"EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1186)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - The kernel package contains the Linux kernel (vmlinuz),\n the core of any Linux operating system. The kernel\n handles the basic functions of the operating system:\n memory allocation, process allocation, device input and\n output, etc.Security Fix(es):Heap-based buffer overflow\n in the udf_load_logicalvol function in fs/udf/super.c\n in the Linux kernel before 3.4.5 allows remote\n attackers to cause a denial of service (system crash)\n or possibly have unspecified other impact via a crafted\n UDF filesystem.(CVE-2012-3400)The\n mmc_ioctl_cdrom_read_data function in\n drivers/cdrom/cdrom.c in the Linux kernel through 3.10\n allows local users to obtain sensitive information from\n kernel memory via a read operation on a malfunctioning\n CD-ROM drive.(CVE-2013-2164)The\n sctp_sf_do_5_2_4_dupcook function in\n net/sctp/sm_statefuns.c in the SCTP implementation in\n the Linux kernel before 3.8.5 does not properly handle\n associations during the processing of a duplicate\n COOKIE ECHO chunk, which allows remote attackers to\n cause a denial of service (NULL pointer dereference and\n system crash) or possibly have unspecified other impact\n via crafted SCTP traffic.(CVE-2013-2206)The (1)\n get_user and (2) put_user API functions in the Linux\n kernel before 3.5.5 on the v6k and v7 ARM platforms do\n not validate certain addresses, which allows attackers\n to read or modify the contents of arbitrary kernel\n memory locations via a crafted application, as\n exploited in the wild against Android devices in\n October and November 2013.(CVE-2013-6282)An issue was\n discovered in the Linux kernel before 4.20. There is a\n race condition in smp_task_timedout() and\n smp_task_done() in drivers/scsi/libsas/sas_expander.c,\n leading to a use-after-free.(CVE-2018-20836)The Siemens\n R3964 line discipline driver in drivers/tty/n_r3964.c\n in the Linux kernel before 5.0.8 has multiple race\n conditions.(CVE-2019-11486)The Linux kernel before\n 5.1-rc5 allows page->_refcount reference count\n overflow, with resultant use-after-free issues, if\n about 140 GiB of RAM exists. This is related to\n fs/fuse/dev.c, fs/pipe.c, fs/splice.c,\n include/linux/mm.h, include/linux/pipe_fs_i.h,\n kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It\n can occur with FUSE requests.(CVE-2019-11487)The\n coredump implementation in the Linux kernel before\n 5.0.10 does not use locking or other mechanisms to\n prevent vma layout or vma flags changes while it runs,\n which allows local users to obtain sensitive\n information, cause a denial of service, or possibly\n have unspecified other impact by triggering a race\n condition with mmget_not_zero or get_task_mm calls.\n This is related to fs/userfaultfd.c, mm/mmap.c,\n fs/proc/task_mmu.c, and\n drivers/infiniband/core/uverbs_main.c.(CVE-2019-11599)A\n n issue was discovered in the Linux kernel before\n 5.0.7. A NULL pointer dereference can occur when\n megasas_create_frame_pool() fails in\n megasas_alloc_cmds() in\n drivers/scsi/megaraid/megaraid_sas_base.c. This causes\n a Denial of Service, related to a\n use-after-free.(CVE-2019-11810)An issue was discovered\n in the Linux kernel before 5.0.4. There is a\n use-after-free upon attempted read access to\n /proc/ioports after the ipmi_si module is removed,\n related to drivers/char/ipmi/ipmi_si_intf.c,\n drivers/char/ipmi/ipmi_si_mem_io.c, and\n drivers/char/ipmi/ipmi_si_port_io.c.(CVE-2019-11811)A\n flaw was found in the Linux kernel's handle_rx()\n function in the [vhost_net] driver. A malicious virtual\n guest, under specific conditions, can trigger an\n out-of-bounds write in a kmalloc-8 slab on a virtual\n host which may lead to a kernel memory corruption and a\n system panic. Due to the nature of the flaw, privilege\n escalation cannot be fully ruled out. Versions from\n v4.16 and newer are vulnerable.(CVE-2018-16880)An issue\n was discovered in rds_tcp_kill_sock in net/rds/tcp.c in\n the Linux kernel before 5.0.8. There is a race\n condition leading to a use-after-free, related to net\n namespace cleanup.(CVE-2019-11815)A flaw was found in\n the Linux kernel in the function\n hid_debug_events_read() in drivers/hid/hid-debug.c file\n which may enter an infinite loop with certain\n parameters passed from a userspace. A local privileged\n user ('root') can cause a system lock up and a denial\n of service. Versions from v4.18 and newer are\n vulnerable.(CVE-2019-3819)A flaw was found in the Linux\n kernel's vfio interface implementation that permits\n violation of the user's locked memory limit. If a\n device is bound to a vfio driver, such as vfio-pci, and\n the local attacker is administratively granted\n ownership of the device, it may cause a system memory\n exhaustion and thus a denial of service (DoS). Versions\n 3.10, 4.14 and 4.18 are vulnerable.(CVE-2019-3882)An\n infinite loop issue was found in the vhost_net kernel\n module in Linux Kernel up to and including v5.1-rc6,\n while handling incoming packets in handle_rx(). It\n could occur if one end sends packets faster than the\n other end can process them. A guest user, maybe remote\n one, could use this flaw to stall the vhost_net kernel\n thread, resulting in a DoS scenario.(CVE-2019-3900)In\n the Linux Kernel before versions 4.20.8 and 4.19.21 a\n use-after-free error in the 'sctp_sendmsg()' function\n (net/sctp/socket.c) when handling SCTP_SENDALL flag can\n be exploited to corrupt memory.(CVE-2019-8956)A flaw\n was found in the Linux kernel's implementation of ext4\n extent management. The kernel doesn't correctly\n initialize memory regions in the extent tree block\n which may be exported to a local user to obtain\n sensitive information by reading empty/uninitialized\n data from the filesystem.(CVE-2019-11833)An issue was\n discovered in drm_load_edid_firmware in\n drivers/gpu/drm/drm_edid_load.c in the Linux kernel\n through 5.1.5. There is an unchecked kstrdup of fwstr,\n which might allow an attacker to cause a denial of\n service (NULL pointer dereference and system crash).\n NOTE: The vendor disputes this issues as not being a\n vulnerability because kstrdup() returning NULL is\n handled sufficiently and there is no chance for a NULL\n pointer dereference.(CVE-2019-12382)An issue was\n discovered in the efi subsystem in the Linux kernel\n through 5.1.5. phys_efi_set_virtual_address_map in\n arch/x86/platform/efi/efi.c and efi_call_phys_prolog in\n arch/x86/platform/efi/efi_64.c mishandle memory\n allocation failures. NOTE: This id is disputed as not\n being an issue because ?All the code touched by the\n referenced commit runs only at boot, before any user\n processes are started. Therefore, there is no\n possibility for an unprivileged user to control\n it.(CVE-2019-12380)An issue was discovered in the Linux\n kernel before 5.2.3. An out of bounds access exists in\n the function hclge_tm_schd_mode_vnet_base_cfg in the\n file drivers\n et/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c.(CVE-2019-\n 15925)An issue was discovered in\n dlpar_parse_cc_property in\n arch/powerpc/platforms/pseries/dlpar.c in the Linux\n kernel through 5.1.6. There is an unchecked kstrdup of\n prop-i1/4zname, which might allow an attacker to cause a\n denial of service (NULL pointer dereference and system\n crash).(CVE-2019-12614)An issue was discovered in\n net/ipv4/sysctl_net_ipv4.c in the Linux kernel before\n 5.0.11. There is a net/ipv4/tcp_input.c signed integer\n overflow in tcp_ack_update_rtt() when userspace writes\n a very large integer to\n /proc/syset/ipv4/tcp_min_rtt_wlen, leading to a denial\n of service or possibly unspecified other impact, aka\n CID-19fad20d15a6.(CVE-2019-18805)A flaw was found in\n the way PTRACE_TRACEME functionality was handled in the\n Linux kernel. The kernel's implementation of ptrace can\n inadvertently grant elevated permissions to an attacker\n who can then abuse the relationship between the tracer\n and the process being traced. This flaw could allow a\n local, unprivileged user to increase their privileges\n on the system or cause a denial of\n service.(CVE-2019-13272)An issue was discovered in\n ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux\n kernel through 5.1.5. There is an unchecked kmalloc of\n new_ra, which might allow an attacker to cause a denial\n of service (NULL pointer dereference and system crash).\n NOTE: This has been disputed as not an\n issue.(CVE-2019-12378)An issue was discovered in\n ip_ra_control in net/ipv4/ip_sockglue.c in the Linux\n kernel through 5.1.5. There is an unchecked kmalloc of\n new_ra, which might allow an attacker to cause a denial\n of service (NULL pointer dereference and system crash).\n NOTE: this is disputed because new_ra is never used if\n it is NULL.(CVE-2019-12381)An issue was discovered in\n sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c\n in the Linux kernel through 5.1.5. There is an\n unchecked kstrndup of derived_name, which might allow\n an attacker to cause a denial of service (NULL pointer\n dereference and system crash). NOTE: This id is\n disputed as not being an issue because 'The memory\n allocation that was not checked is part of a code that\n only runs at boot time, before user processes are\n started. Therefore, there is no possibility for an\n unprivileged user to control it, and no denial of\n service.'.(CVE-2019-12455)An issue was discovered in\n the MPT3COMMAND case in _ctl_ioctl_main in\n drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux kernel\n through 5.1.5. It allows local users to cause a denial\n of service or possibly have unspecified other impact by\n changing the value of ioc_number between two kernel\n reads of that value, aka a ''double fetch''\n vulnerability. NOTE: a third party reports that this is\n unexploitable because the doubly fetched value is not\n used.(CVE-2019-12456)An issue was discovered in\n get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in\n the Linux kernel through 5.1.6. There is an unchecked\n kstrdup_const of node_info-i1/4zvdev_port.name, which\n might allow an attacker to cause a denial of service\n (NULL pointer dereference and system\n crash).(CVE-2019-12615)In parse_hid_report_descriptor\n in drivers/input/tablet/gtco.c in the Linux kernel\n through 5.2.1, a malicious USB device can send an HID\n report that triggers an out-of-bounds write during\n generation of debugging messages.(CVE-2019-13631)A\n vulnerability was found in the Linux kernelaEURtms floppy\n disk driver implementation. A local attacker with\n access to the floppy device could call set_geometry in\n drivers/block/floppy.c, which does not validate the\n sect and head fields, causing an integer overflow and\n out-of-bounds read. This flaw may crash the system or\n allow an attacker to gather information causing\n subsequent successful\n attacks.(CVE-2019-14283)check_input_term in\n sound/usb/mixer.c in the Linux kernel through 5.2.9\n mishandles recursion, leading to kernel stack\n exhaustion.(CVE-2019-15118)An issue was discovered in\n the Linux kernel before 5.2.6. There is a\n use-after-free caused by a malicious USB device in the\n drivers/media/v4l2-core/v4l2-dev.c driver because\n drivers/media/radio/radio-raremono.c does not properly\n allocate memory.(CVE-2019-15211)An issue was discovered\n in the Linux kernel before 5.0.10. There is a\n use-after-free in the sound subsystem because card\n disconnection causes certain data structures to be\n deleted too early. This is related to sound/core/init.c\n and sound/core/info.c.(CVE-2019-15214)An issue was\n discovered in the Linux kernel before 5.1.8. There is a\n NULL pointer dereference caused by a malicious USB\n device in the drivers/media/usb/siano/smsusb.c\n driver.(CVE-2019-15218)An issue was discovered in the\n Linux kernel before 5.1.8. There is a NULL pointer\n dereference caused by a malicious USB device in the\n drivers/usb/misc/sisusbvga/sisusb.c\n driver.(CVE-2019-15219)An issue was discovered in the\n Linux kernel before 5.2.1. There is a use-after-free\n caused by a malicious USB device in the\n driverset/wireless/intersil/p54/p54usb.c\n driver.(CVE-2019-15220)An issue was discovered in the\n Linux kernel before 5.1.17. There is a NULL pointer\n dereference caused by a malicious USB device in the\n sound/usb/line6/pcm.c driver.(CVE-2019-15221)An issue\n was discovered in the Linux kernel before 5.0.9. There\n is a use-after-free in atalk_proc_exit, related to\n net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and\n net/appletalk/sysctl_net_atalk.c.(CVE-2019-15292)An\n issue was discovered in xfs_setattr_nonsize in\n fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9.\n XFS partially wedges when a chgrp fails on account of\n being out of disk quota. xfs_setattr_nonsize is failing\n to unlock the ILOCK after the xfs_qm_vop_chown_reserve\n call fails. This is primarily a local DoS attack\n vector, but it might result as well in remote DoS if\n the XFS filesystem is exported for instance via\n NFS.(CVE-2019-15538)An issue was discovered in the\n Linux kernel before 5.0.19. There is an out-of-bounds\n array access in __xfrm_policy_unlink, which will cause\n denial of service, because verify_newpolicy_info in\n net/xfrm/xfrm_user.c mishandles directory\n validation.(CVE-2019-15666)In the Linux kernel before\n 5.1.13, there is a memory leak in\n drivers/scsi/libsas/sas_expander.c when SAS expander\n discovery fails. This will cause a BUG and denial of\n service.(CVE-2019-15807)An issue was discovered in the\n Linux kernel before 5.0.5. There is a use-after-free\n issue when hci_uart_register_dev() fails in\n hci_uart_set_proto() in\n drivers/bluetooth/hci_ldisc.c.(CVE-2019-15917)An issue\n was discovered in the Linux kernel before 5.0.10.\n SMB2_write in fs/cifs/smb2pdu.c has a\n use-after-free.(CVE-2019-15919)An issue was discovered\n in the Linux kernel before 5.0.10. SMB2_read in\n fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was\n not fixed correctly in 5.0.10 see the 5.0.11 ChangeLog,\n which documents a memory leak.(CVE-2019-15920)An issue\n was discovered in the Linux kernel before 5.0.4. The 9p\n filesystem did not protect i_size_write() properly,\n which causes an i_size_read() infinite loop and denial\n of service on SMP systems.(CVE-2019-16413)An issue was\n discovered in can_can_gw_rcv in net/can/gw.c in the\n Linux kernel through 4.19.13. The CAN frame\n modification rules allow bitwise logical operations\n that can be also applied to the can_dlc field. Because\n of a missing check, the CAN drivers may write arbitrary\n content beyond the data registers in the CAN\n controller's I/O memory when processing can-gw\n manipulated outgoing frames. This is related to\n cgw_csum_xor_rel. An unprivileged user can trigger a\n system crash (general protection\n fault).(CVE-2019-3701)A flaw was found in the Linux\n kernel's Marvell wifi chip driver. A heap overflow in\n mwifiex_update_bss_desc_with_ie function in\n marvell/mwifiex/scan.c allows remote attackers to cause\n a denial of service(system crash) or execute arbitrary\n code.(CVE-2019-3846)A new software page cache side\n channel attack scenario was discovered in operating\n systems that implement the very common 'page cache'\n caching mechanism. A malicious user/process could use\n 'in memory' page-cache knowledge to infer access\n timings to shared memory and gain knowledge which can\n be used to reduce effectiveness of cryptographic\n strength by monitoring algorithmic behavior, infer\n access patterns of memory to determine code paths\n taken, and exfiltrate data to a blinded attacker\n through page-granularity access times as a\n side-channel.(CVE-2019-5489)In the Android kernel in\n the video driver there is a kernel pointer leak due to\n a WARN_ON statement. This could lead to local\n information disclosure with System execution privileges\n needed. User interaction is not needed for\n exploitation.(CVE-2019-9455)A vulnerability was found\n in the arch/x86/lib/insn-eval.c function in the Linux\n kernel. An attacker could corrupt the memory due to a\n flaw in use-after-free access to an LDT entry caused by\n a race condition between modify_ldt() and a #BR\n exception for an MPX bounds violation.(CVE-2019-13233)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1186\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6d22916d\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Linux Polkit pkexec helper PTRACE_TRACEME local root exploit');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/03/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/03/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:bpftool\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python3-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(8)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"bpftool-4.19.36-vhulk1907.1.0.h361.eulerosv2r8\",\n \"kernel-4.19.36-vhulk1907.1.0.h361.eulerosv2r8\",\n \"kernel-devel-4.19.36-vhulk1907.1.0.h361.eulerosv2r8\",\n \"kernel-headers-4.19.36-vhulk1907.1.0.h361.eulerosv2r8\",\n \"kernel-source-4.19.36-vhulk1907.1.0.h361.eulerosv2r8\",\n \"kernel-tools-4.19.36-vhulk1907.1.0.h361.eulerosv2r8\",\n \"kernel-tools-libs-4.19.36-vhulk1907.1.0.h361.eulerosv2r8\",\n \"perf-4.19.36-vhulk1907.1.0.h361.eulerosv2r8\",\n \"python-perf-4.19.36-vhulk1907.1.0.h361.eulerosv2r8\",\n \"python3-perf-4.19.36-vhulk1907.1.0.h361.eulerosv2r8\"];\n\nforeach (var pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"8\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-12-23T02:15:38", "description": "It was discovered that the alarmtimer implementation in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service. (CVE-2018-13053)\n\nWen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly track inode validations. An attacker could use this to construct a malicious XFS image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13093)\n\nWen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13096, CVE-2018-13097, CVE-2018-13098, CVE-2018-13099, CVE-2018-13100, CVE-2018-14614, CVE-2018-14615, CVE-2018-14616)\n\nWen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not properly validate metadata.\nAn attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service (system crash).\n(CVE-2018-14609, CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613)\n\nWen Xu discovered that the HFS+ filesystem implementation in the Linux kernel did not properly handle malformed catalog data in some situations. An attacker could use this to construct a malicious HFS+ image that, when mounted, could cause a denial of service (system crash). (CVE-2018-14617)\n\nVasily Averin and Pavel Tikhomirov discovered that the cleancache subsystem of the Linux kernel did not properly initialize new files in some situations. A local attacker could use this to expose sensitive information. (CVE-2018-16862)\n\nHui Peng and Mathias Payer discovered that the Option USB High Speed driver in the Linux kernel did not properly validate metadata received from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19985)\n\nHui Peng and Mathias Payer discovered that the USB subsystem in the Linux kernel did not properly handle size checks when handling an extra USB descriptor. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-20169)\n\nZhipeng Xie discovered that an infinite loop could triggered in the CFS Linux kernel process scheduler. A local attacker could possibly use this to cause a denial of service. (CVE-2018-20784)\n\nIt was discovered that a use-after-free error existed in the block layer subsystem of the Linux kernel when certain failure conditions occurred. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2018-20856)\n\nEli Biham and Lior Neumann discovered that the Bluetooth implementation in the Linux kernel did not properly validate elliptic curve parameters during Diffie-Hellman key exchange in some situations. An attacker could use this to expose sensitive information. (CVE-2018-5383)\n\nIt was discovered that the Intel wifi device driver in the Linux kernel did not properly validate certain Tunneled Direct Link Setup (TDLS). A physically proximate attacker could use this to cause a denial of service (wifi disconnect). (CVE-2019-0136)\n\nIt was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-10126)\n\nIt was discovered that the Bluetooth UART implementation in the Linux kernel did not properly check for missing tty operations. A local attacker could use this to cause a denial of service. (CVE-2019-10207)\n\nAmit Klein and Benny Pinkas discovered that the Linux kernel did not sufficiently randomize IP ID values generated for connectionless networking protocols. A remote attacker could use this to track particular Linux devices. (CVE-2019-10638)\n\nAmit Klein and Benny Pinkas discovered that the location of kernel addresses could exposed by the implementation of connection-less network protocols in the Linux kernel. A remote attacker could possibly use this to assist in the exploitation of another vulnerability in the Linux kernel. (CVE-2019-10639)\n\nAdam Zabrocki discovered that the Intel i915 kernel mode graphics driver in the Linux kernel did not properly restrict mmap() ranges in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2019-11085)\n\nIt was discovered that an integer overflow existed in the Linux kernel when reference counting pages, leading to potential use-after-free issues. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-11487)\n\nJann Horn discovered that a race condition existed in the Linux kernel when performing core dumps. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information.\n(CVE-2019-11599)\n\nIt was discovered that a NULL pointer dereference vulnerability existed in the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash).\n(CVE-2019-11810)\n\nIt was discovered that a race condition leading to a use-after-free existed in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel. The RDS protocol is blacklisted by default in Ubuntu. If enabled, a local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2019-11815)\n\nIt was discovered that the ext4 file system implementation in the Linux kernel did not properly zero out memory in some situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2019-11833)\n\nIt was discovered that the Bluetooth Human Interface Device Protocol (HIDP) implementation in the Linux kernel did not properly verify strings were NULL terminated in certain situations. A local attacker could use this to expose sensitive information (kernel memory).\n(CVE-2019-11884)\n\nIt was discovered that a NULL pointer dereference vulnerabilty existed in the Near-field communication (NFC) implementation in the Linux kernel. An attacker could use this to cause a denial of service (system crash). (CVE-2019-12818)\n\nIt was discovered that the MDIO bus devices subsystem in the Linux kernel improperly dropped a device reference in an error condition, leading to a use-after-free. An attacker could use this to cause a denial of service (system crash). (CVE-2019-12819)\n\nIt was discovered that a NULL pointer dereference vulnerability existed in the Near-field communication (NFC) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-12984)\n\nJann Horn discovered a use-after-free vulnerability in the Linux kernel when accessing LDT entries in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-13233)\n\nJann Horn discovered that the ptrace implementation in the Linux kernel did not properly record credentials in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly gain administrative privileges. (CVE-2019-13272)\n\nIt was discovered that the GTCO tablet input driver in the Linux kernel did not properly bounds check the initial HID report sent by the device. A physically proximate attacker could use to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2019-13631)\n\nIt was discovered that the floppy driver in the Linux kernel did not properly validate meta data, leading to a buffer overread. A local attacker could use this to cause a denial of service (system crash).\n(CVE-2019-14283)\n\nIt was discovered that the floppy driver in the Linux kernel did not properly validate ioctl() calls, leading to a division-by-zero. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-14284)\n\nTuba Yavuz discovered that a race condition existed in the DesignWare USB3 DRD Controller device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service.\n(CVE-2019-14763)\n\nIt was discovered that an out-of-bounds read existed in the QLogic QEDI iSCSI Initiator Driver in the Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2019-15090)\n\nIt was discovered that the Raremono AM/FM/SW radio device driver in the Linux kernel did not properly allocate memory, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code.\n(CVE-2019-15211)\n\nIt was discovered at a double-free error existed in the USB Rio 500 device driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service. (CVE-2019-15212)\n\nIt was discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel, leading to a potential use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) pro possibly execute arbitrary code. (CVE-2019-15214)\n\nIt was discovered that a race condition existed in the CPiA2 video4linux device driver for the Linux kernel, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15215)\n\nIt was discovered that a race condition existed in the Softmac USB Prism54 device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash).\n(CVE-2019-15220)\n\nIt was discovered that a use-after-free vulnerability existed in the Appletalk implementation in the Linux kernel if an error occurs during initialization. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-15292)\n\nIt was discovered that the Empia EM28xx DVB USB device driver implementation in the Linux kernel contained a use-after-free vulnerability when disconnecting the device. An attacker could use this to cause a denial of service (system crash). (CVE-2019-2024)\n\nIt was discovered that the USB video device class implementation in the Linux kernel did not properly validate control bits, resulting in an out of bounds buffer read. A local attacker could use this to possibly expose sensitive information (kernel memory). (CVE-2019-2101)\n\nIt was discovered that the Marvell Wireless LAN device driver in the Linux kernel did not properly validate the BSS descriptor. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-3846)\n\nJason Wang discovered that an infinite loop vulnerability existed in the virtio net driver in the Linux kernel. A local attacker in a guest VM could possibly use this to cause a denial of service in the host system. (CVE-2019-3900)\n\nDaniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen discovered that the Bluetooth protocol BR/EDR specification did not properly require sufficiently strong encryption key lengths. A physicall proximate attacker could use this to expose sensitive information. (CVE-2019-9506)\n\nIt was discovered that the Appletalk IP encapsulation driver in the Linux kernel did not properly prevent kernel addresses from being copied to user space. A local attacker with the CAP_NET_ADMIN capability could use this to expose sensitive information.\n(CVE-2018-20511)\n\nIt was discovered that a race condition existed in the USB YUREX device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash).\n(CVE-2019-15216)\n\nIt was discovered that the Siano USB MDTV receiver device driver in the Linux kernel made improper assumptions about the device characteristics. A physically proximate attacker could use this cause a denial of service (system crash). (CVE-2019-15218)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux kernel did not properly validate data size information from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15221)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux kernel's HID subsystem did not properly validate passed parameters in some situations. A local privileged attacker could use this to cause a denial of service (infinite loop). (CVE-2019-3819).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-09-03T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS / 18.04 LTS : linux-aws vulnerabilities (USN-4118-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-13053", "CVE-2018-13093", "CVE-2018-13096", "CVE-2018-13097", "CVE-2018-13098", "CVE-2018-13099", "CVE-2018-13100", "CVE-2018-14609", "CVE-2018-14610", "CVE-2018-14611", "CVE-2018-14612", "CVE-2018-14613", "CVE-2018-14614", "CVE-2018-14615", "CVE-2018-14616", "CVE-2018-14617", "CVE-2018-16862", "CVE-2018-19985", "CVE-2018-20169", "CVE-2018-20511", "CVE-2018-20784", "CVE-2018-20856", "CVE-2018-5383", "CVE-2019-0136", "CVE-2019-10126", "CVE-2019-10207", "CVE-2019-10638", "CVE-2019-10639", "CVE-2019-11085", "CVE-2019-11487", "CVE-2019-11599", "CVE-2019-11810", "CVE-2019-11815", "CVE-2019-11833", "CVE-2019-11884", "CVE-2019-12818", "CVE-2019-12819", "CVE-2019-12984", "CVE-2019-13233", "CVE-2019-13272", "CVE-2019-13631", "CVE-2019-14283", "CVE-2019-14284", "CVE-2019-14763", "CVE-2019-15090", "CVE-2019-15211", "CVE-2019-15212", "CVE-2019-15214", "CVE-2019-15215", "CVE-2019-15216", "CVE-2019-15218", "CVE-2019-15220", "CVE-2019-15221", "CVE-2019-15292", "CVE-2019-2024", "CVE-2019-2101", "CVE-2019-3701", "CVE-2019-3819", "CVE-2019-3846", "CVE-2019-3900", "CVE-2019-9506"], "modified": "2021-12-21T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws-hwe", "cpe:/o:canonical:ubuntu_linux:16.04", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts"], "id": "UBUNTU_USN-4118-1.NASL", "href": "https://www.tenable.com/plugins/nessus/128478", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4118-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(128478);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/12/21\");\n\n script_cve_id(\"CVE-2018-13053\", \"CVE-2018-13093\", \"CVE-2018-13096\", \"CVE-2018-13097\", \"CVE-2018-13098\", \"CVE-2018-13099\", \"CVE-2018-13100\", \"CVE-2018-14609\", \"CVE-2018-14610\", \"CVE-2018-14611\", \"CVE-2018-14612\", \"CVE-2018-14613\", \"CVE-2018-14614\", \"CVE-2018-14615\", \"CVE-2018-14616\", \"CVE-2018-14617\", \"CVE-2018-16862\", \"CVE-2018-19985\", \"CVE-2018-20169\", \"CVE-2018-20511\", \"CVE-2018-20784\", \"CVE-2018-20856\", \"CVE-2018-5383\", \"CVE-2019-0136\", \"CVE-2019-10126\", \"CVE-2019-10207\", \"CVE-2019-10638\", \"CVE-2019-10639\", \"CVE-2019-11085\", \"CVE-2019-11487\", \"CVE-2019-11599\", \"CVE-2019-11810\", \"CVE-2019-11815\", \"CVE-2019-11833\", \"CVE-2019-11884\", \"CVE-2019-12818\", \"CVE-2019-12819\", \"CVE-2019-12984\", \"CVE-2019-13233\", \"CVE-2019-13272\", \"CVE-2019-13631\", \"CVE-2019-14283\", \"CVE-2019-14284\", \"CVE-2019-14763\", \"CVE-2019-15090\", \"CVE-2019-15211\", \"CVE-2019-15212\", \"CVE-2019-15214\", \"CVE-2019-15215\", \"CVE-2019-15216\", \"CVE-2019-15218\", \"CVE-2019-15220\", \"CVE-2019-15221\", \"CVE-2019-15292\", \"CVE-2019-2024\", \"CVE-2019-2101\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-3846\", \"CVE-2019-3900\", \"CVE-2019-9506\");\n script_xref(name:\"USN\", value:\"4118-1\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/10\");\n\n script_name(english:\"Ubuntu 16.04 LTS / 18.04 LTS : linux-aws vulnerabilities (USN-4118-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"It was discovered that the alarmtimer implementation in the Linux\nkernel contained an integer overflow vulnerability. A local attacker\ncould use this to cause a denial of service. (CVE-2018-13053)\n\nWen Xu discovered that the XFS filesystem implementation in the Linux\nkernel did not properly track inode validations. An attacker could use\nthis to construct a malicious XFS image that, when mounted, could\ncause a denial of service (system crash). (CVE-2018-13093)\n\nWen Xu discovered that the f2fs file system implementation in the\nLinux kernel did not properly validate metadata. An attacker could use\nthis to construct a malicious f2fs image that, when mounted, could\ncause a denial of service (system crash). (CVE-2018-13096,\nCVE-2018-13097, CVE-2018-13098, CVE-2018-13099, CVE-2018-13100,\nCVE-2018-14614, CVE-2018-14615, CVE-2018-14616)\n\nWen Xu and Po-Ning Tseng discovered that btrfs file system\nimplementation in the Linux kernel did not properly validate metadata.\nAn attacker could use this to construct a malicious btrfs image that,\nwhen mounted, could cause a denial of service (system crash).\n(CVE-2018-14609, CVE-2018-14610, CVE-2018-14611, CVE-2018-14612,\nCVE-2018-14613)\n\nWen Xu discovered that the HFS+ filesystem implementation in the Linux\nkernel did not properly handle malformed catalog data in some\nsituations. An attacker could use this to construct a malicious HFS+\nimage that, when mounted, could cause a denial of service (system\ncrash). (CVE-2018-14617)\n\nVasily Averin and Pavel Tikhomirov discovered that the cleancache\nsubsystem of the Linux kernel did not properly initialize new files in\nsome situations. A local attacker could use this to expose sensitive\ninformation. (CVE-2018-16862)\n\nHui Peng and Mathias Payer discovered that the Option USB High Speed\ndriver in the Linux kernel did not properly validate metadata received\nfrom the device. A physically proximate attacker could use this to\ncause a denial of service (system crash). (CVE-2018-19985)\n\nHui Peng and Mathias Payer discovered that the USB subsystem in the\nLinux kernel did not properly handle size checks when handling an\nextra USB descriptor. A physically proximate attacker could use this\nto cause a denial of service (system crash). (CVE-2018-20169)\n\nZhipeng Xie discovered that an infinite loop could triggered in the\nCFS Linux kernel process scheduler. A local attacker could possibly\nuse this to cause a denial of service. (CVE-2018-20784)\n\nIt was discovered that a use-after-free error existed in the block\nlayer subsystem of the Linux kernel when certain failure conditions\noccurred. A local attacker could possibly use this to cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2018-20856)\n\nEli Biham and Lior Neumann discovered that the Bluetooth\nimplementation in the Linux kernel did not properly validate elliptic\ncurve parameters during Diffie-Hellman key exchange in some\nsituations. An attacker could use this to expose sensitive\ninformation. (CVE-2018-5383)\n\nIt was discovered that the Intel wifi device driver in the Linux\nkernel did not properly validate certain Tunneled Direct Link Setup\n(TDLS). A physically proximate attacker could use this to cause a\ndenial of service (wifi disconnect). (CVE-2019-0136)\n\nIt was discovered that a heap buffer overflow existed in the Marvell\nWireless LAN device driver for the Linux kernel. An attacker could use\nthis to cause a denial of service (system crash) or possibly execute\narbitrary code. (CVE-2019-10126)\n\nIt was discovered that the Bluetooth UART implementation in the Linux\nkernel did not properly check for missing tty operations. A local\nattacker could use this to cause a denial of service. (CVE-2019-10207)\n\nAmit Klein and Benny Pinkas discovered that the Linux kernel did not\nsufficiently randomize IP ID values generated for connectionless\nnetworking protocols. A remote attacker could use this to track\nparticular Linux devices. (CVE-2019-10638)\n\nAmit Klein and Benny Pinkas discovered that the location of kernel\naddresses could exposed by the implementation of connection-less\nnetwork protocols in the Linux kernel. A remote attacker could\npossibly use this to assist in the exploitation of another\nvulnerability in the Linux kernel. (CVE-2019-10639)\n\nAdam Zabrocki discovered that the Intel i915 kernel mode graphics\ndriver in the Linux kernel did not properly restrict mmap() ranges in\nsome situations. A local attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code.\n(CVE-2019-11085)\n\nIt was discovered that an integer overflow existed in the Linux kernel\nwhen reference counting pages, leading to potential use-after-free\nissues. A local attacker could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2019-11487)\n\nJann Horn discovered that a race condition existed in the Linux kernel\nwhen performing core dumps. A local attacker could use this to cause a\ndenial of service (system crash) or expose sensitive information.\n(CVE-2019-11599)\n\nIt was discovered that a NULL pointer dereference vulnerability\nexisted in the LSI Logic MegaRAID driver in the Linux kernel. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-11810)\n\nIt was discovered that a race condition leading to a use-after-free\nexisted in the Reliable Datagram Sockets (RDS) protocol implementation\nin the Linux kernel. The RDS protocol is blacklisted by default in\nUbuntu. If enabled, a local attacker could use this to cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2019-11815)\n\nIt was discovered that the ext4 file system implementation in the\nLinux kernel did not properly zero out memory in some situations. A\nlocal attacker could use this to expose sensitive information (kernel\nmemory). (CVE-2019-11833)\n\nIt was discovered that the Bluetooth Human Interface Device Protocol\n(HIDP) implementation in the Linux kernel did not properly verify\nstrings were NULL terminated in certain situations. A local attacker\ncould use this to expose sensitive information (kernel memory).\n(CVE-2019-11884)\n\nIt was discovered that a NULL pointer dereference vulnerabilty existed\nin the Near-field communication (NFC) implementation in the Linux\nkernel. An attacker could use this to cause a denial of service\n(system crash). (CVE-2019-12818)\n\nIt was discovered that the MDIO bus devices subsystem in the Linux\nkernel improperly dropped a device reference in an error condition,\nleading to a use-after-free. An attacker could use this to cause a\ndenial of service (system crash). (CVE-2019-12819)\n\nIt was discovered that a NULL pointer dereference vulnerability\nexisted in the Near-field communication (NFC) implementation in the\nLinux kernel. A local attacker could use this to cause a denial of\nservice (system crash). (CVE-2019-12984)\n\nJann Horn discovered a use-after-free vulnerability in the Linux\nkernel when accessing LDT entries in some situations. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2019-13233)\n\nJann Horn discovered that the ptrace implementation in the Linux\nkernel did not properly record credentials in some situations. A local\nattacker could use this to cause a denial of service (system crash) or\npossibly gain administrative privileges. (CVE-2019-13272)\n\nIt was discovered that the GTCO tablet input driver in the Linux\nkernel did not properly bounds check the initial HID report sent by\nthe device. A physically proximate attacker could use to cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2019-13631)\n\nIt was discovered that the floppy driver in the Linux kernel did not\nproperly validate meta data, leading to a buffer overread. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-14283)\n\nIt was discovered that the floppy driver in the Linux kernel did not\nproperly validate ioctl() calls, leading to a division-by-zero. A\nlocal attacker could use this to cause a denial of service (system\ncrash). (CVE-2019-14284)\n\nTuba Yavuz discovered that a race condition existed in the DesignWare\nUSB3 DRD Controller device driver in the Linux kernel. A physically\nproximate attacker could use this to cause a denial of service.\n(CVE-2019-14763)\n\nIt was discovered that an out-of-bounds read existed in the QLogic\nQEDI iSCSI Initiator Driver in the Linux kernel. A local attacker\ncould possibly use this to expose sensitive information (kernel\nmemory). (CVE-2019-15090)\n\nIt was discovered that the Raremono AM/FM/SW radio device driver in\nthe Linux kernel did not properly allocate memory, leading to a\nuse-after-free. A physically proximate attacker could use this to\ncause a denial of service or possibly execute arbitrary code.\n(CVE-2019-15211)\n\nIt was discovered at a double-free error existed in the USB Rio 500\ndevice driver for the Linux kernel. A physically proximate attacker\ncould use this to cause a denial of service. (CVE-2019-15212)\n\nIt was discovered that a race condition existed in the Advanced Linux\nSound Architecture (ALSA) subsystem of the Linux kernel, leading to a\npotential use-after-free. A physically proximate attacker could use\nthis to cause a denial of service (system crash) pro possibly execute\narbitrary code. (CVE-2019-15214)\n\nIt was discovered that a race condition existed in the CPiA2\nvideo4linux device driver for the Linux kernel, leading to a\nuse-after-free. A physically proximate attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2019-15215)\n\nIt was discovered that a race condition existed in the Softmac USB\nPrism54 device driver in the Linux kernel. A physically proximate\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-15220)\n\nIt was discovered that a use-after-free vulnerability existed in the\nAppletalk implementation in the Linux kernel if an error occurs during\ninitialization. A local attacker could use this to cause a denial of\nservice (system crash). (CVE-2019-15292)\n\nIt was discovered that the Empia EM28xx DVB USB device driver\nimplementation in the Linux kernel contained a use-after-free\nvulnerability when disconnecting the device. An attacker could use\nthis to cause a denial of service (system crash). (CVE-2019-2024)\n\nIt was discovered that the USB video device class implementation in\nthe Linux kernel did not properly validate control bits, resulting in\nan out of bounds buffer read. A local attacker could use this to\npossibly expose sensitive information (kernel memory). (CVE-2019-2101)\n\nIt was discovered that the Marvell Wireless LAN device driver in the\nLinux kernel did not properly validate the BSS descriptor. A local\nattacker could possibly use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2019-3846)\n\nJason Wang discovered that an infinite loop vulnerability existed in\nthe virtio net driver in the Linux kernel. A local attacker in a guest\nVM could possibly use this to cause a denial of service in the host\nsystem. (CVE-2019-3900)\n\nDaniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen\ndiscovered that the Bluetooth protocol BR/EDR specification did not\nproperly require sufficiently strong encryption key lengths. A\nphysicall proximate attacker could use this to expose sensitive\ninformation. (CVE-2019-9506)\n\nIt was discovered that the Appletalk IP encapsulation driver in the\nLinux kernel did not properly prevent kernel addresses from being\ncopied to user space. A local attacker with the CAP_NET_ADMIN\ncapability could use this to expose sensitive information.\n(CVE-2018-20511)\n\nIt was discovered that a race condition existed in the USB YUREX\ndevice driver in the Linux kernel. A physically proximate attacker\ncould use this to cause a denial of service (system crash).\n(CVE-2019-15216)\n\nIt was discovered that the Siano USB MDTV receiver device driver in\nthe Linux kernel made improper assumptions about the device\ncharacteristics. A physically proximate attacker could use this cause\na denial of service (system crash). (CVE-2019-15218)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux\nkernel did not properly validate data size information from the\ndevice. A physically proximate attacker could use this to cause a\ndenial of service (system crash). (CVE-2019-15221)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in\nsome situations did not properly restrict the field size when\nprocessing outgoing frames. A local attacker with CAP_NET_ADMIN\nprivileges could use this to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux\nkernel's HID subsystem did not properly validate passed parameters in\nsome situations. A local privileged attacker could use this to cause a\ndenial of service (infinite loop). (CVE-2019-3819).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/4118-1/\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Update the affected linux-image-4.15-aws, linux-image-aws and / or\nlinux-image-aws-hwe packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Linux Polkit pkexec helper PTRACE_TRACEME local root exploit');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws-hwe\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/07/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/09/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/09/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2019-2021 Canonical, Inc. / NASL script (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04|18\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04 / 18.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECK
CVE-2019-3819
