Fedora Update for kernel-headers FEDORA-2019-337484d88b
2019-01-15T00:00:00
ID OPENVAS:1361412562310875404 Type openvas Reporter Copyright (C) 2019 Greenbone Networks GmbH Modified 2019-05-20T00:00:00
Description
The remote host is missing an update for
the
###############################################################################
# OpenVAS Vulnerability Test
#
# Fedora Update for kernel-headers FEDORA-2019-337484d88b
#
# Authors:
# System Generated Check
#
# Copyright:
# Copyright (C) 2019 Greenbone Networks GmbH, http://www.greenbone.net
# Text descriptions are largely excerpted from the referenced
# advisory, and are Copyright (c) the respective author(s)
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2
# (or any later version), as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
###############################################################################
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.875404");
script_version("2019-05-20T06:45:30+0000");
script_cve_id("CVE-2019-3701");
script_tag(name:"cvss_base", value:"4.9");
script_tag(name:"cvss_base_vector", value:"AV:L/AC:L/Au:N/C:N/I:N/A:C");
script_tag(name:"last_modification", value:"2019-05-20 06:45:30 +0000 (Mon, 20 May 2019)");
script_tag(name:"creation_date", value:"2019-01-15 04:01:41 +0100 (Tue, 15 Jan 2019)");
script_name("Fedora Update for kernel-headers FEDORA-2019-337484d88b");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2019 Greenbone Networks GmbH");
script_family("Fedora Local Security Checks");
script_dependencies("gather-package-list.nasl");
script_mandatory_keys("ssh/login/fedora", "ssh/login/rpms", re:"ssh/login/release=FC28");
script_xref(name:"FEDORA", value:"2019-337484d88b");
script_xref(name:"URL", value:"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GRRDIQFD2RTAZ5D555Q4TNISROVK7FDC");
script_tag(name:"summary", value:"The remote host is missing an update for
the 'kernel-headers' package(s) announced via the FEDORA-2019-337484d88b advisory.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present
on the target host.");
script_tag(name:"affected", value:"kernel-headers on Fedora 28.");
script_tag(name:"solution", value:"Please install the updated package(s).");
script_tag(name:"solution_type", value:"VendorFix");
script_tag(name:"qod_type", value:"package");
exit(0);
}
include("revisions-lib.inc");
include("pkg-lib-rpm.inc");
release = rpm_get_ssh_release();
if(!release)
exit(0);
res = "";
if(release == "FC28")
{
if ((res = isrpmvuln(pkg:"kernel-headers", rpm:"kernel-headers~4.19.14~200.fc28", rls:"FC28")) != NULL)
{
security_message(data:res);
exit(0);
}
if (__pkg_match) exit(99);
exit(0);
}
{"id": "OPENVAS:1361412562310875404", "type": "openvas", "bulletinFamily": "scanner", "title": "Fedora Update for kernel-headers FEDORA-2019-337484d88b", "description": "The remote host is missing an update for\n the ", "published": "2019-01-15T00:00:00", "modified": "2019-05-20T00:00:00", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875404", "reporter": "Copyright (C) 2019 Greenbone Networks GmbH", "references": ["2019-337484d88b", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GRRDIQFD2RTAZ5D555Q4TNISROVK7FDC"], "cvelist": ["CVE-2019-3701"], "lastseen": "2019-05-29T18:32:12", "viewCount": 51, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2019-3701"]}, {"type": "f5", "idList": ["F5:K17957133"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310875628", "OPENVAS:1361412562310875834", "OPENVAS:1361412562311220191234", "OPENVAS:1361412562310875946", "OPENVAS:1361412562310875406", "OPENVAS:1361412562311220191259", "OPENVAS:1361412562310853121", "OPENVAS:1361412562311220191131", "OPENVAS:1361412562310875801", "OPENVAS:1361412562311220191028"]}, {"type": "nessus", "idList": ["EULEROS_SA-2019-1259.NASL", "ORACLELINUX_ELSA-2019-4612.NASL", "ORACLELINUX_ELSA-2019-4600.NASL", "SUSE_SU-2020-1146-1.NASL", "ORACLEVM_OVMSA-2019-0014.NASL", "OPENSUSE-2020-543.NASL", "EULEROS_SA-2019-1234.NASL", "FEDORA_2019-337484D88B.NASL", "ORACLELINUX_ELSA-2019-4596.NASL", "FEDORA_2019-B0F7A7B74B.NASL"]}, {"type": "fedora", "idList": ["FEDORA:F417F60477C5", "FEDORA:D2B426045A04", "FEDORA:AAA6460491BA", "FEDORA:5B68260A5858", "FEDORA:5956060491DC", "FEDORA:E88866014636", "FEDORA:DBB1B659CBE0", "FEDORA:296826040AED", "FEDORA:8FD3E60491BA", "FEDORA:EF6BA6045A0C"]}, {"type": "oraclelinux", "idList": ["ELSA-2019-4596", "ELSA-2019-4612", "ELSA-2019-4600"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2020:0543-1"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1771-1:3CE68", "DEBIAN:DLA-1731-1:D19BD", "DEBIAN:DLA-1731-2:E6E1E"]}, {"type": "ubuntu", "idList": ["USN-4115-2", "USN-3932-1", "USN-4115-1", "USN-3932-2"]}, {"type": "cloudfoundry", "idList": ["CFOUNDRY:BD71AB043932448695E8B3D20302D582", "CFOUNDRY:A005A5D22D18F966EBF6C011F833E895", "CFOUNDRY:63AC599C6730C4293761CECD360AA195"]}, {"type": "slackware", "idList": ["SSA-2019-030-01"]}], "modified": "2019-05-29T18:32:12", "rev": 2}, "score": {"value": 7.1, "vector": "NONE", "modified": "2019-05-29T18:32:12", "rev": 2}, "vulnersScore": 7.1}, "pluginID": "1361412562310875404", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for kernel-headers FEDORA-2019-337484d88b\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2019 Greenbone Networks GmbH, http://www.greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875404\");\n script_version(\"2019-05-20T06:45:30+0000\");\n script_cve_id(\"CVE-2019-3701\");\n script_tag(name:\"cvss_base\", value:\"4.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-05-20 06:45:30 +0000 (Mon, 20 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-01-15 04:01:41 +0100 (Tue, 15 Jan 2019)\");\n script_name(\"Fedora Update for kernel-headers FEDORA-2019-337484d88b\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC28\");\n\n script_xref(name:\"FEDORA\", value:\"2019-337484d88b\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GRRDIQFD2RTAZ5D555Q4TNISROVK7FDC\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for\n the 'kernel-headers' package(s) announced via the FEDORA-2019-337484d88b advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present\n on the target host.\");\n\n script_tag(name:\"affected\", value:\"kernel-headers on Fedora 28.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC28\")\n{\n\n if ((res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~4.19.14~200.fc28\", rls:\"FC28\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "naslFamily": "Fedora Local Security Checks"}
{"cve": [{"lastseen": "2020-12-09T21:41:52", "description": "An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. The privileged user \"root\" with CAP_NET_ADMIN can create a CAN frame modification rule that makes the data length code a higher value than the available CAN frame data size. In combination with a configured checksum calculation where the result is stored relatively to the end of the data (e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in skb_shared_info) can be rewritten which finally can cause a system crash. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames.", "edition": 7, "cvss3": {"exploitabilityScore": 0.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 4.4, "privilegesRequired": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2019-01-03T16:29:00", "title": "CVE-2019-3701", "type": "cve", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 4.9, "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-3701"], "modified": "2019-09-03T00:15:00", "cpe": ["cpe:/o:debian:debian_linux:8.0", "cpe:/o:canonical:ubuntu_linux:16.04", "cpe:/o:canonical:ubuntu_linux:14.04", "cpe:/o:linux:linux_kernel:4.19.13"], "id": "CVE-2019-3701", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-3701", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:4.19.13:*:*:*:*:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*"]}], "f5": [{"lastseen": "2020-04-06T22:40:03", "bulletinFamily": "software", "cvelist": ["CVE-2019-3701"], "description": "\nF5 Product Development has evaluated the currently supported releases for potential vulnerability, and no F5 products were found to be vulnerable.\n\nNone\n\n * [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>)\n * [K41942608: Overview of AskF5 Security Advisory articles](<https://support.f5.com/csp/article/K41942608>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n", "edition": 1, "modified": "2019-04-12T16:43:00", "published": "2019-04-12T16:43:00", "id": "F5:K17957133", "href": "https://support.f5.com/csp/article/K17957133", "title": "Linux kernel vulnerability CVE-2019-3701", "type": "f5", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}], "nessus": [{"lastseen": "2020-03-18T00:02:24", "description": "The v4.19.14 stable update contains important fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 10, "cvss3": {"score": 4.4, "vector": "AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-01-15T00:00:00", "title": "Fedora 29 : kernel / kernel-headers / kernel-tools (2019-b0f7a7b74b)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-3701"], "modified": "2019-01-15T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel", "cpe:/o:fedoraproject:fedora:29", "p-cpe:/a:fedoraproject:fedora:kernel-tools", "p-cpe:/a:fedoraproject:fedora:kernel-headers"], "id": "FEDORA_2019-B0F7A7B74B.NASL", "href": "https://www.tenable.com/plugins/nessus/121171", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2019-b0f7a7b74b.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(121171);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/02/24\");\n\n script_cve_id(\"CVE-2019-3701\");\n script_xref(name:\"FEDORA\", value:\"2019-b0f7a7b74b\");\n\n script_name(english:\"Fedora 29 : kernel / kernel-headers / kernel-tools (2019-b0f7a7b74b)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The v4.19.14 stable update contains important fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2019-b0f7a7b74b\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected kernel, kernel-headers and / or kernel-tools\npackages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:29\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/01/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/01/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^29([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 29\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2019-3701\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for FEDORA-2019-b0f7a7b74b\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\nif (rpm_check(release:\"FC29\", reference:\"kernel-4.19.14-300.fc29\")) flag++;\nif (rpm_check(release:\"FC29\", reference:\"kernel-headers-4.19.14-300.fc29\")) flag++;\nif (rpm_check(release:\"FC29\", reference:\"kernel-tools-4.19.14-300.fc29\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel / kernel-headers / kernel-tools\");\n}\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-03-17T23:50:09", "description": "The v4.19.14 stable update contains important fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 10, "cvss3": {"score": 4.4, "vector": "AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-01-15T00:00:00", "title": "Fedora 28 : kernel / kernel-headers / kernel-tools (2019-337484d88b)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-3701"], "modified": "2019-01-15T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel", "p-cpe:/a:fedoraproject:fedora:kernel-tools", "p-cpe:/a:fedoraproject:fedora:kernel-headers", "cpe:/o:fedoraproject:fedora:28"], "id": "FEDORA_2019-337484D88B.NASL", "href": "https://www.tenable.com/plugins/nessus/121170", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2019-337484d88b.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(121170);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/02/24\");\n\n script_cve_id(\"CVE-2019-3701\");\n script_xref(name:\"FEDORA\", value:\"2019-337484d88b\");\n\n script_name(english:\"Fedora 28 : kernel / kernel-headers / kernel-tools (2019-337484d88b)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The v4.19.14 stable update contains important fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2019-337484d88b\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected kernel, kernel-headers and / or kernel-tools\npackages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:28\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/01/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/01/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^28([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 28\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2019-3701\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for FEDORA-2019-337484d88b\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\nif (rpm_check(release:\"FC28\", reference:\"kernel-4.19.14-200.fc28\")) flag++;\nif (rpm_check(release:\"FC28\", reference:\"kernel-headers-4.19.14-200.fc28\")) flag++;\nif (rpm_check(release:\"FC28\", reference:\"kernel-tools-4.19.14-200.fc28\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel / kernel-headers / kernel-tools\");\n}\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-07T08:55:14", "description": "According to the versions of the kernel packages installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - An issue was discovered in can_can_gw_rcv() in the\n net/can/gw.c in the Linux kernel. The CAN driver may\n write arbitrary content beyond the data registers in\n the CAN controller's I/O memory when processing can-gw\n manipulated outgoing frames because of a missing check.\n A local user with CAP_NET_ADMIN capability granted in\n the initial namespace can exploit this vulnerability to\n cause a system crash and thus a denial of service\n (DoS).i1/4^CVE-2019-3701i1/4%0\n\n - A flaw was found in the Linux kernel in the function\n hso_probe() which reads if_num value from the USB\n device (as an u8) and uses it without a length check to\n index an array, resulting in an OOB memory read in\n hso_probe() or hso_get_config_data(). An attacker with\n a forged USB device and physical access to a system\n (needed to connect such a device) can cause a system\n crash and a denial of service.i1/4^CVE-2018-19985i1/4%0\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 11, "cvss3": {"score": 4.6, "vector": "AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "published": "2019-04-04T00:00:00", "title": "EulerOS Virtualization 2.5.4 : kernel (EulerOS-SA-2019-1234)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-3701", "CVE-2018-19985"], "modified": "2019-04-04T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-tools-libs-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "cpe:/o:huawei:euleros:uvp:2.5.4"], "id": "EULEROS_SA-2019-1234.NASL", "href": "https://www.tenable.com/plugins/nessus/123702", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(123702);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2018-19985\",\n \"CVE-2019-3701\"\n );\n\n script_name(english:\"EulerOS Virtualization 2.5.4 : kernel (EulerOS-SA-2019-1234)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - An issue was discovered in can_can_gw_rcv() in the\n net/can/gw.c in the Linux kernel. The CAN driver may\n write arbitrary content beyond the data registers in\n the CAN controller's I/O memory when processing can-gw\n manipulated outgoing frames because of a missing check.\n A local user with CAP_NET_ADMIN capability granted in\n the initial namespace can exploit this vulnerability to\n cause a system crash and thus a denial of service\n (DoS).i1/4^CVE-2019-3701i1/4%0\n\n - A flaw was found in the Linux kernel in the function\n hso_probe() which reads if_num value from the USB\n device (as an u8) and uses it without a length check to\n index an array, resulting in an OOB memory read in\n hso_probe() or hso_get_config_data(). An attacker with\n a forged USB device and physical access to a system\n (needed to connect such a device) can cause a system\n crash and a denial of service.i1/4^CVE-2018-19985i1/4%0\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1234\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?482cb2f8\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-19985\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/04/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:2.5.4\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"2.5.4\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 2.5.4\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-3.10.0-862.14.1.1_58\",\n \"kernel-devel-3.10.0-862.14.1.1_58\",\n \"kernel-headers-3.10.0-862.14.1.1_58\",\n \"kernel-tools-3.10.0-862.14.1.1_58\",\n \"kernel-tools-libs-3.10.0-862.14.1.1_58\",\n \"kernel-tools-libs-devel-3.10.0-862.14.1.1_58\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-01-01T04:47:10", "description": "Description of changes:\n\n[4.1.12-124.26.7.el7uek]\n- ib_core: initialize shpd field when allocating 'struct ib_pd' (Mukesh \nKacker) [Orabug: 29384815] - Revert 'x86/apic: Make arch_setup_hwirq \nNUMA node aware' (Brian Maly) [Orabug: 29542185] - qlcnic: fix Tx \ndescriptor corruption on 82xx devices (Shahed Shaikh) [Orabug: 27708787] \n- block: Fix a race between blk_cleanup_queue() and timeout handling \n(Bart Van Assche) [Orabug: 29158186] - can: gw: ensure DLC boundaries \nafter CAN frame modification (Oliver Hartkopp) [Orabug: 29215299] \n{CVE-2019-3701} {CVE-2019-3701}\n- CIFS: Enable encryption during session setup phase (Pavel Shilovsky) \n[Orabug: 29338239] {CVE-2018-1066}\n- ext4: clear i_data in ext4_inode_info when removing inline data \n(Theodore Ts'o) [Orabug: 29540709] {CVE-2018-10881} {CVE-2018-10881}\n- ext4: add more inode number paranoia checks (Theodore Ts'o) [Orabug: \n29545566] {CVE-2018-10882} {CVE-2018-10882}\n- Revert 'KVM: nVMX: Eliminate vmcs02 pool' (Boris Ostrovsky) [Orabug: \n29542029] - Revert 'KVM: VMX: introduce alloc_loaded_vmcs' (Boris \nOstrovsky) [Orabug: 29542029] - Revert 'KVM: VMX: make MSR bitmaps \nper-VCPU' (Boris Ostrovsky) [Orabug: 29542029] - Revert 'KVM: x86: pass \nhost_initiated to functions that read MSRs' (Boris Ostrovsky) [Orabug: \n29542029] - Revert 'KVM/x86: Add IBPB support' (Boris Ostrovsky) \n[Orabug: 29542029] - Revert 'KVM/VMX: Allow direct access to \nMSR_IA32_SPEC_CTRL - reloaded' (Boris Ostrovsky) [Orabug: 29542029] - \nRevert 'KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL' (Boris \nOstrovsky) [Orabug: 29542029] - Revert 'KVM: SVM: Add MSR-based feature \nsupport for serializing LFENCE' (Boris Ostrovsky) [Orabug: 29542029] - \nRevert 'x86/cpufeatures: rename X86_FEATURE_AMD_SSBD to \nX86_FEATURE_LS_CFG_SSBD' (Boris Ostrovsky) [Orabug: 29542029] - Revert \n'x86/bugs: Add AMD's SPEC_CTRL MSR usage' (Boris Ostrovsky) [Orabug: \n29542029] - Revert 'x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL \nMSR' (Boris Ostrovsky) [Orabug: 29542029] - arch: x86: remove unsued \nSET_IBPB from spec_ctrl.h (Mihai Carabas) [Orabug: 29336760] - x86: cpu: \nmicrocode: fix late loading SpectreV2 bugs eval (Mihai Carabas) [Orabug: \n29336760] - x86: cpu: microcode: fix late loading SSBD and L1TF bugs \neval (Mihai Carabas) [Orabug: 29336760] - x86: cpu: microcode: \nRe-evaluate bugs in a CPU after microcode loading (Mihai Carabas) \n[Orabug: 29336760] - x86: cpu: microcode: update flags for all cpus \n(Mihai Carabas) [Orabug: 29336760]\n\n[4.1.12-124.26.6.el7uek]\n- x86/apic: Make arch_setup_hwirq NUMA node aware (Henry Willard) \n[Orabug: 29292411]", "edition": 18, "cvss3": {"score": 6.5, "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "published": "2019-04-02T00:00:00", "title": "Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4596)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-10882", "CVE-2018-1066", "CVE-2018-10881", "CVE-2019-3701"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/o:oracle:linux:6", "p-cpe:/a:oracle:linux:kernel-uek-firmware", "p-cpe:/a:oracle:linux:kernel-uek-doc", "p-cpe:/a:oracle:linux:kernel-uek", "p-cpe:/a:oracle:linux:kernel-uek-debug-devel", "p-cpe:/a:oracle:linux:kernel-uek-devel", "cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:kernel-uek-debug"], "id": "ORACLELINUX_ELSA-2019-4596.NASL", "href": "https://www.tenable.com/plugins/nessus/123631", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2019-4596.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(123631);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2020/01/27\");\n\n script_cve_id(\"CVE-2018-1066\", \"CVE-2018-10881\", \"CVE-2018-10882\", \"CVE-2019-3701\");\n\n script_name(english:\"Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4596)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Description of changes:\n\n[4.1.12-124.26.7.el7uek]\n- ib_core: initialize shpd field when allocating 'struct ib_pd' (Mukesh \nKacker) [Orabug: 29384815] - Revert 'x86/apic: Make arch_setup_hwirq \nNUMA node aware' (Brian Maly) [Orabug: 29542185] - qlcnic: fix Tx \ndescriptor corruption on 82xx devices (Shahed Shaikh) [Orabug: 27708787] \n- block: Fix a race between blk_cleanup_queue() and timeout handling \n(Bart Van Assche) [Orabug: 29158186] - can: gw: ensure DLC boundaries \nafter CAN frame modification (Oliver Hartkopp) [Orabug: 29215299] \n{CVE-2019-3701} {CVE-2019-3701}\n- CIFS: Enable encryption during session setup phase (Pavel Shilovsky) \n[Orabug: 29338239] {CVE-2018-1066}\n- ext4: clear i_data in ext4_inode_info when removing inline data \n(Theodore Ts'o) [Orabug: 29540709] {CVE-2018-10881} {CVE-2018-10881}\n- ext4: add more inode number paranoia checks (Theodore Ts'o) [Orabug: \n29545566] {CVE-2018-10882} {CVE-2018-10882}\n- Revert 'KVM: nVMX: Eliminate vmcs02 pool' (Boris Ostrovsky) [Orabug: \n29542029] - Revert 'KVM: VMX: introduce alloc_loaded_vmcs' (Boris \nOstrovsky) [Orabug: 29542029] - Revert 'KVM: VMX: make MSR bitmaps \nper-VCPU' (Boris Ostrovsky) [Orabug: 29542029] - Revert 'KVM: x86: pass \nhost_initiated to functions that read MSRs' (Boris Ostrovsky) [Orabug: \n29542029] - Revert 'KVM/x86: Add IBPB support' (Boris Ostrovsky) \n[Orabug: 29542029] - Revert 'KVM/VMX: Allow direct access to \nMSR_IA32_SPEC_CTRL - reloaded' (Boris Ostrovsky) [Orabug: 29542029] - \nRevert 'KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL' (Boris \nOstrovsky) [Orabug: 29542029] - Revert 'KVM: SVM: Add MSR-based feature \nsupport for serializing LFENCE' (Boris Ostrovsky) [Orabug: 29542029] - \nRevert 'x86/cpufeatures: rename X86_FEATURE_AMD_SSBD to \nX86_FEATURE_LS_CFG_SSBD' (Boris Ostrovsky) [Orabug: 29542029] - Revert \n'x86/bugs: Add AMD's SPEC_CTRL MSR usage' (Boris Ostrovsky) [Orabug: \n29542029] - Revert 'x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL \nMSR' (Boris Ostrovsky) [Orabug: 29542029] - arch: x86: remove unsued \nSET_IBPB from spec_ctrl.h (Mihai Carabas) [Orabug: 29336760] - x86: cpu: \nmicrocode: fix late loading SpectreV2 bugs eval (Mihai Carabas) [Orabug: \n29336760] - x86: cpu: microcode: fix late loading SSBD and L1TF bugs \neval (Mihai Carabas) [Orabug: 29336760] - x86: cpu: microcode: \nRe-evaluate bugs in a CPU after microcode loading (Mihai Carabas) \n[Orabug: 29336760] - x86: cpu: microcode: update flags for all cpus \n(Mihai Carabas) [Orabug: 29336760]\n\n[4.1.12-124.26.6.el7uek]\n- x86/apic: Make arch_setup_hwirq NUMA node aware (Henry Willard) \n[Orabug: 29292411]\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2019-April/008616.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2019-April/008617.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected unbreakable enterprise kernel packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-firmware\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/03/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/04/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 6 / 7\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2018-1066\", \"CVE-2018-10881\", \"CVE-2018-10882\", \"CVE-2019-3701\"); \n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for ELSA-2019-4596\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nkernel_major_minor = get_kb_item(\"Host/uname/major_minor\");\nif (empty_or_null(kernel_major_minor)) exit(1, \"Unable to determine kernel major-minor level.\");\nexpected_kernel_major_minor = \"4.1\";\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, \"running kernel level \" + expected_kernel_major_minor + \", it is running kernel level \" + kernel_major_minor);\n\nflag = 0;\nif (rpm_exists(release:\"EL6\", rpm:\"kernel-uek-4.1.12\") && rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"kernel-uek-4.1.12-124.26.7.el6uek\")) flag++;\nif (rpm_exists(release:\"EL6\", rpm:\"kernel-uek-debug-4.1.12\") && rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"kernel-uek-debug-4.1.12-124.26.7.el6uek\")) flag++;\nif (rpm_exists(release:\"EL6\", rpm:\"kernel-uek-debug-devel-4.1.12\") && rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"kernel-uek-debug-devel-4.1.12-124.26.7.el6uek\")) flag++;\nif (rpm_exists(release:\"EL6\", rpm:\"kernel-uek-devel-4.1.12\") && rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"kernel-uek-devel-4.1.12-124.26.7.el6uek\")) flag++;\nif (rpm_exists(release:\"EL6\", rpm:\"kernel-uek-doc-4.1.12\") && rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"kernel-uek-doc-4.1.12-124.26.7.el6uek\")) flag++;\nif (rpm_exists(release:\"EL6\", rpm:\"kernel-uek-firmware-4.1.12\") && rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"kernel-uek-firmware-4.1.12-124.26.7.el6uek\")) flag++;\n\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-4.1.12\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-4.1.12-124.26.7.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-debug-4.1.12\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-debug-4.1.12-124.26.7.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-debug-devel-4.1.12\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-debug-devel-4.1.12-124.26.7.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-devel-4.1.12\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-devel-4.1.12-124.26.7.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-doc-4.1.12\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-doc-4.1.12-124.26.7.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-firmware-4.1.12\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-firmware-4.1.12-124.26.7.el7uek\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"affected kernel\");\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-01T04:53:13", "description": "The remote OracleVM system is missing necessary patches to address\ncritical security updates :\n\n - ib_core: initialize shpd field when allocating 'struct\n ib_pd' (Mukesh Kacker) [Orabug: 29384815]\n\n - Revert 'x86/apic: Make arch_setup_hwirq NUMA node aware'\n (Brian Maly) [Orabug: 29542185]\n\n - qlcnic: fix Tx descriptor corruption on 82xx devices\n (Shahed Shaikh) [Orabug: 27708787]\n\n - block: Fix a race between blk_cleanup_queue and timeout\n handling (Bart Van Assche) [Orabug: 29158186]\n\n - can: gw: ensure DLC boundaries after CAN frame\n modification (Oliver Hartkopp) [Orabug: 29215299]\n (CVE-2019-3701) (CVE-2019-3701)\n\n - CIFS: Enable encryption during session setup phase\n (Pavel Shilovsky) [Orabug: 29338239] (CVE-2018-1066)\n\n - ext4: clear i_data in ext4_inode_info when removing\n inline data (Theodore Ts'o) [Orabug: 29540709]\n (CVE-2018-10881) (CVE-2018-10881)\n\n - ext4: add more inode number paranoia checks (Theodore\n Ts'o) [Orabug: 29545566] (CVE-2018-10882)\n (CVE-2018-10882)\n\n - Revert 'KVM: nVMX: Eliminate vmcs02 pool' (Boris\n Ostrovsky) [Orabug: 29542029]\n\n - Revert 'KVM: VMX: introduce alloc_loaded_vmcs' (Boris\n Ostrovsky) [Orabug: 29542029]\n\n - Revert 'KVM: VMX: make MSR bitmaps per-VCPU' (Boris\n Ostrovsky) [Orabug: 29542029]\n\n - Revert 'KVM: x86: pass host_initiated to functions that\n read MSRs' (Boris Ostrovsky) [Orabug: 29542029]\n\n - Revert 'KVM/x86: Add IBPB support' (Boris Ostrovsky)\n [Orabug: 29542029]\n\n - Revert 'KVM/VMX: Allow direct access to\n MSR_IA32_SPEC_CTRL - reloaded' (Boris Ostrovsky)\n [Orabug: 29542029]\n\n - Revert 'KVM/SVM: Allow direct access to\n MSR_IA32_SPEC_CTRL' (Boris Ostrovsky) [Orabug: 29542029]\n\n - Revert 'KVM: SVM: Add MSR-based feature support for\n serializing LFENCE' (Boris Ostrovsky) [Orabug: 29542029]\n\n - Revert 'x86/cpufeatures: rename X86_FEATURE_AMD_SSBD to\n X86_FEATURE_LS_CFG_SSBD' (Boris Ostrovsky) [Orabug:\n 29542029]\n\n - Revert 'x86/bugs: Add AMD's SPEC_CTRL MSR usage' (Boris\n Ostrovsky) [Orabug: 29542029]\n\n - Revert 'x86/bugs: Fix the AMD SSBD usage of the\n SPEC_CTRL MSR' (Boris Ostrovsky) [Orabug: 29542029]\n\n - arch: x86: remove unsued SET_IBPB from spec_ctrl.h\n (Mihai Carabas) [Orabug: 29336760]\n\n - x86: cpu: microcode: fix late loading SpectreV2 bugs\n eval (Mihai Carabas) [Orabug: 29336760]\n\n - x86: cpu: microcode: fix late loading SSBD and L1TF bugs\n eval (Mihai Carabas) [Orabug: 29336760]\n\n - x86: cpu: microcode: Re-evaluate bugs in a CPU after\n microcode loading (Mihai Carabas) [Orabug: 29336760]\n\n - x86: cpu: microcode: update flags for all cpus (Mihai\n Carabas) [Orabug: 29336760]\n\n - x86/apic: Make arch_setup_hwirq NUMA node aware (Henry\n Willard) [Orabug: 29292411]", "edition": 18, "cvss3": {"score": 6.5, "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "published": "2019-05-06T00:00:00", "title": "OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0014)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-10882", "CVE-2018-1066", "CVE-2018-10881", "CVE-2019-3701"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/o:oracle:vm_server:3.4", "p-cpe:/a:oracle:vm:kernel-uek", "p-cpe:/a:oracle:vm:kernel-uek-firmware"], "id": "ORACLEVM_OVMSA-2019-0014.NASL", "href": "https://www.tenable.com/plugins/nessus/124637", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from OracleVM\n# Security Advisory OVMSA-2019-0014.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(124637);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2020/01/21\");\n\n script_cve_id(\"CVE-2018-1066\", \"CVE-2018-10881\", \"CVE-2018-10882\", \"CVE-2019-3701\");\n\n script_name(english:\"OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0014)\");\n script_summary(english:\"Checks the RPM output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote OracleVM host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote OracleVM system is missing necessary patches to address\ncritical security updates :\n\n - ib_core: initialize shpd field when allocating 'struct\n ib_pd' (Mukesh Kacker) [Orabug: 29384815]\n\n - Revert 'x86/apic: Make arch_setup_hwirq NUMA node aware'\n (Brian Maly) [Orabug: 29542185]\n\n - qlcnic: fix Tx descriptor corruption on 82xx devices\n (Shahed Shaikh) [Orabug: 27708787]\n\n - block: Fix a race between blk_cleanup_queue and timeout\n handling (Bart Van Assche) [Orabug: 29158186]\n\n - can: gw: ensure DLC boundaries after CAN frame\n modification (Oliver Hartkopp) [Orabug: 29215299]\n (CVE-2019-3701) (CVE-2019-3701)\n\n - CIFS: Enable encryption during session setup phase\n (Pavel Shilovsky) [Orabug: 29338239] (CVE-2018-1066)\n\n - ext4: clear i_data in ext4_inode_info when removing\n inline data (Theodore Ts'o) [Orabug: 29540709]\n (CVE-2018-10881) (CVE-2018-10881)\n\n - ext4: add more inode number paranoia checks (Theodore\n Ts'o) [Orabug: 29545566] (CVE-2018-10882)\n (CVE-2018-10882)\n\n - Revert 'KVM: nVMX: Eliminate vmcs02 pool' (Boris\n Ostrovsky) [Orabug: 29542029]\n\n - Revert 'KVM: VMX: introduce alloc_loaded_vmcs' (Boris\n Ostrovsky) [Orabug: 29542029]\n\n - Revert 'KVM: VMX: make MSR bitmaps per-VCPU' (Boris\n Ostrovsky) [Orabug: 29542029]\n\n - Revert 'KVM: x86: pass host_initiated to functions that\n read MSRs' (Boris Ostrovsky) [Orabug: 29542029]\n\n - Revert 'KVM/x86: Add IBPB support' (Boris Ostrovsky)\n [Orabug: 29542029]\n\n - Revert 'KVM/VMX: Allow direct access to\n MSR_IA32_SPEC_CTRL - reloaded' (Boris Ostrovsky)\n [Orabug: 29542029]\n\n - Revert 'KVM/SVM: Allow direct access to\n MSR_IA32_SPEC_CTRL' (Boris Ostrovsky) [Orabug: 29542029]\n\n - Revert 'KVM: SVM: Add MSR-based feature support for\n serializing LFENCE' (Boris Ostrovsky) [Orabug: 29542029]\n\n - Revert 'x86/cpufeatures: rename X86_FEATURE_AMD_SSBD to\n X86_FEATURE_LS_CFG_SSBD' (Boris Ostrovsky) [Orabug:\n 29542029]\n\n - Revert 'x86/bugs: Add AMD's SPEC_CTRL MSR usage' (Boris\n Ostrovsky) [Orabug: 29542029]\n\n - Revert 'x86/bugs: Fix the AMD SSBD usage of the\n SPEC_CTRL MSR' (Boris Ostrovsky) [Orabug: 29542029]\n\n - arch: x86: remove unsued SET_IBPB from spec_ctrl.h\n (Mihai Carabas) [Orabug: 29336760]\n\n - x86: cpu: microcode: fix late loading SpectreV2 bugs\n eval (Mihai Carabas) [Orabug: 29336760]\n\n - x86: cpu: microcode: fix late loading SSBD and L1TF bugs\n eval (Mihai Carabas) [Orabug: 29336760]\n\n - x86: cpu: microcode: Re-evaluate bugs in a CPU after\n microcode loading (Mihai Carabas) [Orabug: 29336760]\n\n - x86: cpu: microcode: update flags for all cpus (Mihai\n Carabas) [Orabug: 29336760]\n\n - x86/apic: Make arch_setup_hwirq NUMA node aware (Henry\n Willard) [Orabug: 29292411]\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/oraclevm-errata/2019-May/000936.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel-uek / kernel-uek-firmware packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:kernel-uek-firmware\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:vm_server:3.4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/03/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/06\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"OracleVM Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleVM/release\", \"Host/OracleVM/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/OracleVM/release\");\nif (isnull(release) || \"OVS\" >!< release) audit(AUDIT_OS_NOT, \"OracleVM\");\nif (! preg(pattern:\"^OVS\" + \"3\\.4\" + \"(\\.[0-9]|$)\", string:release)) audit(AUDIT_OS_NOT, \"OracleVM 3.4\", \"OracleVM \" + release);\nif (!get_kb_item(\"Host/OracleVM/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"OracleVM\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"OVS3.4\", reference:\"kernel-uek-4.1.12-124.26.7.el6uek\")) flag++;\nif (rpm_check(release:\"OVS3.4\", reference:\"kernel-uek-firmware-4.1.12-124.26.7.el6uek\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel-uek / kernel-uek-firmware\");\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-01T04:47:11", "description": "Description of changes:\n\nkernel-uek\n[3.8.13-118.32.1.el7uek]\n- x86/fpu: Factor out memset(xstate, 0) in fpu_finit() paths (Oleg \nNesterov) [Orabug: 29012034]\n- x86/fpu: Always allow FPU in interrupt if use_eager_fpu() (Oleg \nNesterov) [Orabug: 29012034]\n- x86/fpu: Fix 32-bit signal frame handling (Dave Hansen) [Orabug: 29012034]\n- x86/fpu: Don't do __thread_fpu_end() if use_eager_fpu() (Oleg \nNesterov) [Orabug: 29012034]\n- x86/fpu: Don't reset fpu_counter (Oleg Nesterov) [Orabug: 29012034]\n- x86, fpu: Fix math_state_restore() race with kernel_fpu_begin() (Oleg \nNesterov) [Orabug: 29012034]\n- x86, fpu: Introduce per-cpu in_kernel_fpu state (Oleg Nesterov) \n[Orabug: 29012034]\n- x86, fpu: Don't abuse has_fpu in __kernel_fpu_begin/end() (Oleg \nNesterov) [Orabug: 29012034]\n- x86: Allow FPU to be used at interrupt time even with eagerfpu (Pekka \nRiikonen) [Orabug: 29012034]\n- can: gw: ensure DLC boundaries after CAN frame modification (Oliver \nHartkopp) [Orabug: 29215300] {CVE-2019-3701} {CVE-2019-3701}\n- ext4: verify the depth of extent tree in ext4_find_extent() (Theodore \nTs'o) [Orabug: 29396713] {CVE-2018-10877} {CVE-2018-10877}\n- ext4: always verify the magic number in xattr blocks (Theodore Ts'o) \n[Orabug: 29437128] {CVE-2018-10879} {CVE-2018-10879}\n- ext4: add corruption check in ext4_xattr_set_entry() (Theodore Ts'o) \n[Orabug: 29437128] {CVE-2018-10879} {CVE-2018-10879}\n- ext4: clear i_data in ext4_inode_info when removing inline data \n(Theodore Ts'o) [Orabug: 29540710] {CVE-2018-10881} {CVE-2018-10881}\n- ext4: add more inode number paranoia checks (Theodore Ts'o) [Orabug: \n29545567] {CVE-2018-10882} {CVE-2018-10882}", "edition": 18, "cvss3": {"score": 6.5, "vector": "AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"}, "published": "2019-04-10T00:00:00", "title": "Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4600)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-10882", "CVE-2018-10877", "CVE-2018-10881", "CVE-2019-3701", "CVE-2018-10879"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/o:oracle:linux:6", "p-cpe:/a:oracle:linux:kernel-uek-firmware", "p-cpe:/a:oracle:linux:kernel-uek-doc", "p-cpe:/a:oracle:linux:kernel-uek", "p-cpe:/a:oracle:linux:kernel-uek-debug-devel", "p-cpe:/a:oracle:linux:dtrace-modules-3.8.13-118.32.1.el6uek", "p-cpe:/a:oracle:linux:kernel-uek-devel", "p-cpe:/a:oracle:linux:dtrace-modules-3.8.13-118.32.1.el7uek", "cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:kernel-uek-debug"], "id": "ORACLELINUX_ELSA-2019-4600.NASL", "href": "https://www.tenable.com/plugins/nessus/123961", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2019-4600.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(123961);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2020/01/23\");\n\n script_cve_id(\"CVE-2018-10877\", \"CVE-2018-10879\", \"CVE-2018-10881\", \"CVE-2018-10882\", \"CVE-2019-3701\");\n\n script_name(english:\"Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4600)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Description of changes:\n\nkernel-uek\n[3.8.13-118.32.1.el7uek]\n- x86/fpu: Factor out memset(xstate, 0) in fpu_finit() paths (Oleg \nNesterov) [Orabug: 29012034]\n- x86/fpu: Always allow FPU in interrupt if use_eager_fpu() (Oleg \nNesterov) [Orabug: 29012034]\n- x86/fpu: Fix 32-bit signal frame handling (Dave Hansen) [Orabug: 29012034]\n- x86/fpu: Don't do __thread_fpu_end() if use_eager_fpu() (Oleg \nNesterov) [Orabug: 29012034]\n- x86/fpu: Don't reset fpu_counter (Oleg Nesterov) [Orabug: 29012034]\n- x86, fpu: Fix math_state_restore() race with kernel_fpu_begin() (Oleg \nNesterov) [Orabug: 29012034]\n- x86, fpu: Introduce per-cpu in_kernel_fpu state (Oleg Nesterov) \n[Orabug: 29012034]\n- x86, fpu: Don't abuse has_fpu in __kernel_fpu_begin/end() (Oleg \nNesterov) [Orabug: 29012034]\n- x86: Allow FPU to be used at interrupt time even with eagerfpu (Pekka \nRiikonen) [Orabug: 29012034]\n- can: gw: ensure DLC boundaries after CAN frame modification (Oliver \nHartkopp) [Orabug: 29215300] {CVE-2019-3701} {CVE-2019-3701}\n- ext4: verify the depth of extent tree in ext4_find_extent() (Theodore \nTs'o) [Orabug: 29396713] {CVE-2018-10877} {CVE-2018-10877}\n- ext4: always verify the magic number in xattr blocks (Theodore Ts'o) \n[Orabug: 29437128] {CVE-2018-10879} {CVE-2018-10879}\n- ext4: add corruption check in ext4_xattr_set_entry() (Theodore Ts'o) \n[Orabug: 29437128] {CVE-2018-10879} {CVE-2018-10879}\n- ext4: clear i_data in ext4_inode_info when removing inline data \n(Theodore Ts'o) [Orabug: 29540710] {CVE-2018-10881} {CVE-2018-10881}\n- ext4: add more inode number paranoia checks (Theodore Ts'o) [Orabug: \n29545567] {CVE-2018-10882} {CVE-2018-10882}\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2019-April/008626.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2019-April/008627.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected unbreakable enterprise kernel packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-10877\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:dtrace-modules-3.8.13-118.32.1.el6uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:dtrace-modules-3.8.13-118.32.1.el7uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-firmware\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/07/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/04/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 6 / 7\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2018-10877\", \"CVE-2018-10879\", \"CVE-2018-10881\", \"CVE-2018-10882\", \"CVE-2019-3701\"); \n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for ELSA-2019-4600\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nkernel_major_minor = get_kb_item(\"Host/uname/major_minor\");\nif (empty_or_null(kernel_major_minor)) exit(1, \"Unable to determine kernel major-minor level.\");\nexpected_kernel_major_minor = \"3.8\";\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, \"running kernel level \" + expected_kernel_major_minor + \", it is running kernel level \" + kernel_major_minor);\n\nflag = 0;\nif (rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"dtrace-modules-3.8.13-118.32.1.el6uek-0.4.5-3.el6\")) flag++;\nif (rpm_exists(release:\"EL6\", rpm:\"kernel-uek-3.8.13\") && rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"kernel-uek-3.8.13-118.32.1.el6uek\")) flag++;\nif (rpm_exists(release:\"EL6\", rpm:\"kernel-uek-debug-3.8.13\") && rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"kernel-uek-debug-3.8.13-118.32.1.el6uek\")) flag++;\nif (rpm_exists(release:\"EL6\", rpm:\"kernel-uek-debug-devel-3.8.13\") && rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"kernel-uek-debug-devel-3.8.13-118.32.1.el6uek\")) flag++;\nif (rpm_exists(release:\"EL6\", rpm:\"kernel-uek-devel-3.8.13\") && rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"kernel-uek-devel-3.8.13-118.32.1.el6uek\")) flag++;\nif (rpm_exists(release:\"EL6\", rpm:\"kernel-uek-doc-3.8.13\") && rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"kernel-uek-doc-3.8.13-118.32.1.el6uek\")) flag++;\nif (rpm_exists(release:\"EL6\", rpm:\"kernel-uek-firmware-3.8.13\") && rpm_check(release:\"EL6\", cpu:\"x86_64\", reference:\"kernel-uek-firmware-3.8.13-118.32.1.el6uek\")) flag++;\n\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"dtrace-modules-3.8.13-118.32.1.el7uek-0.4.5-3.el7\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-3.8.13\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-3.8.13-118.32.1.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-debug-3.8.13\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-debug-3.8.13-118.32.1.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-debug-devel-3.8.13\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-debug-devel-3.8.13-118.32.1.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-devel-3.8.13\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-devel-3.8.13-118.32.1.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-doc-3.8.13\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-doc-3.8.13-118.32.1.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-firmware-3.8.13\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-firmware-3.8.13-118.32.1.el7uek\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"affected kernel\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T04:47:11", "description": "Description of changes:\n\n[4.14.35-1844.4.5.el7uek]\n- x86/apic/x2apic: set back affinity of a single interrupt to one cpu (Mridula Shastry) [Orabug: 29510342]\n\n[4.14.35-1844.4.4.el7uek]\n- ext4: fix data corruption caused by unaligned direct AIO (Lukas Czerner) [Orabug: 29598590]\n- swiotlb: checking whether swiotlb buffer is full with io_tlb_used (Dongli Zhang) [Orabug: 29587097]\n- swiotlb: add debugfs to track swiotlb buffer usage (Dongli Zhang) [Orabug: 29587097]\n- swiotlb: fix comment on swiotlb_bounce() (Dongli Zhang) [Orabug: 29587097]\n- scsi: target: add device product id and revision configfs attributes (Alan Adamson) [Orabug: 29344881]\n- scsi: target: remove hardcoded T10 Vendor ID in INQUIRY response (David Disseldorp) [Orabug: 29344881]\n- scsi: target: add device vendor_id configfs attribute (David Disseldorp) [Orabug: 29344881]\n- scsi: target: consistently null-terminate t10_wwn strings (David Disseldorp) [Orabug: 29344881]\n- scsi: target: use consistent left-aligned ASCII INQUIRY data (David Disseldorp) [Orabug: 29344881]\n- x86/speculation: Keep enhanced IBRS on when prctl is used for SSBD control (Alejandro Jimenez) [Orabug: 29526400]\n- drm/amdkfd: fix amdkfd use-after-free GP fault (Randy Dunlap) [Orabug: 29534199]\n\n[4.14.35-1844.4.3.el7uek]\n- can: gw: ensure DLC boundaries after CAN frame modification (Oliver Hartkopp) [Orabug: 29215297] {CVE-2019-3701} {CVE-2019-3701}\n\n[4.14.35-1844.4.2.el7uek]\n- x86/speculation: Clean up enhanced IBRS checks in bugs.c (Alejandro Jimenez) [Orabug: 29423796]\n- x86/speculation: Keep enhanced IBRS on when spec_store_bypass_disable=on is used (Alejandro Jimenez) [Orabug: 29423796]\n- kvm/speculation: Allow KVM guests to use SSBD even if host does not (Alejandro Jimenez) [Orabug: 29423796]\n- exec: Fix mem leak in kernel_read_file (YueHaibing) [Orabug: 29454858] {CVE-2019-8980}\n- net: crypto set sk to NULL when af_alg_release. (Mao Wenan) [Orabug: 29454874] {CVE-2019-8912}\n- {net, IB}/mlx5: Raise fatal IB event when sys error occurs (Daniel Jurgens) [Orabug: 29479744]\n- net/mlx5e: Avoid query PPCNT register if not supported by the device (Eyal Davidovich) [Orabug: 29479795]\n- mm: enforce min addr even if capable() in expand_downwards() (Jann Horn) [Orabug: 29501977] {CVE-2019-9213}\n- [UEK-5] IB/mlx5_core: Use kzalloc when allocating PD (Erez Alfasi) [Orabug: 29479806]\n- IB/mlx5: Change debugfs to have per port contents (Parav Pandit) [Orabug: 29486784]\n- Revert 'IB/mlx5: Change debugfs to have per port contents' (Qing Huang) [Orabug: 29486784]\n- scsi: scsi_transport_iscsi: modify detected conn err to KERN_ERR (Fred Herard) [Orabug: 29487789]\n- xen/blkfront: avoid NULL blkfront_info dereference on device removal (Vasilis Liaskovitis) [Orabug: 29489795]\n- qlcnic: fix Tx descriptor corruption on 82xx devices (Shahed Shaikh) [Orabug: 29495427]\n\n[4.14.35-1844.4.1.el7uek]\n- scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task (Anoob Soman) [Orabug: 29024514]\n- scsi: scsi_transport_iscsi: redirect conn error to console (Fred Herard) [Orabug: 29469713]\n- Revert x86/apic/x2apic: set affinity of a single interrupt to one cpu (Mridula Shastry) [Orabug: 29469651]\n- net/mlx5: Fix error handling in load one (Maor Gottlieb) [Orabug: 29019396]\n- net/mlx5: Fix mlx5_get_uars_page to return error code (Eran Ben Elisha) [Orabug: 29019396]\n- net/mlx5: Fix memory leak in bad flow of mlx5_alloc_irq_vectors (Alaa Hleihel) [Orabug: 29019396]\n- net/mlx4_core: Fix wrong calculation of free counters (Eran Ben Elisha) [Orabug: 29019396]\n- net/mlx5: Free IRQs in shutdown path (Daniel Jurgens) [Orabug: 29019427]\n- net/mlx5e: DCBNL fix min inline header size for dscp (Huy Nguyen) [Orabug: 29019427]\n- IB/mlx4: Fix integer overflow when calculating optimal MTT size (Jack Morgenstein) [Orabug: 29019427]\n- net/mlx5: Fix mlx5_get_vector_affinity function (Israel Rukshin) [Orabug: 29019427]\n- net/mlx5e: Fixed sleeping inside atomic context (Aviad Yehezkel) [Orabug: 29019427]\n- IB/core: Generate GID change event regardless of RoCE GID table property (Parav Pandit) [Orabug: 29019427]\n- net/mlx5: Vport, Use 'kvfree()' for memory allocated by 'kvzalloc()' (Christophe JAILLET) [Orabug: 29019430]\n- IB/mlx4: Use 4K pages for kernel QP's WQE buffer (Jack Morgenstein) [Orabug: 29019795]\n- net/mlx5: Add missing SET_DRIVER_VERSION command translation (Noa Osherovich) [Orabug: 29447325]\n- net/mlx5: E-Switch, Fix memory leak when creating switchdev mode FDB tables (Raed Salem) [Orabug: 29447325]\n- net/mlx5: Fix debugfs cleanup in the device init/remove flow (Jack Morgenstein) [Orabug: 29447325]\n- net/mlx5: Check for error in mlx5_attach_interface (Huy Nguyen) [Orabug: 29447325]\n- net/mlx5: Fix use-after-free in self-healing flow (Jack Morgenstein) [Orabug: 29447325]\n- uek-rpm: update list of removed files, generated by depmod on install stage (Alexander Burmashev) [Orabug: 29460369]\n\n[4.14.35-1844.4.0.el7uek]\n- fs/dcache.c: add cond_resched() in shrink_dentry_list() (Nikolay Borisov) [Orabug: 29450975]\n- net_failover: delay taking over primary device to accommodate udevd renaming (Si-Wei Liu)\n- hugetlbfs: fix races and page leaks during migration (Mike Kravetz) [Orabug: 29443877]\n- rds: update correct congestion map for loopback transport (Mukesh Kacker) [Orabug: 29431289]\n- KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) (Peter Shier) [Orabug: 29408638] {CVE-2019-7221}\n- KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) (Paolo Bonzini) [Orabug: 29408618] {CVE-2019-7222}\n- kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) (Jann Horn) [Orabug: 29408541] {CVE-2019-6974}\n- ib_core: initialize shpd field when allocating 'struct ib_pd' (Mukesh Kacker) [Orabug: 29384900]\n- bnxt_en: Return linux standard errors in bnxt_ethtool.c (Vasundhara Volam) [Orabug: 29261957]\n- bnxt_en: Don't set ETS on unused TCs. (Michael Chan) [Orabug: 29261957]\n- bnxt_en: get the reduced max_irqs by the ones used by RDMA (Vasundhara Volam) [Orabug: 29261957]\n- bnxt_en: free hwrm resources, if driver probe fails. (Venkat Duvvuru) [Orabug: 29261957]\n- bnxt_en: Fix enables field in HWRM_QUEUE_COS2BW_CFG request (Vasundhara Volam) [Orabug: 29261957]\n- bnxt_en: Fix VNIC reservations on the PF. (Michael Chan) [Orabug: 29261957]", "edition": 19, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-04-15T00:00:00", "title": "Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4612)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-7222", "CVE-2019-8980", "CVE-2019-8912", "CVE-2019-7221", "CVE-2019-3701", "CVE-2019-6974", "CVE-2019-9213"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:kernel-uek-doc", "p-cpe:/a:oracle:linux:kernel-uek", "p-cpe:/a:oracle:linux:kernel-uek-debug-devel", "p-cpe:/a:oracle:linux:kernel-uek-devel", "p-cpe:/a:oracle:linux:kernel-uek-tools", "cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:kernel-uek-debug"], "id": "ORACLELINUX_ELSA-2019-4612.NASL", "href": "https://www.tenable.com/plugins/nessus/124048", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2019-4612.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(124048);\n script_version(\"1.7\");\n script_cvs_date(\"Date: 2020/01/24\");\n\n script_cve_id(\"CVE-2019-3701\", \"CVE-2019-6974\", \"CVE-2019-7221\", \"CVE-2019-7222\", \"CVE-2019-8912\", \"CVE-2019-8980\", \"CVE-2019-9213\");\n\n script_name(english:\"Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4612)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Description of changes:\n\n[4.14.35-1844.4.5.el7uek]\n- x86/apic/x2apic: set back affinity of a single interrupt to one cpu (Mridula Shastry) [Orabug: 29510342]\n\n[4.14.35-1844.4.4.el7uek]\n- ext4: fix data corruption caused by unaligned direct AIO (Lukas Czerner) [Orabug: 29598590]\n- swiotlb: checking whether swiotlb buffer is full with io_tlb_used (Dongli Zhang) [Orabug: 29587097]\n- swiotlb: add debugfs to track swiotlb buffer usage (Dongli Zhang) [Orabug: 29587097]\n- swiotlb: fix comment on swiotlb_bounce() (Dongli Zhang) [Orabug: 29587097]\n- scsi: target: add device product id and revision configfs attributes (Alan Adamson) [Orabug: 29344881]\n- scsi: target: remove hardcoded T10 Vendor ID in INQUIRY response (David Disseldorp) [Orabug: 29344881]\n- scsi: target: add device vendor_id configfs attribute (David Disseldorp) [Orabug: 29344881]\n- scsi: target: consistently null-terminate t10_wwn strings (David Disseldorp) [Orabug: 29344881]\n- scsi: target: use consistent left-aligned ASCII INQUIRY data (David Disseldorp) [Orabug: 29344881]\n- x86/speculation: Keep enhanced IBRS on when prctl is used for SSBD control (Alejandro Jimenez) [Orabug: 29526400]\n- drm/amdkfd: fix amdkfd use-after-free GP fault (Randy Dunlap) [Orabug: 29534199]\n\n[4.14.35-1844.4.3.el7uek]\n- can: gw: ensure DLC boundaries after CAN frame modification (Oliver Hartkopp) [Orabug: 29215297] {CVE-2019-3701} {CVE-2019-3701}\n\n[4.14.35-1844.4.2.el7uek]\n- x86/speculation: Clean up enhanced IBRS checks in bugs.c (Alejandro Jimenez) [Orabug: 29423796]\n- x86/speculation: Keep enhanced IBRS on when spec_store_bypass_disable=on is used (Alejandro Jimenez) [Orabug: 29423796]\n- kvm/speculation: Allow KVM guests to use SSBD even if host does not (Alejandro Jimenez) [Orabug: 29423796]\n- exec: Fix mem leak in kernel_read_file (YueHaibing) [Orabug: 29454858] {CVE-2019-8980}\n- net: crypto set sk to NULL when af_alg_release. (Mao Wenan) [Orabug: 29454874] {CVE-2019-8912}\n- {net, IB}/mlx5: Raise fatal IB event when sys error occurs (Daniel Jurgens) [Orabug: 29479744]\n- net/mlx5e: Avoid query PPCNT register if not supported by the device (Eyal Davidovich) [Orabug: 29479795]\n- mm: enforce min addr even if capable() in expand_downwards() (Jann Horn) [Orabug: 29501977] {CVE-2019-9213}\n- [UEK-5] IB/mlx5_core: Use kzalloc when allocating PD (Erez Alfasi) [Orabug: 29479806]\n- IB/mlx5: Change debugfs to have per port contents (Parav Pandit) [Orabug: 29486784]\n- Revert 'IB/mlx5: Change debugfs to have per port contents' (Qing Huang) [Orabug: 29486784]\n- scsi: scsi_transport_iscsi: modify detected conn err to KERN_ERR (Fred Herard) [Orabug: 29487789]\n- xen/blkfront: avoid NULL blkfront_info dereference on device removal (Vasilis Liaskovitis) [Orabug: 29489795]\n- qlcnic: fix Tx descriptor corruption on 82xx devices (Shahed Shaikh) [Orabug: 29495427]\n\n[4.14.35-1844.4.1.el7uek]\n- scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task (Anoob Soman) [Orabug: 29024514]\n- scsi: scsi_transport_iscsi: redirect conn error to console (Fred Herard) [Orabug: 29469713]\n- Revert x86/apic/x2apic: set affinity of a single interrupt to one cpu (Mridula Shastry) [Orabug: 29469651]\n- net/mlx5: Fix error handling in load one (Maor Gottlieb) [Orabug: 29019396]\n- net/mlx5: Fix mlx5_get_uars_page to return error code (Eran Ben Elisha) [Orabug: 29019396]\n- net/mlx5: Fix memory leak in bad flow of mlx5_alloc_irq_vectors (Alaa Hleihel) [Orabug: 29019396]\n- net/mlx4_core: Fix wrong calculation of free counters (Eran Ben Elisha) [Orabug: 29019396]\n- net/mlx5: Free IRQs in shutdown path (Daniel Jurgens) [Orabug: 29019427]\n- net/mlx5e: DCBNL fix min inline header size for dscp (Huy Nguyen) [Orabug: 29019427]\n- IB/mlx4: Fix integer overflow when calculating optimal MTT size (Jack Morgenstein) [Orabug: 29019427]\n- net/mlx5: Fix mlx5_get_vector_affinity function (Israel Rukshin) [Orabug: 29019427]\n- net/mlx5e: Fixed sleeping inside atomic context (Aviad Yehezkel) [Orabug: 29019427]\n- IB/core: Generate GID change event regardless of RoCE GID table property (Parav Pandit) [Orabug: 29019427]\n- net/mlx5: Vport, Use 'kvfree()' for memory allocated by 'kvzalloc()' (Christophe JAILLET) [Orabug: 29019430]\n- IB/mlx4: Use 4K pages for kernel QP's WQE buffer (Jack Morgenstein) [Orabug: 29019795]\n- net/mlx5: Add missing SET_DRIVER_VERSION command translation (Noa Osherovich) [Orabug: 29447325]\n- net/mlx5: E-Switch, Fix memory leak when creating switchdev mode FDB tables (Raed Salem) [Orabug: 29447325]\n- net/mlx5: Fix debugfs cleanup in the device init/remove flow (Jack Morgenstein) [Orabug: 29447325]\n- net/mlx5: Check for error in mlx5_attach_interface (Huy Nguyen) [Orabug: 29447325]\n- net/mlx5: Fix use-after-free in self-healing flow (Jack Morgenstein) [Orabug: 29447325]\n- uek-rpm: update list of removed files, generated by depmod on install stage (Alexander Burmashev) [Orabug: 29460369]\n\n[4.14.35-1844.4.0.el7uek]\n- fs/dcache.c: add cond_resched() in shrink_dentry_list() (Nikolay Borisov) [Orabug: 29450975]\n- net_failover: delay taking over primary device to accommodate udevd renaming (Si-Wei Liu)\n- hugetlbfs: fix races and page leaks during migration (Mike Kravetz) [Orabug: 29443877]\n- rds: update correct congestion map for loopback transport (Mukesh Kacker) [Orabug: 29431289]\n- KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) (Peter Shier) [Orabug: 29408638] {CVE-2019-7221}\n- KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) (Paolo Bonzini) [Orabug: 29408618] {CVE-2019-7222}\n- kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) (Jann Horn) [Orabug: 29408541] {CVE-2019-6974}\n- ib_core: initialize shpd field when allocating 'struct ib_pd' (Mukesh Kacker) [Orabug: 29384900]\n- bnxt_en: Return linux standard errors in bnxt_ethtool.c (Vasundhara Volam) [Orabug: 29261957]\n- bnxt_en: Don't set ETS on unused TCs. (Michael Chan) [Orabug: 29261957]\n- bnxt_en: get the reduced max_irqs by the ones used by RDMA (Vasundhara Volam) [Orabug: 29261957]\n- bnxt_en: free hwrm resources, if driver probe fails. (Venkat Duvvuru) [Orabug: 29261957]\n- bnxt_en: Fix enables field in HWRM_QUEUE_COS2BW_CFG request (Vasundhara Volam) [Orabug: 29261957]\n- bnxt_en: Fix VNIC reservations on the PF. (Michael Chan) [Orabug: 29261957]\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2019-April/008648.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected unbreakable enterprise kernel packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8912\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/01/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/04/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 7\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2019-3701\", \"CVE-2019-6974\", \"CVE-2019-7221\", \"CVE-2019-7222\", \"CVE-2019-8912\", \"CVE-2019-8980\", \"CVE-2019-9213\"); \n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for ELSA-2019-4612\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nkernel_major_minor = get_kb_item(\"Host/uname/major_minor\");\nif (empty_or_null(kernel_major_minor)) exit(1, \"Unable to determine kernel major-minor level.\");\nexpected_kernel_major_minor = \"4.14\";\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, \"running kernel level \" + expected_kernel_major_minor + \", it is running kernel level \" + kernel_major_minor);\n\nflag = 0;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-4.14.35\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-4.14.35-1844.4.5.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-debug-4.14.35\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-debug-4.14.35-1844.4.5.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-debug-devel-4.14.35\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-debug-devel-4.14.35-1844.4.5.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-devel-4.14.35\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-devel-4.14.35-1844.4.5.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-doc-4.14.35\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-doc-4.14.35-1844.4.5.el7uek\")) flag++;\nif (rpm_exists(release:\"EL7\", rpm:\"kernel-uek-tools-4.14.35\") && rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"kernel-uek-tools-4.14.35-1844.4.5.el7uek\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"affected kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-07T08:55:21", "description": "According to the versions of the kernel packages installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - An issue was discovered in can_can_gw_rcv in\n net/can/gw.c in the Linux kernel through 4.19.13. The\n CAN frame modification rules allow bitwise logical\n operations that can be also applied to the can_dlc\n field. Because of a missing check, the CAN drivers may\n write arbitrary content beyond the data registers in\n the CAN controller's I/O memory when processing can-gw\n manipulated outgoing frames. This is related to\n cgw_csum_xor_rel. An unprivileged user can trigger a\n system crash (general protection fault).(CVE-2019-3701)\n\n - A flaw was found in mmap in the Linux kernel allowing\n the process to map a null page. This allows attackers\n to abuse this mechanism to turn null pointer\n dereferences into workable exploits.(CVE-2019-9213)\n\n - A security flaw was found in the Linux kernel in a way\n that the cleancache subsystem clears an inode after the\n final file truncation (removal). The new file created\n with the same inode may contain leftover pages from\n cleancache and the old file data instead of the new\n one.i1/4^CVE-2018-16862i1/4%0\n\n - It was found that the raw midi kernel driver does not\n protect against concurrent access which leads to a\n double realloc (double free) in\n snd_rawmidi_input_params() and\n snd_rawmidi_output_status() which are part of\n snd_rawmidi_ioctl() handler in rawmidi.c file. A\n malicious local attacker could possibly use this for\n privilege escalation.i1/4^CVE-2018-10902i1/4%0\n\n - In the function wmi_set_ie() in the Linux kernel the\n length validation code does not handle unsigned integer\n overflow properly. As a result, a large value of the\n aEUR~ie_lenaEURtm argument can cause a buffer overflow and\n thus a memory corruption leading to a system crash or\n other or unspecified impact. Due to the nature of the\n flaw, privilege escalation cannot be fully ruled out,\n although we believe it is unlikely.i1/4^CVE-2018-5848i1/4%0\n\n - A flaw was found in the Linux kernel in the function\n hid_debug_events_read() in the drivers/hid/hid-debug.c\n file which may enter an infinite loop with certain\n parameters passed from a user space. A local privileged\n user ('root') can cause a system lock up and a denial\n of service.i1/4^CVE-2019-3819i1/4%0\n\n - A flaw was found in the Linux kernel in the\n hid_debug_events_read() function in the\n drivers/hid/hid-debug.c file. A lack of the certain\n checks may allow a privileged user ('root') to achieve\n an out-of-bounds write and thus receiving user space\n buffer corruption.i1/4^CVE-2018-9516i1/4%0\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 12, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-04-04T00:00:00", "title": "EulerOS Virtualization 2.5.3 : kernel (EulerOS-SA-2019-1259)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-5848", "CVE-2018-16862", "CVE-2019-3701", "CVE-2019-9213", "CVE-2018-9516", "CVE-2018-10902", "CVE-2019-3819"], "modified": "2019-04-04T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-tools-libs-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "cpe:/o:huawei:euleros:uvp:2.5.3"], "id": "EULEROS_SA-2019-1259.NASL", "href": "https://www.tenable.com/plugins/nessus/123727", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(123727);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2018-10902\",\n \"CVE-2018-16862\",\n \"CVE-2018-5848\",\n \"CVE-2018-9516\",\n \"CVE-2019-3701\",\n \"CVE-2019-3819\",\n \"CVE-2019-9213\"\n );\n\n script_name(english:\"EulerOS Virtualization 2.5.3 : kernel (EulerOS-SA-2019-1259)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - An issue was discovered in can_can_gw_rcv in\n net/can/gw.c in the Linux kernel through 4.19.13. The\n CAN frame modification rules allow bitwise logical\n operations that can be also applied to the can_dlc\n field. Because of a missing check, the CAN drivers may\n write arbitrary content beyond the data registers in\n the CAN controller's I/O memory when processing can-gw\n manipulated outgoing frames. This is related to\n cgw_csum_xor_rel. An unprivileged user can trigger a\n system crash (general protection fault).(CVE-2019-3701)\n\n - A flaw was found in mmap in the Linux kernel allowing\n the process to map a null page. This allows attackers\n to abuse this mechanism to turn null pointer\n dereferences into workable exploits.(CVE-2019-9213)\n\n - A security flaw was found in the Linux kernel in a way\n that the cleancache subsystem clears an inode after the\n final file truncation (removal). The new file created\n with the same inode may contain leftover pages from\n cleancache and the old file data instead of the new\n one.i1/4^CVE-2018-16862i1/4%0\n\n - It was found that the raw midi kernel driver does not\n protect against concurrent access which leads to a\n double realloc (double free) in\n snd_rawmidi_input_params() and\n snd_rawmidi_output_status() which are part of\n snd_rawmidi_ioctl() handler in rawmidi.c file. A\n malicious local attacker could possibly use this for\n privilege escalation.i1/4^CVE-2018-10902i1/4%0\n\n - In the function wmi_set_ie() in the Linux kernel the\n length validation code does not handle unsigned integer\n overflow properly. As a result, a large value of the\n aEUR~ie_lenaEURtm argument can cause a buffer overflow and\n thus a memory corruption leading to a system crash or\n other or unspecified impact. Due to the nature of the\n flaw, privilege escalation cannot be fully ruled out,\n although we believe it is unlikely.i1/4^CVE-2018-5848i1/4%0\n\n - A flaw was found in the Linux kernel in the function\n hid_debug_events_read() in the drivers/hid/hid-debug.c\n file which may enter an infinite loop with certain\n parameters passed from a user space. A local privileged\n user ('root') can cause a system lock up and a denial\n of service.i1/4^CVE-2019-3819i1/4%0\n\n - A flaw was found in the Linux kernel in the\n hid_debug_events_read() function in the\n drivers/hid/hid-debug.c file. A lack of the certain\n checks may allow a privileged user ('root') to achieve\n an out-of-bounds write and thus receiving user space\n buffer corruption.i1/4^CVE-2018-9516i1/4%0\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1259\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?39825ffc\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/04/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:2.5.3\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"2.5.3\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 2.5.3\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-3.10.0-514.44.5.10_136\",\n \"kernel-devel-3.10.0-514.44.5.10_136\",\n \"kernel-headers-3.10.0-514.44.5.10_136\",\n \"kernel-tools-3.10.0-514.44.5.10_136\",\n \"kernel-tools-libs-3.10.0-514.44.5.10_136\",\n \"kernel-tools-libs-devel-3.10.0-514.44.5.10_136\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-09-14T17:12:11", "description": "The openSUSE Leap 15.1 kernel was updated to receive various security\nand bugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2020-11669: An issue was discovered on the powerpc\n platform. arch/powerpc/kernel/idle_book3s.S did not have\n save/restore functionality for PNV_POWERSAVE_AMR,\n PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka\n CID-53a712bae5dd (bnc#1169390).\n\n - CVE-2020-8834: KVM on Power8 processors had a\n conflicting use of HSTATE_HOST_R1 to store r1 state in\n kvmppc_hv_entry plus in kvmppc_(save,restore)_tm,\n leading to a stack corruption. Because of this, an\n attacker with the ability run code in kernel space of a\n guest VM can cause the host kernel to panic. There were\n two commits that, according to the reporter, introduced\n the vulnerability: f024ee098476 ('KVM: PPC: Book3S HV:\n Pull out TM state save/restore into separate\n procedures') 87a11bb6a7f7 ('KVM: PPC: Book3S HV: Work\n around XER[SO] bug in fake suspend mode') (bnc#1168276).\n\n - CVE-2020-11494: An issue was discovered in slc_bump in\n drivers/net/can/slcan.c, which allowed attackers to read\n uninitialized can_frame data, potentially containing\n sensitive information from kernel stack memory, if the\n configuration lacks CONFIG_INIT_STACK_ALL, aka\n CID-b9258a2cece4 (bnc#1168424).\n\n - CVE-2019-9458: In the video driver there is a use after\n free due to a race condition. This could lead to local\n escalation of privilege with no additional execution\n privileges needed. User interaction is not needed for\n exploitation (bnc#1168295).\n\n - CVE-2019-3701: An issue was discovered in can_can_gw_rcv\n in net/can/gw.c. The CAN frame modification rules allow\n bitwise logical operations that can be also applied to\n the can_dlc field. The privileged user 'root' with\n CAP_NET_ADMIN can create a CAN frame modification rule\n that made the data length code a higher value than the\n available CAN frame data size. In combination with a\n configured checksum calculation where the result is\n stored relatively to the end of the data (e.g.\n cgw_csum_xor_rel) the tail of the skb (e.g. frag_list\n pointer in skb_shared_info) can be rewritten which\n finally can cause a system crash. Because of a missing\n check, the CAN drivers may write arbitrary content\n beyond the data registers in the CAN controller's I/O\n memory when processing can-gw manipulated outgoing\n frames (bnc#1120386).\n\n - CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c\n lacked validation of an sk_family field, which might\n allow attackers to trigger kernel stack corruption via\n crafted system calls (bnc#1167629).\n\n - CVE-2019-19770: A use-after-free in the debugfs_remove\n function in fs/debugfs/inode.c was fixed. (bnc#1159198).\n\nThe following non-security bugs were fixed :\n\n - ACPI: watchdog: Fix gas->access_width usage\n (bsc#1051510).\n\n - ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro\n (bsc#1051510).\n\n - ALSA: ali5451: remove redundant variable capture_flag\n (bsc#1051510).\n\n - ALSA: core: Add snd_device_get_state() helper\n (bsc#1051510).\n\n - ALSA: core: Replace zero-length array with\n flexible-array member (bsc#1051510).\n\n - ALSA: emu10k1: Fix endianness annotations (bsc#1051510).\n\n - ALSA: hda/ca0132 - Add Recon3Di quirk to handle\n integrated sound on EVGA X99 Classified motherboard\n (bsc#1051510).\n\n - ALSA: hda/ca0132 - Replace zero-length array with\n flexible-array member (bsc#1051510).\n\n - ALSA: hda/realtek - Enable headset mic of Acer X2660G\n with ALC662 (git-fixes).\n\n - ALSA: hda/realtek - Enable the headset of Acer N50-600\n with ALC662 (git-fixes).\n\n - ALSA: hda/realtek - Remove now-unnecessary XPS 13\n headphone noise fixups (bsc#1051510).\n\n - ALSA: hda/realtek - Set principled PC Beep configuration\n for ALC256 (bsc#1051510).\n\n - ALSA: hda/realtek - a fake key event is triggered by\n running shutup (bsc#1051510).\n\n - ALSA: hda/realtek: Enable mute LED on an HP system\n (bsc#1051510).\n\n - ALSA: hda/realtek: Fix pop noise on ALC225 (git-fixes).\n\n - ALSA: hda: Fix potential access overflow in beep helper\n (bsc#1051510).\n\n - ALSA: hda: Use scnprintf() for string truncation\n (bsc#1051510).\n\n - ALSA: hda: default enable CA0132 DSP support\n (bsc#1051510).\n\n - ALSA: hda: remove redundant assignment to variable\n timeout (bsc#1051510).\n\n - ALSA: hda_codec: Replace zero-length array with\n flexible-array member (bsc#1051510).\n\n - ALSA: hdsp: remove redundant assignment to variable err\n (bsc#1051510).\n\n - ALSA: ice1724: Fix invalid access for enumerated ctl\n items (bsc#1051510).\n\n - ALSA: info: remove redundant assignment to variable c\n (bsc#1051510).\n\n - ALSA: korg1212: fix if-statement empty body warnings\n (bsc#1051510).\n\n - ALSA: line6: Fix endless MIDI read loop (git-fixes).\n\n - ALSA: pcm.h: add for_each_pcm_streams() (bsc#1051510).\n\n - ALSA: pcm: Fix superfluous snprintf() usage\n (bsc#1051510).\n\n - ALSA: pcm: Use a macro for parameter masks to reduce the\n needed cast (bsc#1051510).\n\n - ALSA: pcm: oss: Avoid plugin buffer overflow\n (git-fixes).\n\n - ALSA: pcm: oss: Fix regression by buffer overflow fix\n (bsc#1051510).\n\n - ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc()\n checks (git-fixes).\n\n - ALSA: pcm: oss: Unlock mutex temporarily for sleeping at\n read/write (bsc#1051510).\n\n - ALSA: seq: oss: Fix running status after receiving sysex\n (git-fixes).\n\n - ALSA: seq: virmidi: Fix running status after receiving\n sysex (git-fixes).\n\n - ALSA: usb-audio: Add delayed_register option\n (bsc#1051510).\n\n - ALSA: usb-audio: Add support for MOTU MicroBook IIc\n (bsc#1051510).\n\n - ALSA: usb-audio: Create a registration quirk for\n Kingston HyperX Amp (0951:16d8) (bsc#1051510).\n\n - ALSA: usb-audio: Do not create a mixer element with\n bogus volume range (bsc#1051510).\n\n - ALSA: usb-audio: Fix case when USB MIDI interface has\n more than one extra endpoint descriptor (bsc#1051510).\n\n - ALSA: usb-audio: Fix mixer controls' USB interface for\n Kingston HyperX Amp (0951:16d8) (bsc#1051510).\n\n - ALSA: usb-audio: Inform devices that need delayed\n registration (bsc#1051510).\n\n - ALSA: usb-audio: Parse source ID of UAC2 effect unit\n (bsc#1051510).\n\n - ALSA: usb-audio: Rewrite registration quirk handling\n (bsc#1051510).\n\n - ALSA: usb-midi: Replace zero-length array with\n flexible-array member (bsc#1051510).\n\n - ALSA: usx2y: use for_each_pcm_streams() macro\n (bsc#1051510).\n\n - ALSA: via82xx: Fix endianness annotations (bsc#1051510).\n\n - ASoC: Intel: atom: Take the drv->lock mutex before\n calling sst_send_slot_map() (bsc#1051510).\n\n - ASoC: Intel: mrfld: fix incorrect check on p->sink\n (bsc#1051510).\n\n - ASoC: Intel: mrfld: return error codes when an error\n occurs (bsc#1051510).\n\n - ASoC: jz4740-i2s: Fix divider written at incorrect\n offset in register (bsc#1051510).\n\n - ASoC: sun8i-codec: Remove unused dev from codec struct\n (bsc#1051510).\n\n - Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl\n (bsc#1051510).\n\n - Btrfs: clean up error handling in btrfs_truncate()\n (bsc#1165949).\n\n - Btrfs: do not reset bio->bi_ops while writing bio\n (bsc#1168273).\n\n - Btrfs: fix missing delayed iputs on unmount\n (bsc#1165949).\n\n - Btrfs: fix qgroup double free after failure to reserve\n metadata for delalloc (bsc#1165949).\n\n - Btrfs: fix race leading to metadata space leak after\n task received signal (bsc#1165949).\n\n - Btrfs: fix unwritten extent buffers and hangs on future\n writeback attempts (bsc#1168273).\n\n - Btrfs: make plug in writing meta blocks really work\n (bsc#1168273).\n\n - Btrfs: only check delayed ref usage in\n should_end_transaction (bsc#1165949).\n\n - Btrfs: remove bio_flags which indicates a meta block of\n log-tree (bsc#1168273).\n\n - Crypto: chelsio - Fixes a deadlock between rtnl_lock and\n uld_mutex (bsc#1111666).\n\n - Crypto: chelsio - Fixes a hang issue during driver\n registration (bsc#1111666).\n\n - Deprecate NR_UNSTABLE_NFS, use NR_WRITEBACK\n (bsc#1163403).\n\n - HID: apple: Add support for recent firmware on Magic\n Keyboards (bsc#1051510).\n\n - IB/hfi1: convert to debugfs_file_get() and -put()\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - Input: add safety guards to input_set_keycode()\n (bsc#1168075).\n\n - Input: avoid BIT() macro usage in the serio.h UAPI\n header (bsc#1051510).\n\n - Input: raydium_i2c_ts - fix error codes in\n raydium_i2c_boot_trigger() (bsc#1051510).\n\n - Input: synaptics - enable RMI on HP Envy 13-ad105ng\n (bsc#1051510).\n\n - MM: replace PF_LESS_THROTTLE with PF_LOCAL_THROTTLE\n (bsc#1163403).\n\n - NFC: fdp: Fix a signedness bug in fdp_nci_send_patch()\n (bsc#1051510).\n\n - NFS: send state management on a single connection\n (bsc#1167005).\n\n - OMAP: DSS2: remove non-zero check on variable r\n (bsc#1114279)\n\n - PCI/AER: Factor message prefixes with dev_fmt()\n (bsc#1161561).\n\n - PCI/AER: Log which device prevents error recovery\n (bsc#1161561).\n\n - PCI/AER: Remove ERR_FATAL code from ERR_NONFATAL path\n (bsc#1161561).\n\n - PCI/ASPM: Clear the correct bits when enabling L1\n substates (bsc#1051510).\n\n - PCI/ERR: Always report current recovery status for udev\n (bsc#1161561).\n\n - PCI/ERR: Handle fatal error recovery (bsc#1161561).\n\n - PCI/ERR: Remove duplicated include from err.c\n (bsc#1161561).\n\n - PCI/ERR: Simplify broadcast callouts (bsc#1161561).\n\n - PCI/portdrv: Remove pcie_port_bus_type link order\n dependency (bsc#1161561).\n\n - PCI/switchtec: Fix init_completion race condition with\n poll_wait() (bsc#1051510).\n\n - PCI: Simplify disconnected marking (bsc#1161561).\n\n - PCI: Unify device inaccessible (bsc#1161561).\n\n - PCI: endpoint: Fix clearing start entry in configfs\n (bsc#1051510).\n\n - PCI: pciehp: Fix MSI interrupt race (bsc#1159037).\n\n - PCI: portdrv: Initialize service drivers directly\n (bsc#1161561).\n\n - PM: core: Fix handling of devices deleted during\n system-wide resume (git-fixes).\n\n - SUNRPC: defer slow parts of rpc_free_client() to a\n workqueue (bsc#1168202).\n\n - USB: Disable LPM on WD19's Realtek Hub (git-fixes).\n\n - USB: Fix novation SourceControl XL after suspend\n (git-fixes).\n\n - USB: cdc-acm: fix rounding error in TIOCSSERIAL\n (git-fixes).\n\n - USB: hub: Do not record a connect-change event during\n reset-resume (git-fixes).\n\n - USB: misc: iowarrior: add support for 2 OEMed devices\n (git-fixes).\n\n - USB: misc: iowarrior: add support for the 100 device\n (git-fixes).\n\n - USB: misc: iowarrior: add support for the 28 and 28L\n devices (git-fixes).\n\n - USB: serial: io_edgeport: fix slab-out-of-bounds read in\n edge_interrupt_callback (bsc#1051510).\n\n - USB: serial: option: add ME910G1 ECM composition 0x110b\n (git-fixes).\n\n - USB: serial: pl2303: add device-id for HP LD381\n (git-fixes).\n\n - ahci: Add support for Amazon's Annapurna Labs SATA\n controller (bsc#1169013).\n\n - apei/ghes: Do not delay GHES polling (bsc#1166982).\n\n - ath9k: Handle txpower changes even when TPC is disabled\n (bsc#1051510).\n\n - batman-adv: Avoid spurious warnings from bat_v neigh_cmp\n implementation (bsc#1051510).\n\n - batman-adv: Do not schedule OGM for disabled interface\n (bsc#1051510).\n\n - batman-adv: prevent TT request storms by not sending\n inconsistent TT TLVLs (bsc#1051510).\n\n - binfmt_elf: Do not move brk for INTERP-less ET_EXEC\n (bsc#1169013).\n\n - binfmt_elf: move brk out of mmap when doing direct\n loader exec (bsc#1169013).\n\n - blk-mq: Allow blocking queue tag iter callbacks\n (bsc#1167316).\n\n - block, bfq: fix use-after-free in\n bfq_idle_slice_timer_body (bsc#1168760).\n\n - block: keep bdi->io_pages in sync with max_sectors_kb\n for stacked devices (bsc#1168762).\n\n - bnxt_en: Support all variants of the 5750X chip family\n (bsc#1167216).\n\n - bpf: Explicitly memset some bpf info structures declared\n on the stack (bsc#1083647).\n\n - bpf: Explicitly memset the bpf_attr structure\n (bsc#1083647).\n\n - brcmfmac: abort and release host after error\n (bsc#1111666).\n\n - btrfs: Account for trans_block_rsv in\n may_commit_transaction (bsc#1165949).\n\n - btrfs: Add enospc_debug printing in\n metadata_reserve_bytes (bsc#1165949).\n\n - btrfs: Do mandatory tree block check before submitting\n bio (bsc#1168273).\n\n - btrfs: Improve global reserve stealing logic\n (bsc#1165949).\n\n - btrfs: Output ENOSPC debug info in inc_block_group_ro\n (bsc#1165949).\n\n - btrfs: Remove btrfs_inode::delayed_iput_count\n (bsc#1165949).\n\n - btrfs: Remove fs_info from do_chunk_alloc (bsc#1165949).\n\n - btrfs: Remove redundant argument of flush_space\n (bsc#1165949).\n\n - btrfs: Remove redundant mirror_num arg (bsc#1168273).\n\n - btrfs: Rename bin_search -> btrfs_bin_search\n (bsc#1168273).\n\n - btrfs: add a flush step for delayed iputs (bsc#1165949).\n\n - btrfs: add assertions for releasing trans handle\n reservations (bsc#1165949).\n\n - btrfs: add btrfs_delete_ref_head helper (bsc#1165949).\n\n - btrfs: add enospc debug messages for ticket failure\n (bsc#1165949).\n\n - btrfs: add new flushing states for the delayed refs rsv\n (bsc#1165949).\n\n - btrfs: add space reservation tracepoint for reserved\n bytes (bsc#1165949).\n\n - btrfs: adjust dirty_metadata_bytes after writeback\n failure of extent buffer (bsc#1168273).\n\n - btrfs: allow us to use up to 90% of the global rsv for\n unlink (bsc#1165949).\n\n - btrfs: always reserve our entire size for the global\n reserve (bsc#1165949).\n\n - btrfs: assert on non-empty delayed iputs (bsc##1165949).\n\n - btrfs: be more explicit about allowed flush states\n (bsc#1165949).\n\n - btrfs: call btrfs_create_pending_block_groups\n unconditionally (bsc#1165949).\n\n - btrfs: catch cow on deleting snapshots (bsc#1165949).\n\n - btrfs: change the minimum global reserve size\n (bsc#1165949).\n\n - btrfs: check if there are free block groups for commit\n (bsc#1165949).\n\n - btrfs: cleanup extent_op handling (bsc#1165949).\n\n - btrfs: cleanup root usage by btrfs_get_alloc_profile\n (bsc#1165949).\n\n - btrfs: cleanup the target logic in\n __btrfs_block_rsv_release (bsc#1165949).\n\n - btrfs: clear space cache inode generation always\n (bsc#1165949).\n\n - btrfs: delayed-ref: pass delayed_refs directly to\n btrfs_delayed_ref_lock (bsc#1165949).\n\n - btrfs: do not account global reserve in can_overcommit\n (bsc#1165949).\n\n - btrfs: do not allow reservations if we have pending\n tickets (bsc#1165949).\n\n - btrfs: do not call btrfs_start_delalloc_roots in\n flushoncommit (bsc#1165949).\n\n - btrfs: do not end the transaction for delayed refs in\n throttle (bsc#1165949).\n\n - btrfs: do not enospc all tickets on flush failure\n (bsc#1165949).\n\n - btrfs: do not run delayed refs in the end transaction\n logic (bsc#1165949).\n\n - btrfs: do not run delayed_iputs in commit\n (bsc##1165949).\n\n - btrfs: do not use ctl->free_space for max_extent_size\n (bsc##1165949).\n\n - btrfs: do not use global reserve for chunk allocation\n (bsc#1165949).\n\n - btrfs: drop get_extent from extent_page_data\n (bsc#1168273).\n\n - btrfs: drop min_size from evict_refill_and_join\n (bsc##1165949).\n\n - btrfs: drop unused space_info parameter from\n create_space_info (bsc#1165949).\n\n - btrfs: dump block_rsv details when dumping space info\n (bsc#1165949).\n\n - btrfs: export __btrfs_block_rsv_release (bsc#1165949).\n\n - btrfs: export block group accounting helpers\n (bsc#1165949).\n\n - btrfs: export block_rsv_use_bytes (bsc#1165949).\n\n - btrfs: export btrfs_block_rsv_add_bytes (bsc#1165949).\n\n - btrfs: export space_info_add_*_bytes (bsc#1165949).\n\n - btrfs: export the block group caching helpers\n (bsc#1165949).\n\n - btrfs: export the caching control helpers (bsc#1165949).\n\n - btrfs: export the excluded extents helpers\n (bsc#1165949).\n\n - btrfs: extent-tree: Add lockdep assert when updating\n space info (bsc#1165949).\n\n - btrfs: extent-tree: Add trace events for space info\n numbers update (bsc#1165949).\n\n - btrfs: extent-tree: Detect bytes_may_use underflow\n earlier (bsc#1165949).\n\n - btrfs: extent-tree: Detect bytes_pinned underflow\n earlier (bsc#1165949).\n\n - btrfs: extent_io: Handle errors better in\n btree_write_cache_pages() (bsc#1168273).\n\n - btrfs: extent_io: Handle errors better in\n extent_write_full_page() (bsc#1168273).\n\n - btrfs: extent_io: Handle errors better in\n extent_write_locked_range() (bsc#1168273).\n\n - btrfs: extent_io: Handle errors better in\n extent_writepages() (bsc#1168273).\n\n - btrfs: extent_io: Kill dead condition in\n extent_write_cache_pages() (bsc#1168273).\n\n - btrfs: extent_io: Kill the forward declaration of\n flush_write_bio (bsc#1168273).\n\n - btrfs: extent_io: Move the BUG_ON() in flush_write_bio()\n one level up (bsc#1168273).\n\n - btrfs: extent_io: add proper error handling to\n lock_extent_buffer_for_io() (bsc#1168273).\n\n - btrfs: factor our read/write stage off csum_tree_block\n into its callers (bsc#1168273).\n\n - btrfs: factor out the ticket flush handling\n (bsc#1165949).\n\n - btrfs: fix insert_reserved error handling\n (bsc##1165949).\n\n - btrfs: fix may_commit_transaction to deal with no\n partial filling (bsc#1165949).\n\n - btrfs: fix truncate throttling (bsc#1165949).\n\n - btrfs: force chunk allocation if our global rsv is\n larger than metadata (bsc#1165949).\n\n - btrfs: introduce an evict flushing state (bsc#1165949).\n\n - btrfs: introduce delayed_refs_rsv (bsc#1165949).\n\n - btrfs: loop in inode_rsv_refill (bsc#1165949).\n\n - btrfs: make btrfs_destroy_delayed_refs use\n btrfs_delayed_ref_lock (bsc#1165949).\n\n - btrfs: make btrfs_destroy_delayed_refs use\n btrfs_delete_ref_head (bsc#1165949).\n\n - btrfs: make caching_thread use btrfs_find_next_key\n (bsc#1165949).\n\n - btrfs: merge two flush_write_bio helpers (bsc#1168273).\n\n - btrfs: migrate btrfs_trans_release_chunk_metadata\n (bsc#1165949).\n\n - btrfs: migrate inc/dec_block_group_ro code\n (bsc#1165949).\n\n - btrfs: migrate nocow and reservation helpers\n (bsc#1165949).\n\n - btrfs: migrate the alloc_profile helpers (bsc#1165949).\n\n - btrfs: migrate the block group caching code\n (bsc#1165949).\n\n - btrfs: migrate the block group cleanup code\n (bsc#1165949).\n\n - btrfs: migrate the block group lookup code\n (bsc#1165949).\n\n - btrfs: migrate the block group read/creation code\n (bsc#1165949).\n\n - btrfs: migrate the block group ref counting stuff\n (bsc#1165949).\n\n - btrfs: migrate the block group removal code\n (bsc#1165949).\n\n - btrfs: migrate the block group space accounting helpers\n (bsc#1165949).\n\n - btrfs: migrate the block-rsv code to block-rsv.c\n (bsc#1165949).\n\n - btrfs: migrate the chunk allocation code (bsc#1165949).\n\n - btrfs: migrate the delalloc space stuff to it's own home\n (bsc#1165949).\n\n - btrfs: migrate the delayed refs rsv code (bsc#1165949).\n\n - btrfs: migrate the dirty bg writeout code (bsc#1165949).\n\n - btrfs: migrate the global_block_rsv helpers to\n block-rsv.c (bsc#1165949).\n\n - btrfs: move and export can_overcommit (bsc#1165949).\n\n - btrfs: move basic block_group definitions to their own\n header (bsc#1165949).\n\n - btrfs: move btrfs_add_free_space out of a header file\n (bsc#1165949).\n\n - btrfs: move btrfs_block_rsv definitions into it's own\n header (bsc#1165949).\n\n - btrfs: move btrfs_raid_group values to btrfs_raid_attr\n table (bsc#1165949).\n\n - btrfs: move btrfs_space_info_add_*_bytes to space-info.c\n (bsc#1165949).\n\n - btrfs: move dump_space_info to space-info.c\n (bsc#1165949).\n\n - btrfs: move reserve_metadata_bytes and supporting code\n to space-info.c (bsc#1165949).\n\n - btrfs: move space_info to space-info.h (bsc#1165949).\n\n - btrfs: move the space info update macro to space-info.h\n (bsc#1165949).\n\n - btrfs: move the space_info handling code to space-info.c\n (bsc#1165949).\n\n - btrfs: move the subvolume reservation stuff out of\n extent-tree.c (bsc#1165949).\n\n - btrfs: only check priority tickets for priority flushing\n (bsc#1165949).\n\n - btrfs: only free reserved extent if we didn't insert it\n (bsc##1165949).\n\n - btrfs: only reserve metadata_size for inodes\n (bsc#1165949).\n\n - btrfs: only track ref_heads in delayed_ref_updates\n (bsc#1165949).\n\n - btrfs: pass root to various extent ref mod functions\n (bsc#1165949).\n\n - btrfs: qgroup: Do not hold qgroup_ioctl_lock in\n btrfs_qgroup_inherit() (bsc#1165823).\n\n - btrfs: qgroup: Mark qgroup inconsistent if we're\n inherting snapshot to a new qgroup (bsc#1165823).\n\n - btrfs: refactor block group replication factor\n calculation to a helper (bsc#1165949).\n\n - btrfs: refactor priority_reclaim_metadata_space\n (bsc#1165949).\n\n - btrfs: refactor the ticket wakeup code (bsc#1165949).\n\n - btrfs: release metadata before running delayed refs\n (bsc##1165949).\n\n - btrfs: remove orig_bytes from reserve_ticket\n (bsc#1165949).\n\n - btrfs: rename btrfs_space_info_add_old_bytes\n (bsc#1165949).\n\n - btrfs: rename do_chunk_alloc to btrfs_chunk_alloc\n (bsc#1165949).\n\n - btrfs: rename the btrfs_calc_*_metadata_size helpers\n (bsc#1165949).\n\n - btrfs: replace cleaner_delayed_iput_mutex with a\n waitqueue (bsc#1165949).\n\n - btrfs: reserve delalloc metadata differently\n (bsc#1165949).\n\n - btrfs: reserve extra space during evict (bsc#1165949).\n\n - btrfs: reset max_extent_size on clear in a bitmap\n (bsc##1165949).\n\n - btrfs: reset max_extent_size properly (bsc##1165949).\n\n - btrfs: rework btrfs_check_space_for_delayed_refs\n (bsc#1165949).\n\n - btrfs: rework wake_all_tickets (bsc#1165949).\n\n - btrfs: roll tracepoint into btrfs_space_info_update\n helper (bsc#1165949).\n\n - btrfs: run btrfs_try_granting_tickets if a priority\n ticket fails (bsc#1165949).\n\n - btrfs: run delayed iput at unlink time (bsc#1165949).\n\n - btrfs: run delayed iputs before committing\n (bsc#1165949).\n\n - btrfs: set max_extent_size properly (bsc##1165949).\n\n - btrfs: sink extent_write_full_page tree argument\n (bsc#1168273).\n\n - btrfs: sink extent_write_locked_range tree parameter\n (bsc#1168273).\n\n - btrfs: sink flush_fn to extent_write_cache_pages\n (bsc#1168273).\n\n - btrfs: sink get_extent parameter to\n extent_write_full_page (bsc#1168273).\n\n - btrfs: sink get_extent parameter to\n extent_write_locked_range (bsc#1168273).\n\n - btrfs: sink get_extent parameter to extent_fiemap\n (bsc#1168273).\n\n - btrfs: sink get_extent parameter to extent_readpages\n (bsc#1168273).\n\n - btrfs: sink get_extent parameter to extent_writepages\n (bsc#1168273).\n\n - btrfs: sink get_extent parameter to\n get_extent_skip_holes (bsc#1168273).\n\n - btrfs: sink writepage parameter to\n extent_write_cache_pages (bsc#1168273).\n\n - btrfs: stop partially refilling tickets when releasing\n space (bsc#1165949).\n\n - btrfs: stop using block_rsv_release_bytes everywhere\n (bsc#1165949).\n\n - btrfs: switch to on-stack csum buffer in csum_tree_block\n (bsc#1168273).\n\n - btrfs: temporarily export btrfs_get_restripe_target\n (bsc#1165949).\n\n - btrfs: temporarily export fragment_free_space\n (bsc#1165949).\n\n - btrfs: temporarily export inc_block_group_ro\n (bsc#1165949).\n\n - btrfs: track DIO bytes in flight (bsc#1165949).\n\n - btrfs: tree-checker: Remove comprehensive root owner\n check (bsc#1168273).\n\n - btrfs: unexport can_overcommit (bsc#1165949).\n\n - btrfs: unexport the temporary exported functions\n (bsc#1165949).\n\n - btrfs: unify error handling for ticket flushing\n (bsc#1165949).\n\n - btrfs: unify extent_page_data type passed as void\n (bsc#1168273).\n\n - btrfs: update may_commit_transaction to use the delayed\n refs rsv (bsc#1165949).\n\n - btrfs: use btrfs_try_granting_tickets in\n update_global_rsv (bsc#1165949).\n\n - btrfs: wait on caching when putting the bg cache\n (bsc#1165949).\n\n - btrfs: wait on ordered extents on abort cleanup\n (bsc#1165949).\n\n - btrfs: wakeup cleaner thread when adding delayed iput\n (bsc#1165949).\n\n - ceph: canonicalize server path in place (bsc#1168443).\n\n - ceph: check POOL_FLAG_FULL/NEARFULL in addition to\n OSDMAP_FULL/NEARFULL (bsc#1169307).\n\n - ceph: remove the extra slashes in the server path\n (bsc#1168443).\n\n - cfg80211: check reg_rule for NULL in\n handle_channel_custom() (bsc#1051510).\n\n - cfg80211: check wiphy driver existence for drvinfo\n report (bsc#1051510).\n\n - cgroup: memcg: net: do not associate sock with unrelated\n cgroup (bsc#1167290).\n\n - cifs: ignore cached share root handle closing errors\n (bsc#1166780).\n\n - clk: imx: Align imx sc clock msg structs to 4\n (bsc#1111666).\n\n - clk: imx: Align imx sc clock msg structs to 4\n (git-fixes).\n\n - clk: qcom: rcg: Return failure for RCG update\n (bsc#1051510).\n\n - configfs: Fix bool initialization/comparison\n (bsc#1051510).\n\n - cpufreq: Register drivers only after CPU devices have\n been registered (bsc#1051510).\n\n - cpuidle: Do not unset the driver if it is there already\n (bsc#1051510).\n\n - crypto: arm64/sha-ce - implement export/import\n (bsc#1051510).\n\n - crypto: mxs-dcp - fix scatterlist linearization for hash\n (bsc#1051510).\n\n - crypto: tcrypt - fix printed skcipher [a]sync mode\n (bsc#1051510).\n\n - debugfs: add support for more elaborate ->d_fsdata\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - debugfs: call debugfs_real_fops() only after\n debugfs_file_get() (bsc#1159198 bsc#1109911).\n Prerequisite for bsc#1159198.\n\n - debugfs: call debugfs_real_fops() only after\n debugfs_file_get() (bsc#1159198). Prerequisite for\n bsc#1159198.\n\n - debugfs: convert to debugfs_file_get() and -put()\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - debugfs: debugfs_real_fops(): drop __must_hold sparse\n annotation (bsc#1159198 bsc#1109911). Prerequisite for\n bsc#1159198.\n\n - debugfs: debugfs_use_start/finish do not exist anymore\n (bsc#1159198). Prerequisite for bsc#1159198.\n\n - debugfs: defer debugfs_fsdata allocation to first usage\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - debugfs: defer debugfs_fsdata allocation to first usage\n (bsc#1159198). Prerequisite for bsc#1159198.\n\n - debugfs: fix debugfs_real_fops() build error\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - debugfs: implement per-file removal protection\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - debugfs: purge obsolete SRCU based removal protection\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - debugfs: simplify __debugfs_remove_file() (bsc#1159198).\n Prerequisite for bsc#1159198.\n\n - dmaengine: ste_dma40: fix unneeded variable warning\n (bsc#1051510).\n\n - drm/amd/amdgpu: Fix GPR read from debugfs (v2)\n (bsc#1113956)\n\n - drm/amd/display: Add link_rate quirk for Apple 15' MBP\n 2017 (bsc#1111666).\n\n - drm/amd/display: Fix wrongly passed static prefix\n (bsc#1111666).\n\n - drm/amd/display: remove duplicated assignment to\n grph_obj_type (bsc#1051510).\n\n - drm/amdgpu: fix typo for vcn1 idle check (bsc#1111666).\n\n - drm/bochs: downgrade pci_request_region failure from\n error to warning (bsc#1051510).\n\n - drm/bridge: dw-hdmi: fix AVI frame colorimetry\n (bsc#1051510).\n\n - drm/drm_dp_mst:remove set but not used variable\n 'origlen' (bsc#1051510).\n\n - drm/exynos: dsi: fix workaround for the legacy clock\n name (bsc#1111666).\n\n - drm/exynos: dsi: propagate error value and silence\n meaningless warning (bsc#1111666).\n\n - drm/lease: fix WARNING in idr_destroy (bsc#1113956)\n\n - drm/msm: Set dma maximum segment size for mdss\n (bsc#1051510).\n\n - drm/msm: Use the correct dma_sync calls harder\n (bsc#1051510).\n\n - drm/msm: Use the correct dma_sync calls in msm_gem\n (bsc#1051510).\n\n - drm/msm: stop abusing dma_map/unmap for cache\n (bsc#1051510).\n\n - drm/sun4i: dsi: Use NULL to signify 'no panel'\n (bsc#1111666).\n\n - drm/v3d: Replace wait_for macros to remove use of msleep\n (bsc#1111666).\n\n - drm/vc4: Fix HDMI mode validation (git-fixes).\n\n - drm_dp_mst_topology: fix broken\n drm_dp_sideband_parse_remote_dpcd_read() (bsc#1051510).\n\n - dt-bindings: allow up to four clocks for orion-mdio\n (bsc#1051510).\n\n - efi: Do not attempt to map RCI2 config table if it does\n not exist (jsc#ECO-366, bsc#1168367).\n\n - efi: Export Runtime Configuration Interface table to\n sysfs (jsc#ECO-366, bsc#1168367).\n\n - efi: Fix a race and a buffer overflow while reading\n efivars via sysfs (bsc#1164893).\n\n - efi: x86: move efi_is_table_address() into arch/x86\n (jsc#ECO-366, bsc#1168367).\n\n - ext4: Avoid ENOSPC when avoiding to reuse recently\n deleted inodes (bsc#1165019).\n\n - ext4: Check for non-zero journal inum in\n ext4_calculate_overhead (bsc#1167288).\n\n - ext4: add cond_resched() to __ext4_find_entry()\n (bsc#1166862).\n\n - ext4: do not assume that mmp_nodename/bdevname have NUL\n (bsc#1166860).\n\n - ext4: fix a data race in EXT4_I(inode)->i_disksize\n (bsc#1166861).\n\n - ext4: fix incorrect group count in ext4_fill_super error\n message (bsc#1168765).\n\n - ext4: fix incorrect inodes per group in error message\n (bsc#1168764).\n\n - ext4: fix potential race between online resizing and\n write operations (bsc#1166864).\n\n - ext4: fix potential race between s_flex_groups online\n resizing and access (bsc#1166867).\n\n - ext4: fix potential race between s_group_info online\n resizing and access (bsc#1166866).\n\n - ext4: fix race between writepages and enabling\n EXT4_EXTENTS_FL (bsc#1166870).\n\n - ext4: fix support for inode sizes > 1024 bytes\n (bsc#1164284).\n\n - ext4: potential crash on allocation error in\n ext4_alloc_flex_bg_array() (bsc#1166940).\n\n - ext4: rename s_journal_flag_rwsem to s_writepages_rwsem\n (bsc#1166868).\n\n - ext4: validate the debug_want_extra_isize mount option\n at parse time (bsc#1163897).\n\n - fat: fix uninit-memory access for partial initialized\n inode (bsc#1051510).\n\n - fat: work around race with userspace's read via blockdev\n while mounting (bsc#1051510).\n\n - fbdev/g364fb: Fix build failure (bsc#1051510).\n\n - fbdev: potential information leak in do_fb_ioctl()\n (bsc#1114279)\n\n - fbmem: Adjust indentation in fb_prepare_logo and\n fb_blank (bsc#1114279)\n\n - firmware: arm_sdei: fix double-lock on hibernate with\n shared events (bsc#1111666).\n\n - firmware: arm_sdei: fix possible double-lock on\n hibernate error path (bsc#1111666).\n\n - ftrace/kprobe: Show the maxactive number on\n kprobe_events (git-fixes).\n\n - i2c: hix5hd2: add missed clk_disable_unprepare in remove\n (bsc#1051510).\n\n - i2c: jz4780: silence log flood on txabrt (bsc#1051510).\n\n - ibmvfc: do not send implicit logouts prior to NPIV login\n (bsc#1169625 ltc#184611).\n\n - iio: gyro: adis16136: check ret val for non-zero vs\n less-than-zero (bsc#1051510).\n\n - iio: imu: adis16400: check ret val for non-zero vs\n less-than-zero (bsc#1051510).\n\n - iio: imu: adis16480: check ret val for non-zero vs\n less-than-zero (bsc#1051510).\n\n - iio: imu: adis: check ret val for non-zero vs\n less-than-zero (bsc#1051510).\n\n - iio: magnetometer: ak8974: Fix negative raw values in\n sysfs (bsc#1051510).\n\n - iio: potentiostat: lmp9100: fix\n iio_triggered_buffer_(predisable,postenable) positions\n (bsc#1051510).\n\n - intel_th: Fix user-visible error codes (bsc#1051510).\n\n - intel_th: pci: Add Elkhart Lake CPU support\n (bsc#1051510).\n\n - iommu/amd: Fix the configuration of GCR3 table root\n pointer (bsc#1169057).\n\n - ipmi: fix hung processes in __get_guid() (bsc#1111666).\n\n - ipmi:ssif: Handle a possible NULL pointer reference\n (bsc#1051510).\n\n - ipvlan: do not add hardware address of master to its\n unicast filter list (bsc#1137325).\n\n - irqchip/bcm2835: Quiesce IRQs left enabled by bootloader\n (bsc#1051510).\n\n - irqdomain: Fix a memory leak in irq_domain_push_irq()\n (bsc#1051510).\n\n - kABI workaround for pcie_port_bus_type change\n (bsc#1161561).\n\n - kABI: fixes for debugfs per-file removal protection\n backports (bsc#1159198 bsc#1109911). \n\n - kABI: restore debugfs_remove_recursive() (bsc#1159198).\n\n - kabi fix for (bsc#1168202).\n\n - libceph: fix alloc_msg_with_page_vector() memory leaks\n (bsc#1169308).\n\n - libfs: fix infoleak in simple_attr_read() (bsc#1168881).\n\n - lpfc: add support for translating an RSCN rcv into a\n discovery rescan (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - lpfc: add support to generate RSCN events for nport\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - mac80211: Do not send mesh HWMP PREQ if HWMP is disabled\n (bsc#1051510).\n\n - mac80211: consider more elements in parsing CRC\n (bsc#1051510).\n\n - mac80211: free peer keys before vif down in mesh\n (bsc#1051510).\n\n - mac80211: mesh: fix RCU warning (bsc#1051510).\n\n - mac80211: only warn once on chanctx_conf being NULL\n (bsc#1051510).\n\n - mac80211: rx: avoid RCU list traversal under mutex\n (bsc#1051510).\n\n - macsec: add missing attribute validation for port\n (bsc#1051510).\n\n - macsec: fix refcnt leak in module exit routine\n (bsc#1051510).\n\n - media: dib0700: fix rc endpoint lookup (bsc#1051510).\n\n - media: flexcop-usb: fix endpoint sanity check\n (git-fixes).\n\n - media: go7007: Fix URB type for interrupt handling\n (bsc#1051510).\n\n - media: ov519: add missing endpoint sanity checks\n (bsc#1168829).\n\n - media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY\n support (bsc#1051510).\n\n - media: ov6650: Fix some format attributes not under\n control (bsc#1051510).\n\n - media: ov6650: Fix stored crop rectangle not in sync\n with hardware (bsc#1051510).\n\n - media: ov6650: Fix stored frame format not in sync with\n hardware (bsc#1051510).\n\n - media: stv06xx: add missing descriptor sanity checks\n (bsc#1168854).\n\n - media: tda10071: fix unsigned sign extension overflow\n (bsc#1051510).\n\n - media: usbtv: fix control-message timeouts\n (bsc#1051510).\n\n - media: v4l2-core: fix entity initialization in\n device_register_subdev (bsc#1051510).\n\n - media: vsp1: tidyup VI6_HGT_LBn_H() macro (bsc#1051510).\n\n - media: xirlink_cit: add missing descriptor sanity checks\n (bsc#1051510).\n\n - mfd: dln2: Fix sanity checking for endpoints\n (bsc#1051510).\n\n - misc: pci_endpoint_test: Fix to support > 10\n pci-endpoint-test devices (bsc#1051510).\n\n - mm/filemap.c: do not initiate writeback if mapping has\n no dirty pages (bsc#1168884).\n\n - mm/memory_hotplug.c: only respect mem= parameter during\n boot stage (bsc#1065600).\n\n - mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2\n (bsc#1051510).\n\n - mwifiex: set needed_headroom, not hard_header_len\n (bsc#1051510).\n\n - net/nfc: Avoid stalls when nfc_alloc_send_skb() returned\n NULL (bsc#1051510).\n\n - net/sched: flower: add missing validation of\n TCA_FLOWER_FLAGS (networking-stable-20_02_19).\n\n - net/sched: matchall: add missing validation of\n TCA_MATCHALL_FLAGS (networking-stable-20_02_19).\n\n - net/smc: fix leak of kernel memory to user space\n (networking-stable-20_02_19).\n\n - net: dsa: tag_qca: Make sure there is headroom for tag\n (networking-stable-20_02_19).\n\n - net: ena: Add PCI shutdown handler to allow safe kexec\n (bsc#1167421, bsc#1167423).\n\n - net: nfc: fix bounds checking bugs on 'pipe'\n (bsc#1051510).\n\n - net: phy: micrel: kszphy_resume(): add delay after\n genphy_resume() before accessing PHY registers\n (bsc#1051510).\n\n - net_sched: keep alloc_hash updated after hash allocation\n (git-fixes).\n\n - netfilter: conntrack: sctp: use distinct states for new\n SCTP connections (bsc#1159199).\n\n - nvme-multipath: also check for a disabled path if there\n is a single sibling (bsc#1158983).\n\n - nvme-multipath: do not select namespaces which are about\n to be removed (bsc#1158983).\n\n - nvme-multipath: factor out a nvme_path_is_disabled\n helper (bsc#1158983).\n\n - nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths\n (bsc#1158983).\n\n - nvme-multipath: fix possible I/O hang when paths are\n updated (bsc#1158983).\n\n - nvme-multipath: fix possible io hang after ctrl\n reconnect (bsc#1158983).\n\n - nvme-multipath: remove unused groups_only mode in ana\n log (bsc#1158983).\n\n - nvme-multipath: round-robin I/O policy (bsc#1158983).\n\n - nvme: fix a possible deadlock when passthru commands\n sent to a multipath device (bsc#1158983).\n\n - nvme: fix controller removal race with scan work\n (bsc#1158983).\n\n - objtool: Add is_static_jump() helper (bsc#1169514).\n\n - objtool: Add relocation check for alternative sections\n (bsc#1169514).\n\n - partitions/efi: Fix partition name parsing in GUID\n partition entry (bsc#1168763).\n\n - perf/amd/uncore: Replace manual sampling check with\n CAP_NO_INTERRUPT flag (bsc#1114279).\n\n - perf: qcom_l2: fix column exclusion check (git-fixes).\n\n - pinctrl: core: Remove extra kref_get which blocks hogs\n being freed (bsc#1051510).\n\n - platform/x86: pmc_atom: Add Lex 2I385SW to\n critclk_systems DMI table (bsc#1051510).\n\n - powerpc/64/tm: Do not let userspace set regs->trap via\n sigreturn (bsc#1118338 ltc#173734).\n\n - powerpc/64: mark start_here_multiplatform as __ref\n (bsc#1148868).\n\n - powerpc/64s: Fix section mismatch warnings from boot\n code (bsc#1148868).\n\n - powerpc/hash64/devmap: Use H_PAGE_THP_HUGE when setting\n up huge devmap PTE entries (bsc#1065729).\n\n - powerpc/kprobes: Ignore traps that happened in real mode\n (bsc#1065729).\n\n - powerpc/mm: Fix section mismatch warning in\n stop_machine_change_mapping() (bsc#1148868).\n\n - powerpc/pseries/ddw: Extend upper limit for huge DMA\n window for persistent memory (bsc#1142685 ltc#179509).\n\n - powerpc/pseries/iommu: Fix set but not used values\n (bsc#1142685 ltc#179509).\n\n - powerpc/pseries/iommu: Use memory@ nodes in max RAM\n address calculation (bsc#1142685 ltc#179509).\n\n - powerpc/vmlinux.lds: Explicitly retain .gnu.hash\n (bsc#1148868).\n\n - powerpc/xive: Replace msleep(x) with\n msleep(OPAL_BUSY_DELAY_MS) (bsc#1085030).\n\n - powerpc/xive: Use XIVE_BAD_IRQ instead of zero to catch\n non configured IPIs (bsc#1085030).\n\n - pwm: bcm2835: Dynamically allocate base (bsc#1051510).\n\n - pwm: meson: Fix confusing indentation (bsc#1051510).\n\n - pwm: pca9685: Fix PWM/GPIO inter-operation\n (bsc#1051510).\n\n - pwm: rcar: Fix late Runtime PM enablement (bsc#1051510).\n\n - pwm: renesas-tpu: Fix late Runtime PM enablement\n (bsc#1051510).\n\n - pxa168fb: fix release function mismatch in probe failure\n (bsc#1051510).\n\n - qmi_wwan: unconditionally reject 2 ep interfaces\n (bsc#1051510).\n\n - rtlwifi: rtl8192de: Fix missing callback that tests for\n hw release of buffer (git-fixes).\n\n - s390/mm: fix dynamic pagetable upgrade for hugetlbfs\n (bsc#1165182 LTC#184102).\n\n - s390/qeth: fix potential deadlock on workqueue flush\n (bsc#1165185 LTC#184108).\n\n - scsi: core: avoid repetitive logging of device offline\n messages (bsc#1145929).\n\n - scsi: core: kABI fix offline_already (bsc#1145929).\n\n - scsi: fc: Update Descriptor definition and add RDF and\n Link Integrity FPINs (bsc#1164777 bsc#1164780\n bsc#1165211).\n\n - scsi: ibmvfc: Fix NULL return compiler warning\n (bsc#1161951 ltc#183551). \n\n - scsi: lpfc: Change default SCSI LUN QD to 64\n (bsc#1164777 bsc#1164780 bsc#1165211 jsc#SLE-8654). \n\n - scsi: lpfc: Clean up hba max_lun_queue_depth checks\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Copyright updates for 12.6.0.4 patches\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix Fabric hostname registration if system\n hostname changes (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix MDS Latency Diagnostics Err-drop rates\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix RQ buffer leakage when no IOCBs\n available (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix broken Credit Recovery after driver load\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix compiler warning on frame size\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix coverity errors in fmdi attribute\n handling (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix crash after handling a pci error\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix crash in target side cable pulls hitting\n WAIT_FOR_UNREG (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix disablement of FC-AL on lpe35000 models\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix driver nvme rescan logging (bsc#1164777\n bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix erroneous cpu limit of 128 on I/O\n statistics (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix improper flag check for IO type\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix incomplete NVME discovery when target\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix kasan slab-out-of-bounds error in\n lpfc_unreg_login (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix lockdep error - register non-static key\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix lpfc overwrite of sg_cnt field in\n nvmefc_tgt_fcp_req (bsc#1164777 bsc#1164780\n bsc#1165211).\n\n - scsi: lpfc: Fix lpfc_io_buf resource leak in\n lpfc_get_scsi_buf_s4 error path (bsc#1164777 bsc#1164780\n bsc#1165211).\n\n - scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set\n func (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix missing check for CSF in Write Object\n Mbox Rsp (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix ras_log via debugfs (bsc#1164777\n bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix registration of ELS type support in fdmi\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix release of hwq to clear the eq\n relationship (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix scsi host template for SLI3 vports\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix unmap of dpp bars affecting next driver\n load (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix update of wq consumer index in\n lpfc_sli4_wq_release (bsc#1164777 bsc#1164780\n bsc#1165211).\n\n - scsi: lpfc: Fix: Rework setting of fdmi symbolic node\n name registration (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Make debugfs ktime stats generic for NVME\n and SCSI (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Make lpfc_defer_acc_rsp static (bsc#1164777\n bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Remove handler for obsolete ELS - Read Port\n Status (RPS) (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Remove prototype FIPS/DSS options from SLI-3\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Update lpfc version to 12.6.0.3 (bsc#1164777\n bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Update lpfc version to 12.6.0.4 (bsc#1164777\n bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Update lpfc version to 12.8.0.0 (bsc#1164777\n bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: add RDF registration and Link Integrity FPIN\n logging (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: fix spelling mistake 'Notication' ->\n 'Notification' (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: fix spelling mistakes of asynchronous\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: qla2xxx: Fix I/Os being passed down when FC device\n is being deleted (bsc#1157424).\n\n - serdev: ttyport: restore client ops on deregistration\n (bsc#1051510).\n\n - staging: ccree: use signal safe completion wait\n (git-fixes).\n\n - staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device\n table (bsc#1051510).\n\n - staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi\n (bsc#1051510).\n\n - staging: wlan-ng: fix ODEBUG bug in\n prism2sta_disconnect_usb (bsc#1051510).\n\n - staging: wlan-ng: fix use-after-free Read in\n hfa384x_usbin_callback (bsc#1051510).\n\n - swiotlb: do not panic on mapping failures (bsc#1162171).\n\n - swiotlb: remove the overflow buffer (bsc#1162171).\n\n - thermal: devfreq_cooling: inline all stubs for\n CONFIG_DEVFREQ_THERMAL=n (bsc#1051510).\n\n - tpm: ibmvtpm: Wait for buffer to be set before\n proceeding (bsc#1065729).\n\n - tty/serial: atmel: manage shutdown in case of RS485 or\n ISO7816 mode (bsc#1051510).\n\n - tty: evh_bytechan: Fix out of bounds accesses\n (bsc#1051510).\n\n - tty: serial: imx: setup the correct sg entry for tx dma\n (bsc#1051510).\n\n - usb: audio-v2: Add uac2_effect_unit_descriptor\n definition (bsc#1051510).\n\n - usb: core: hub: do error out if\n usb_autopm_get_interface() fails (git-fixes).\n\n - usb: core: port: do error out if\n usb_autopm_get_interface() fails (git-fixes).\n\n - usb: dwc2: Fix in ISOC request length checking\n (git-fixes).\n\n - usb: gadget: composite: Fix bMaxPower for SuperSpeedPlus\n (git-fixes).\n\n - usb: gadget: f_fs: Fix use after free issue as part of\n queue failure (bsc#1051510).\n\n - usb: host: xhci-plat: add a shutdown (git-fixes).\n\n - usb: musb: Disable pullup at init (git-fixes).\n\n - usb: musb: fix crash with highmen PIO and usbmon\n (bsc#1051510).\n\n - usb: quirks: add NO_LPM quirk for Logitech Screen Share\n (git-fixes).\n\n - usb: quirks: add NO_LPM quirk for RTL8153 based ethernet\n adapters (git-fixes).\n\n - usb: storage: Add quirk for Samsung Fit flash\n (git-fixes).\n\n - usb: uas: fix a plug & unplug racing (git-fixes).\n\n - usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI\n controller 1022:145c (git-fixes).\n\n - virtio-blk: improve virtqueue error to BLK_STS\n (bsc#1167627).\n\n - virtio_ring: fix unmap of indirect descriptors\n (bsc#1162171).\n\n - x86/mce: Fix logic and comments around MSR_PPIN_CTL\n (bsc#1114279).\n\n - x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve\n existing changes (bsc#1114279).\n\n - xen/blkfront: fix memory allocation flags in\n blkfront_setup_indirect() (bsc#1168486).\n\n - xhci: Do not open code __print_symbolic() in xhci trace\n events (git-fixes).\n\n - xhci: apply XHCI_PME_STUCK_QUIRK to Intel Comet Lake\n platforms (git-fixes).", "edition": 3, "cvss3": {"score": 8.2, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}, "published": "2020-04-27T00:00:00", "title": "openSUSE Security Update : the Linux Kernel (openSUSE-2020-543)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-11494", "CVE-2019-19770", "CVE-2020-10942", "CVE-2020-8834", "CVE-2019-3701", "CVE-2019-9458", "CVE-2020-11669"], "modified": "2020-04-27T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:kernel-source", "p-cpe:/a:novell:opensuse:kernel-source-vanilla", "p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource", "p-cpe:/a:novell:opensuse:kernel-vanilla-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-debug-debuginfo", "p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default-debugsource", "p-cpe:/a:novell:opensuse:kernel-vanilla-devel-debuginfo", "cpe:/o:novell:opensuse:15.1", "p-cpe:/a:novell:opensuse:kernel-default-debuginfo", "p-cpe:/a:novell:opensuse:kernel-vanilla-base", "p-cpe:/a:novell:opensuse:kernel-kvmsmall", "p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo", "p-cpe:/a:novell:opensuse:kernel-kvmsmall-devel-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default-devel", "p-cpe:/a:novell:opensuse:kernel-devel", "p-cpe:/a:novell:opensuse:kernel-kvmsmall-devel", "p-cpe:/a:novell:opensuse:kernel-docs-html", "p-cpe:/a:novell:opensuse:kernel-obs-qa", "p-cpe:/a:novell:opensuse:kernel-kvmsmall-base", "p-cpe:/a:novell:opensuse:kernel-macros", "p-cpe:/a:novell:opensuse:kernel-syms", "p-cpe:/a:novell:opensuse:kernel-vanilla", "p-cpe:/a:novell:opensuse:kernel-kvmsmall-debugsource", "p-cpe:/a:novell:opensuse:kernel-vanilla-devel", "p-cpe:/a:novell:opensuse:kernel-debug-base", "p-cpe:/a:novell:opensuse:kernel-debug-debugsource", "p-cpe:/a:novell:opensuse:kernel-kvmsmall-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default", "p-cpe:/a:novell:opensuse:kernel-debug-devel", "p-cpe:/a:novell:opensuse:kernel-kvmsmall-debuginfo", "p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-debug", "p-cpe:/a:novell:opensuse:kernel-obs-build-debugsource", "p-cpe:/a:novell:opensuse:kernel-default-base", "p-cpe:/a:novell:opensuse:kernel-obs-build", "p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default-devel-debuginfo"], "id": "OPENSUSE-2020-543.NASL", "href": "https://www.tenable.com/plugins/nessus/136006", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2020-543.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(136006);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/04/30\");\n\n script_cve_id(\"CVE-2019-19770\", \"CVE-2019-3701\", \"CVE-2019-9458\", \"CVE-2020-10942\", \"CVE-2020-11494\", \"CVE-2020-11669\", \"CVE-2020-8834\");\n\n script_name(english:\"openSUSE Security Update : the Linux Kernel (openSUSE-2020-543)\");\n script_summary(english:\"Check for the openSUSE-2020-543 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The openSUSE Leap 15.1 kernel was updated to receive various security\nand bugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2020-11669: An issue was discovered on the powerpc\n platform. arch/powerpc/kernel/idle_book3s.S did not have\n save/restore functionality for PNV_POWERSAVE_AMR,\n PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka\n CID-53a712bae5dd (bnc#1169390).\n\n - CVE-2020-8834: KVM on Power8 processors had a\n conflicting use of HSTATE_HOST_R1 to store r1 state in\n kvmppc_hv_entry plus in kvmppc_(save,restore)_tm,\n leading to a stack corruption. Because of this, an\n attacker with the ability run code in kernel space of a\n guest VM can cause the host kernel to panic. There were\n two commits that, according to the reporter, introduced\n the vulnerability: f024ee098476 ('KVM: PPC: Book3S HV:\n Pull out TM state save/restore into separate\n procedures') 87a11bb6a7f7 ('KVM: PPC: Book3S HV: Work\n around XER[SO] bug in fake suspend mode') (bnc#1168276).\n\n - CVE-2020-11494: An issue was discovered in slc_bump in\n drivers/net/can/slcan.c, which allowed attackers to read\n uninitialized can_frame data, potentially containing\n sensitive information from kernel stack memory, if the\n configuration lacks CONFIG_INIT_STACK_ALL, aka\n CID-b9258a2cece4 (bnc#1168424).\n\n - CVE-2019-9458: In the video driver there is a use after\n free due to a race condition. This could lead to local\n escalation of privilege with no additional execution\n privileges needed. User interaction is not needed for\n exploitation (bnc#1168295).\n\n - CVE-2019-3701: An issue was discovered in can_can_gw_rcv\n in net/can/gw.c. The CAN frame modification rules allow\n bitwise logical operations that can be also applied to\n the can_dlc field. The privileged user 'root' with\n CAP_NET_ADMIN can create a CAN frame modification rule\n that made the data length code a higher value than the\n available CAN frame data size. In combination with a\n configured checksum calculation where the result is\n stored relatively to the end of the data (e.g.\n cgw_csum_xor_rel) the tail of the skb (e.g. frag_list\n pointer in skb_shared_info) can be rewritten which\n finally can cause a system crash. Because of a missing\n check, the CAN drivers may write arbitrary content\n beyond the data registers in the CAN controller's I/O\n memory when processing can-gw manipulated outgoing\n frames (bnc#1120386).\n\n - CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c\n lacked validation of an sk_family field, which might\n allow attackers to trigger kernel stack corruption via\n crafted system calls (bnc#1167629).\n\n - CVE-2019-19770: A use-after-free in the debugfs_remove\n function in fs/debugfs/inode.c was fixed. (bnc#1159198).\n\nThe following non-security bugs were fixed :\n\n - ACPI: watchdog: Fix gas->access_width usage\n (bsc#1051510).\n\n - ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro\n (bsc#1051510).\n\n - ALSA: ali5451: remove redundant variable capture_flag\n (bsc#1051510).\n\n - ALSA: core: Add snd_device_get_state() helper\n (bsc#1051510).\n\n - ALSA: core: Replace zero-length array with\n flexible-array member (bsc#1051510).\n\n - ALSA: emu10k1: Fix endianness annotations (bsc#1051510).\n\n - ALSA: hda/ca0132 - Add Recon3Di quirk to handle\n integrated sound on EVGA X99 Classified motherboard\n (bsc#1051510).\n\n - ALSA: hda/ca0132 - Replace zero-length array with\n flexible-array member (bsc#1051510).\n\n - ALSA: hda/realtek - Enable headset mic of Acer X2660G\n with ALC662 (git-fixes).\n\n - ALSA: hda/realtek - Enable the headset of Acer N50-600\n with ALC662 (git-fixes).\n\n - ALSA: hda/realtek - Remove now-unnecessary XPS 13\n headphone noise fixups (bsc#1051510).\n\n - ALSA: hda/realtek - Set principled PC Beep configuration\n for ALC256 (bsc#1051510).\n\n - ALSA: hda/realtek - a fake key event is triggered by\n running shutup (bsc#1051510).\n\n - ALSA: hda/realtek: Enable mute LED on an HP system\n (bsc#1051510).\n\n - ALSA: hda/realtek: Fix pop noise on ALC225 (git-fixes).\n\n - ALSA: hda: Fix potential access overflow in beep helper\n (bsc#1051510).\n\n - ALSA: hda: Use scnprintf() for string truncation\n (bsc#1051510).\n\n - ALSA: hda: default enable CA0132 DSP support\n (bsc#1051510).\n\n - ALSA: hda: remove redundant assignment to variable\n timeout (bsc#1051510).\n\n - ALSA: hda_codec: Replace zero-length array with\n flexible-array member (bsc#1051510).\n\n - ALSA: hdsp: remove redundant assignment to variable err\n (bsc#1051510).\n\n - ALSA: ice1724: Fix invalid access for enumerated ctl\n items (bsc#1051510).\n\n - ALSA: info: remove redundant assignment to variable c\n (bsc#1051510).\n\n - ALSA: korg1212: fix if-statement empty body warnings\n (bsc#1051510).\n\n - ALSA: line6: Fix endless MIDI read loop (git-fixes).\n\n - ALSA: pcm.h: add for_each_pcm_streams() (bsc#1051510).\n\n - ALSA: pcm: Fix superfluous snprintf() usage\n (bsc#1051510).\n\n - ALSA: pcm: Use a macro for parameter masks to reduce the\n needed cast (bsc#1051510).\n\n - ALSA: pcm: oss: Avoid plugin buffer overflow\n (git-fixes).\n\n - ALSA: pcm: oss: Fix regression by buffer overflow fix\n (bsc#1051510).\n\n - ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc()\n checks (git-fixes).\n\n - ALSA: pcm: oss: Unlock mutex temporarily for sleeping at\n read/write (bsc#1051510).\n\n - ALSA: seq: oss: Fix running status after receiving sysex\n (git-fixes).\n\n - ALSA: seq: virmidi: Fix running status after receiving\n sysex (git-fixes).\n\n - ALSA: usb-audio: Add delayed_register option\n (bsc#1051510).\n\n - ALSA: usb-audio: Add support for MOTU MicroBook IIc\n (bsc#1051510).\n\n - ALSA: usb-audio: Create a registration quirk for\n Kingston HyperX Amp (0951:16d8) (bsc#1051510).\n\n - ALSA: usb-audio: Do not create a mixer element with\n bogus volume range (bsc#1051510).\n\n - ALSA: usb-audio: Fix case when USB MIDI interface has\n more than one extra endpoint descriptor (bsc#1051510).\n\n - ALSA: usb-audio: Fix mixer controls' USB interface for\n Kingston HyperX Amp (0951:16d8) (bsc#1051510).\n\n - ALSA: usb-audio: Inform devices that need delayed\n registration (bsc#1051510).\n\n - ALSA: usb-audio: Parse source ID of UAC2 effect unit\n (bsc#1051510).\n\n - ALSA: usb-audio: Rewrite registration quirk handling\n (bsc#1051510).\n\n - ALSA: usb-midi: Replace zero-length array with\n flexible-array member (bsc#1051510).\n\n - ALSA: usx2y: use for_each_pcm_streams() macro\n (bsc#1051510).\n\n - ALSA: via82xx: Fix endianness annotations (bsc#1051510).\n\n - ASoC: Intel: atom: Take the drv->lock mutex before\n calling sst_send_slot_map() (bsc#1051510).\n\n - ASoC: Intel: mrfld: fix incorrect check on p->sink\n (bsc#1051510).\n\n - ASoC: Intel: mrfld: return error codes when an error\n occurs (bsc#1051510).\n\n - ASoC: jz4740-i2s: Fix divider written at incorrect\n offset in register (bsc#1051510).\n\n - ASoC: sun8i-codec: Remove unused dev from codec struct\n (bsc#1051510).\n\n - Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl\n (bsc#1051510).\n\n - Btrfs: clean up error handling in btrfs_truncate()\n (bsc#1165949).\n\n - Btrfs: do not reset bio->bi_ops while writing bio\n (bsc#1168273).\n\n - Btrfs: fix missing delayed iputs on unmount\n (bsc#1165949).\n\n - Btrfs: fix qgroup double free after failure to reserve\n metadata for delalloc (bsc#1165949).\n\n - Btrfs: fix race leading to metadata space leak after\n task received signal (bsc#1165949).\n\n - Btrfs: fix unwritten extent buffers and hangs on future\n writeback attempts (bsc#1168273).\n\n - Btrfs: make plug in writing meta blocks really work\n (bsc#1168273).\n\n - Btrfs: only check delayed ref usage in\n should_end_transaction (bsc#1165949).\n\n - Btrfs: remove bio_flags which indicates a meta block of\n log-tree (bsc#1168273).\n\n - Crypto: chelsio - Fixes a deadlock between rtnl_lock and\n uld_mutex (bsc#1111666).\n\n - Crypto: chelsio - Fixes a hang issue during driver\n registration (bsc#1111666).\n\n - Deprecate NR_UNSTABLE_NFS, use NR_WRITEBACK\n (bsc#1163403).\n\n - HID: apple: Add support for recent firmware on Magic\n Keyboards (bsc#1051510).\n\n - IB/hfi1: convert to debugfs_file_get() and -put()\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - Input: add safety guards to input_set_keycode()\n (bsc#1168075).\n\n - Input: avoid BIT() macro usage in the serio.h UAPI\n header (bsc#1051510).\n\n - Input: raydium_i2c_ts - fix error codes in\n raydium_i2c_boot_trigger() (bsc#1051510).\n\n - Input: synaptics - enable RMI on HP Envy 13-ad105ng\n (bsc#1051510).\n\n - MM: replace PF_LESS_THROTTLE with PF_LOCAL_THROTTLE\n (bsc#1163403).\n\n - NFC: fdp: Fix a signedness bug in fdp_nci_send_patch()\n (bsc#1051510).\n\n - NFS: send state management on a single connection\n (bsc#1167005).\n\n - OMAP: DSS2: remove non-zero check on variable r\n (bsc#1114279)\n\n - PCI/AER: Factor message prefixes with dev_fmt()\n (bsc#1161561).\n\n - PCI/AER: Log which device prevents error recovery\n (bsc#1161561).\n\n - PCI/AER: Remove ERR_FATAL code from ERR_NONFATAL path\n (bsc#1161561).\n\n - PCI/ASPM: Clear the correct bits when enabling L1\n substates (bsc#1051510).\n\n - PCI/ERR: Always report current recovery status for udev\n (bsc#1161561).\n\n - PCI/ERR: Handle fatal error recovery (bsc#1161561).\n\n - PCI/ERR: Remove duplicated include from err.c\n (bsc#1161561).\n\n - PCI/ERR: Simplify broadcast callouts (bsc#1161561).\n\n - PCI/portdrv: Remove pcie_port_bus_type link order\n dependency (bsc#1161561).\n\n - PCI/switchtec: Fix init_completion race condition with\n poll_wait() (bsc#1051510).\n\n - PCI: Simplify disconnected marking (bsc#1161561).\n\n - PCI: Unify device inaccessible (bsc#1161561).\n\n - PCI: endpoint: Fix clearing start entry in configfs\n (bsc#1051510).\n\n - PCI: pciehp: Fix MSI interrupt race (bsc#1159037).\n\n - PCI: portdrv: Initialize service drivers directly\n (bsc#1161561).\n\n - PM: core: Fix handling of devices deleted during\n system-wide resume (git-fixes).\n\n - SUNRPC: defer slow parts of rpc_free_client() to a\n workqueue (bsc#1168202).\n\n - USB: Disable LPM on WD19's Realtek Hub (git-fixes).\n\n - USB: Fix novation SourceControl XL after suspend\n (git-fixes).\n\n - USB: cdc-acm: fix rounding error in TIOCSSERIAL\n (git-fixes).\n\n - USB: hub: Do not record a connect-change event during\n reset-resume (git-fixes).\n\n - USB: misc: iowarrior: add support for 2 OEMed devices\n (git-fixes).\n\n - USB: misc: iowarrior: add support for the 100 device\n (git-fixes).\n\n - USB: misc: iowarrior: add support for the 28 and 28L\n devices (git-fixes).\n\n - USB: serial: io_edgeport: fix slab-out-of-bounds read in\n edge_interrupt_callback (bsc#1051510).\n\n - USB: serial: option: add ME910G1 ECM composition 0x110b\n (git-fixes).\n\n - USB: serial: pl2303: add device-id for HP LD381\n (git-fixes).\n\n - ahci: Add support for Amazon's Annapurna Labs SATA\n controller (bsc#1169013).\n\n - apei/ghes: Do not delay GHES polling (bsc#1166982).\n\n - ath9k: Handle txpower changes even when TPC is disabled\n (bsc#1051510).\n\n - batman-adv: Avoid spurious warnings from bat_v neigh_cmp\n implementation (bsc#1051510).\n\n - batman-adv: Do not schedule OGM for disabled interface\n (bsc#1051510).\n\n - batman-adv: prevent TT request storms by not sending\n inconsistent TT TLVLs (bsc#1051510).\n\n - binfmt_elf: Do not move brk for INTERP-less ET_EXEC\n (bsc#1169013).\n\n - binfmt_elf: move brk out of mmap when doing direct\n loader exec (bsc#1169013).\n\n - blk-mq: Allow blocking queue tag iter callbacks\n (bsc#1167316).\n\n - block, bfq: fix use-after-free in\n bfq_idle_slice_timer_body (bsc#1168760).\n\n - block: keep bdi->io_pages in sync with max_sectors_kb\n for stacked devices (bsc#1168762).\n\n - bnxt_en: Support all variants of the 5750X chip family\n (bsc#1167216).\n\n - bpf: Explicitly memset some bpf info structures declared\n on the stack (bsc#1083647).\n\n - bpf: Explicitly memset the bpf_attr structure\n (bsc#1083647).\n\n - brcmfmac: abort and release host after error\n (bsc#1111666).\n\n - btrfs: Account for trans_block_rsv in\n may_commit_transaction (bsc#1165949).\n\n - btrfs: Add enospc_debug printing in\n metadata_reserve_bytes (bsc#1165949).\n\n - btrfs: Do mandatory tree block check before submitting\n bio (bsc#1168273).\n\n - btrfs: Improve global reserve stealing logic\n (bsc#1165949).\n\n - btrfs: Output ENOSPC debug info in inc_block_group_ro\n (bsc#1165949).\n\n - btrfs: Remove btrfs_inode::delayed_iput_count\n (bsc#1165949).\n\n - btrfs: Remove fs_info from do_chunk_alloc (bsc#1165949).\n\n - btrfs: Remove redundant argument of flush_space\n (bsc#1165949).\n\n - btrfs: Remove redundant mirror_num arg (bsc#1168273).\n\n - btrfs: Rename bin_search -> btrfs_bin_search\n (bsc#1168273).\n\n - btrfs: add a flush step for delayed iputs (bsc#1165949).\n\n - btrfs: add assertions for releasing trans handle\n reservations (bsc#1165949).\n\n - btrfs: add btrfs_delete_ref_head helper (bsc#1165949).\n\n - btrfs: add enospc debug messages for ticket failure\n (bsc#1165949).\n\n - btrfs: add new flushing states for the delayed refs rsv\n (bsc#1165949).\n\n - btrfs: add space reservation tracepoint for reserved\n bytes (bsc#1165949).\n\n - btrfs: adjust dirty_metadata_bytes after writeback\n failure of extent buffer (bsc#1168273).\n\n - btrfs: allow us to use up to 90% of the global rsv for\n unlink (bsc#1165949).\n\n - btrfs: always reserve our entire size for the global\n reserve (bsc#1165949).\n\n - btrfs: assert on non-empty delayed iputs (bsc##1165949).\n\n - btrfs: be more explicit about allowed flush states\n (bsc#1165949).\n\n - btrfs: call btrfs_create_pending_block_groups\n unconditionally (bsc#1165949).\n\n - btrfs: catch cow on deleting snapshots (bsc#1165949).\n\n - btrfs: change the minimum global reserve size\n (bsc#1165949).\n\n - btrfs: check if there are free block groups for commit\n (bsc#1165949).\n\n - btrfs: cleanup extent_op handling (bsc#1165949).\n\n - btrfs: cleanup root usage by btrfs_get_alloc_profile\n (bsc#1165949).\n\n - btrfs: cleanup the target logic in\n __btrfs_block_rsv_release (bsc#1165949).\n\n - btrfs: clear space cache inode generation always\n (bsc#1165949).\n\n - btrfs: delayed-ref: pass delayed_refs directly to\n btrfs_delayed_ref_lock (bsc#1165949).\n\n - btrfs: do not account global reserve in can_overcommit\n (bsc#1165949).\n\n - btrfs: do not allow reservations if we have pending\n tickets (bsc#1165949).\n\n - btrfs: do not call btrfs_start_delalloc_roots in\n flushoncommit (bsc#1165949).\n\n - btrfs: do not end the transaction for delayed refs in\n throttle (bsc#1165949).\n\n - btrfs: do not enospc all tickets on flush failure\n (bsc#1165949).\n\n - btrfs: do not run delayed refs in the end transaction\n logic (bsc#1165949).\n\n - btrfs: do not run delayed_iputs in commit\n (bsc##1165949).\n\n - btrfs: do not use ctl->free_space for max_extent_size\n (bsc##1165949).\n\n - btrfs: do not use global reserve for chunk allocation\n (bsc#1165949).\n\n - btrfs: drop get_extent from extent_page_data\n (bsc#1168273).\n\n - btrfs: drop min_size from evict_refill_and_join\n (bsc##1165949).\n\n - btrfs: drop unused space_info parameter from\n create_space_info (bsc#1165949).\n\n - btrfs: dump block_rsv details when dumping space info\n (bsc#1165949).\n\n - btrfs: export __btrfs_block_rsv_release (bsc#1165949).\n\n - btrfs: export block group accounting helpers\n (bsc#1165949).\n\n - btrfs: export block_rsv_use_bytes (bsc#1165949).\n\n - btrfs: export btrfs_block_rsv_add_bytes (bsc#1165949).\n\n - btrfs: export space_info_add_*_bytes (bsc#1165949).\n\n - btrfs: export the block group caching helpers\n (bsc#1165949).\n\n - btrfs: export the caching control helpers (bsc#1165949).\n\n - btrfs: export the excluded extents helpers\n (bsc#1165949).\n\n - btrfs: extent-tree: Add lockdep assert when updating\n space info (bsc#1165949).\n\n - btrfs: extent-tree: Add trace events for space info\n numbers update (bsc#1165949).\n\n - btrfs: extent-tree: Detect bytes_may_use underflow\n earlier (bsc#1165949).\n\n - btrfs: extent-tree: Detect bytes_pinned underflow\n earlier (bsc#1165949).\n\n - btrfs: extent_io: Handle errors better in\n btree_write_cache_pages() (bsc#1168273).\n\n - btrfs: extent_io: Handle errors better in\n extent_write_full_page() (bsc#1168273).\n\n - btrfs: extent_io: Handle errors better in\n extent_write_locked_range() (bsc#1168273).\n\n - btrfs: extent_io: Handle errors better in\n extent_writepages() (bsc#1168273).\n\n - btrfs: extent_io: Kill dead condition in\n extent_write_cache_pages() (bsc#1168273).\n\n - btrfs: extent_io: Kill the forward declaration of\n flush_write_bio (bsc#1168273).\n\n - btrfs: extent_io: Move the BUG_ON() in flush_write_bio()\n one level up (bsc#1168273).\n\n - btrfs: extent_io: add proper error handling to\n lock_extent_buffer_for_io() (bsc#1168273).\n\n - btrfs: factor our read/write stage off csum_tree_block\n into its callers (bsc#1168273).\n\n - btrfs: factor out the ticket flush handling\n (bsc#1165949).\n\n - btrfs: fix insert_reserved error handling\n (bsc##1165949).\n\n - btrfs: fix may_commit_transaction to deal with no\n partial filling (bsc#1165949).\n\n - btrfs: fix truncate throttling (bsc#1165949).\n\n - btrfs: force chunk allocation if our global rsv is\n larger than metadata (bsc#1165949).\n\n - btrfs: introduce an evict flushing state (bsc#1165949).\n\n - btrfs: introduce delayed_refs_rsv (bsc#1165949).\n\n - btrfs: loop in inode_rsv_refill (bsc#1165949).\n\n - btrfs: make btrfs_destroy_delayed_refs use\n btrfs_delayed_ref_lock (bsc#1165949).\n\n - btrfs: make btrfs_destroy_delayed_refs use\n btrfs_delete_ref_head (bsc#1165949).\n\n - btrfs: make caching_thread use btrfs_find_next_key\n (bsc#1165949).\n\n - btrfs: merge two flush_write_bio helpers (bsc#1168273).\n\n - btrfs: migrate btrfs_trans_release_chunk_metadata\n (bsc#1165949).\n\n - btrfs: migrate inc/dec_block_group_ro code\n (bsc#1165949).\n\n - btrfs: migrate nocow and reservation helpers\n (bsc#1165949).\n\n - btrfs: migrate the alloc_profile helpers (bsc#1165949).\n\n - btrfs: migrate the block group caching code\n (bsc#1165949).\n\n - btrfs: migrate the block group cleanup code\n (bsc#1165949).\n\n - btrfs: migrate the block group lookup code\n (bsc#1165949).\n\n - btrfs: migrate the block group read/creation code\n (bsc#1165949).\n\n - btrfs: migrate the block group ref counting stuff\n (bsc#1165949).\n\n - btrfs: migrate the block group removal code\n (bsc#1165949).\n\n - btrfs: migrate the block group space accounting helpers\n (bsc#1165949).\n\n - btrfs: migrate the block-rsv code to block-rsv.c\n (bsc#1165949).\n\n - btrfs: migrate the chunk allocation code (bsc#1165949).\n\n - btrfs: migrate the delalloc space stuff to it's own home\n (bsc#1165949).\n\n - btrfs: migrate the delayed refs rsv code (bsc#1165949).\n\n - btrfs: migrate the dirty bg writeout code (bsc#1165949).\n\n - btrfs: migrate the global_block_rsv helpers to\n block-rsv.c (bsc#1165949).\n\n - btrfs: move and export can_overcommit (bsc#1165949).\n\n - btrfs: move basic block_group definitions to their own\n header (bsc#1165949).\n\n - btrfs: move btrfs_add_free_space out of a header file\n (bsc#1165949).\n\n - btrfs: move btrfs_block_rsv definitions into it's own\n header (bsc#1165949).\n\n - btrfs: move btrfs_raid_group values to btrfs_raid_attr\n table (bsc#1165949).\n\n - btrfs: move btrfs_space_info_add_*_bytes to space-info.c\n (bsc#1165949).\n\n - btrfs: move dump_space_info to space-info.c\n (bsc#1165949).\n\n - btrfs: move reserve_metadata_bytes and supporting code\n to space-info.c (bsc#1165949).\n\n - btrfs: move space_info to space-info.h (bsc#1165949).\n\n - btrfs: move the space info update macro to space-info.h\n (bsc#1165949).\n\n - btrfs: move the space_info handling code to space-info.c\n (bsc#1165949).\n\n - btrfs: move the subvolume reservation stuff out of\n extent-tree.c (bsc#1165949).\n\n - btrfs: only check priority tickets for priority flushing\n (bsc#1165949).\n\n - btrfs: only free reserved extent if we didn't insert it\n (bsc##1165949).\n\n - btrfs: only reserve metadata_size for inodes\n (bsc#1165949).\n\n - btrfs: only track ref_heads in delayed_ref_updates\n (bsc#1165949).\n\n - btrfs: pass root to various extent ref mod functions\n (bsc#1165949).\n\n - btrfs: qgroup: Do not hold qgroup_ioctl_lock in\n btrfs_qgroup_inherit() (bsc#1165823).\n\n - btrfs: qgroup: Mark qgroup inconsistent if we're\n inherting snapshot to a new qgroup (bsc#1165823).\n\n - btrfs: refactor block group replication factor\n calculation to a helper (bsc#1165949).\n\n - btrfs: refactor priority_reclaim_metadata_space\n (bsc#1165949).\n\n - btrfs: refactor the ticket wakeup code (bsc#1165949).\n\n - btrfs: release metadata before running delayed refs\n (bsc##1165949).\n\n - btrfs: remove orig_bytes from reserve_ticket\n (bsc#1165949).\n\n - btrfs: rename btrfs_space_info_add_old_bytes\n (bsc#1165949).\n\n - btrfs: rename do_chunk_alloc to btrfs_chunk_alloc\n (bsc#1165949).\n\n - btrfs: rename the btrfs_calc_*_metadata_size helpers\n (bsc#1165949).\n\n - btrfs: replace cleaner_delayed_iput_mutex with a\n waitqueue (bsc#1165949).\n\n - btrfs: reserve delalloc metadata differently\n (bsc#1165949).\n\n - btrfs: reserve extra space during evict (bsc#1165949).\n\n - btrfs: reset max_extent_size on clear in a bitmap\n (bsc##1165949).\n\n - btrfs: reset max_extent_size properly (bsc##1165949).\n\n - btrfs: rework btrfs_check_space_for_delayed_refs\n (bsc#1165949).\n\n - btrfs: rework wake_all_tickets (bsc#1165949).\n\n - btrfs: roll tracepoint into btrfs_space_info_update\n helper (bsc#1165949).\n\n - btrfs: run btrfs_try_granting_tickets if a priority\n ticket fails (bsc#1165949).\n\n - btrfs: run delayed iput at unlink time (bsc#1165949).\n\n - btrfs: run delayed iputs before committing\n (bsc#1165949).\n\n - btrfs: set max_extent_size properly (bsc##1165949).\n\n - btrfs: sink extent_write_full_page tree argument\n (bsc#1168273).\n\n - btrfs: sink extent_write_locked_range tree parameter\n (bsc#1168273).\n\n - btrfs: sink flush_fn to extent_write_cache_pages\n (bsc#1168273).\n\n - btrfs: sink get_extent parameter to\n extent_write_full_page (bsc#1168273).\n\n - btrfs: sink get_extent parameter to\n extent_write_locked_range (bsc#1168273).\n\n - btrfs: sink get_extent parameter to extent_fiemap\n (bsc#1168273).\n\n - btrfs: sink get_extent parameter to extent_readpages\n (bsc#1168273).\n\n - btrfs: sink get_extent parameter to extent_writepages\n (bsc#1168273).\n\n - btrfs: sink get_extent parameter to\n get_extent_skip_holes (bsc#1168273).\n\n - btrfs: sink writepage parameter to\n extent_write_cache_pages (bsc#1168273).\n\n - btrfs: stop partially refilling tickets when releasing\n space (bsc#1165949).\n\n - btrfs: stop using block_rsv_release_bytes everywhere\n (bsc#1165949).\n\n - btrfs: switch to on-stack csum buffer in csum_tree_block\n (bsc#1168273).\n\n - btrfs: temporarily export btrfs_get_restripe_target\n (bsc#1165949).\n\n - btrfs: temporarily export fragment_free_space\n (bsc#1165949).\n\n - btrfs: temporarily export inc_block_group_ro\n (bsc#1165949).\n\n - btrfs: track DIO bytes in flight (bsc#1165949).\n\n - btrfs: tree-checker: Remove comprehensive root owner\n check (bsc#1168273).\n\n - btrfs: unexport can_overcommit (bsc#1165949).\n\n - btrfs: unexport the temporary exported functions\n (bsc#1165949).\n\n - btrfs: unify error handling for ticket flushing\n (bsc#1165949).\n\n - btrfs: unify extent_page_data type passed as void\n (bsc#1168273).\n\n - btrfs: update may_commit_transaction to use the delayed\n refs rsv (bsc#1165949).\n\n - btrfs: use btrfs_try_granting_tickets in\n update_global_rsv (bsc#1165949).\n\n - btrfs: wait on caching when putting the bg cache\n (bsc#1165949).\n\n - btrfs: wait on ordered extents on abort cleanup\n (bsc#1165949).\n\n - btrfs: wakeup cleaner thread when adding delayed iput\n (bsc#1165949).\n\n - ceph: canonicalize server path in place (bsc#1168443).\n\n - ceph: check POOL_FLAG_FULL/NEARFULL in addition to\n OSDMAP_FULL/NEARFULL (bsc#1169307).\n\n - ceph: remove the extra slashes in the server path\n (bsc#1168443).\n\n - cfg80211: check reg_rule for NULL in\n handle_channel_custom() (bsc#1051510).\n\n - cfg80211: check wiphy driver existence for drvinfo\n report (bsc#1051510).\n\n - cgroup: memcg: net: do not associate sock with unrelated\n cgroup (bsc#1167290).\n\n - cifs: ignore cached share root handle closing errors\n (bsc#1166780).\n\n - clk: imx: Align imx sc clock msg structs to 4\n (bsc#1111666).\n\n - clk: imx: Align imx sc clock msg structs to 4\n (git-fixes).\n\n - clk: qcom: rcg: Return failure for RCG update\n (bsc#1051510).\n\n - configfs: Fix bool initialization/comparison\n (bsc#1051510).\n\n - cpufreq: Register drivers only after CPU devices have\n been registered (bsc#1051510).\n\n - cpuidle: Do not unset the driver if it is there already\n (bsc#1051510).\n\n - crypto: arm64/sha-ce - implement export/import\n (bsc#1051510).\n\n - crypto: mxs-dcp - fix scatterlist linearization for hash\n (bsc#1051510).\n\n - crypto: tcrypt - fix printed skcipher [a]sync mode\n (bsc#1051510).\n\n - debugfs: add support for more elaborate ->d_fsdata\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - debugfs: call debugfs_real_fops() only after\n debugfs_file_get() (bsc#1159198 bsc#1109911).\n Prerequisite for bsc#1159198.\n\n - debugfs: call debugfs_real_fops() only after\n debugfs_file_get() (bsc#1159198). Prerequisite for\n bsc#1159198.\n\n - debugfs: convert to debugfs_file_get() and -put()\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - debugfs: debugfs_real_fops(): drop __must_hold sparse\n annotation (bsc#1159198 bsc#1109911). Prerequisite for\n bsc#1159198.\n\n - debugfs: debugfs_use_start/finish do not exist anymore\n (bsc#1159198). Prerequisite for bsc#1159198.\n\n - debugfs: defer debugfs_fsdata allocation to first usage\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - debugfs: defer debugfs_fsdata allocation to first usage\n (bsc#1159198). Prerequisite for bsc#1159198.\n\n - debugfs: fix debugfs_real_fops() build error\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - debugfs: implement per-file removal protection\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - debugfs: purge obsolete SRCU based removal protection\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n\n - debugfs: simplify __debugfs_remove_file() (bsc#1159198).\n Prerequisite for bsc#1159198.\n\n - dmaengine: ste_dma40: fix unneeded variable warning\n (bsc#1051510).\n\n - drm/amd/amdgpu: Fix GPR read from debugfs (v2)\n (bsc#1113956)\n\n - drm/amd/display: Add link_rate quirk for Apple 15' MBP\n 2017 (bsc#1111666).\n\n - drm/amd/display: Fix wrongly passed static prefix\n (bsc#1111666).\n\n - drm/amd/display: remove duplicated assignment to\n grph_obj_type (bsc#1051510).\n\n - drm/amdgpu: fix typo for vcn1 idle check (bsc#1111666).\n\n - drm/bochs: downgrade pci_request_region failure from\n error to warning (bsc#1051510).\n\n - drm/bridge: dw-hdmi: fix AVI frame colorimetry\n (bsc#1051510).\n\n - drm/drm_dp_mst:remove set but not used variable\n 'origlen' (bsc#1051510).\n\n - drm/exynos: dsi: fix workaround for the legacy clock\n name (bsc#1111666).\n\n - drm/exynos: dsi: propagate error value and silence\n meaningless warning (bsc#1111666).\n\n - drm/lease: fix WARNING in idr_destroy (bsc#1113956)\n\n - drm/msm: Set dma maximum segment size for mdss\n (bsc#1051510).\n\n - drm/msm: Use the correct dma_sync calls harder\n (bsc#1051510).\n\n - drm/msm: Use the correct dma_sync calls in msm_gem\n (bsc#1051510).\n\n - drm/msm: stop abusing dma_map/unmap for cache\n (bsc#1051510).\n\n - drm/sun4i: dsi: Use NULL to signify 'no panel'\n (bsc#1111666).\n\n - drm/v3d: Replace wait_for macros to remove use of msleep\n (bsc#1111666).\n\n - drm/vc4: Fix HDMI mode validation (git-fixes).\n\n - drm_dp_mst_topology: fix broken\n drm_dp_sideband_parse_remote_dpcd_read() (bsc#1051510).\n\n - dt-bindings: allow up to four clocks for orion-mdio\n (bsc#1051510).\n\n - efi: Do not attempt to map RCI2 config table if it does\n not exist (jsc#ECO-366, bsc#1168367).\n\n - efi: Export Runtime Configuration Interface table to\n sysfs (jsc#ECO-366, bsc#1168367).\n\n - efi: Fix a race and a buffer overflow while reading\n efivars via sysfs (bsc#1164893).\n\n - efi: x86: move efi_is_table_address() into arch/x86\n (jsc#ECO-366, bsc#1168367).\n\n - ext4: Avoid ENOSPC when avoiding to reuse recently\n deleted inodes (bsc#1165019).\n\n - ext4: Check for non-zero journal inum in\n ext4_calculate_overhead (bsc#1167288).\n\n - ext4: add cond_resched() to __ext4_find_entry()\n (bsc#1166862).\n\n - ext4: do not assume that mmp_nodename/bdevname have NUL\n (bsc#1166860).\n\n - ext4: fix a data race in EXT4_I(inode)->i_disksize\n (bsc#1166861).\n\n - ext4: fix incorrect group count in ext4_fill_super error\n message (bsc#1168765).\n\n - ext4: fix incorrect inodes per group in error message\n (bsc#1168764).\n\n - ext4: fix potential race between online resizing and\n write operations (bsc#1166864).\n\n - ext4: fix potential race between s_flex_groups online\n resizing and access (bsc#1166867).\n\n - ext4: fix potential race between s_group_info online\n resizing and access (bsc#1166866).\n\n - ext4: fix race between writepages and enabling\n EXT4_EXTENTS_FL (bsc#1166870).\n\n - ext4: fix support for inode sizes > 1024 bytes\n (bsc#1164284).\n\n - ext4: potential crash on allocation error in\n ext4_alloc_flex_bg_array() (bsc#1166940).\n\n - ext4: rename s_journal_flag_rwsem to s_writepages_rwsem\n (bsc#1166868).\n\n - ext4: validate the debug_want_extra_isize mount option\n at parse time (bsc#1163897).\n\n - fat: fix uninit-memory access for partial initialized\n inode (bsc#1051510).\n\n - fat: work around race with userspace's read via blockdev\n while mounting (bsc#1051510).\n\n - fbdev/g364fb: Fix build failure (bsc#1051510).\n\n - fbdev: potential information leak in do_fb_ioctl()\n (bsc#1114279)\n\n - fbmem: Adjust indentation in fb_prepare_logo and\n fb_blank (bsc#1114279)\n\n - firmware: arm_sdei: fix double-lock on hibernate with\n shared events (bsc#1111666).\n\n - firmware: arm_sdei: fix possible double-lock on\n hibernate error path (bsc#1111666).\n\n - ftrace/kprobe: Show the maxactive number on\n kprobe_events (git-fixes).\n\n - i2c: hix5hd2: add missed clk_disable_unprepare in remove\n (bsc#1051510).\n\n - i2c: jz4780: silence log flood on txabrt (bsc#1051510).\n\n - ibmvfc: do not send implicit logouts prior to NPIV login\n (bsc#1169625 ltc#184611).\n\n - iio: gyro: adis16136: check ret val for non-zero vs\n less-than-zero (bsc#1051510).\n\n - iio: imu: adis16400: check ret val for non-zero vs\n less-than-zero (bsc#1051510).\n\n - iio: imu: adis16480: check ret val for non-zero vs\n less-than-zero (bsc#1051510).\n\n - iio: imu: adis: check ret val for non-zero vs\n less-than-zero (bsc#1051510).\n\n - iio: magnetometer: ak8974: Fix negative raw values in\n sysfs (bsc#1051510).\n\n - iio: potentiostat: lmp9100: fix\n iio_triggered_buffer_(predisable,postenable) positions\n (bsc#1051510).\n\n - intel_th: Fix user-visible error codes (bsc#1051510).\n\n - intel_th: pci: Add Elkhart Lake CPU support\n (bsc#1051510).\n\n - iommu/amd: Fix the configuration of GCR3 table root\n pointer (bsc#1169057).\n\n - ipmi: fix hung processes in __get_guid() (bsc#1111666).\n\n - ipmi:ssif: Handle a possible NULL pointer reference\n (bsc#1051510).\n\n - ipvlan: do not add hardware address of master to its\n unicast filter list (bsc#1137325).\n\n - irqchip/bcm2835: Quiesce IRQs left enabled by bootloader\n (bsc#1051510).\n\n - irqdomain: Fix a memory leak in irq_domain_push_irq()\n (bsc#1051510).\n\n - kABI workaround for pcie_port_bus_type change\n (bsc#1161561).\n\n - kABI: fixes for debugfs per-file removal protection\n backports (bsc#1159198 bsc#1109911). \n\n - kABI: restore debugfs_remove_recursive() (bsc#1159198).\n\n - kabi fix for (bsc#1168202).\n\n - libceph: fix alloc_msg_with_page_vector() memory leaks\n (bsc#1169308).\n\n - libfs: fix infoleak in simple_attr_read() (bsc#1168881).\n\n - lpfc: add support for translating an RSCN rcv into a\n discovery rescan (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - lpfc: add support to generate RSCN events for nport\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - mac80211: Do not send mesh HWMP PREQ if HWMP is disabled\n (bsc#1051510).\n\n - mac80211: consider more elements in parsing CRC\n (bsc#1051510).\n\n - mac80211: free peer keys before vif down in mesh\n (bsc#1051510).\n\n - mac80211: mesh: fix RCU warning (bsc#1051510).\n\n - mac80211: only warn once on chanctx_conf being NULL\n (bsc#1051510).\n\n - mac80211: rx: avoid RCU list traversal under mutex\n (bsc#1051510).\n\n - macsec: add missing attribute validation for port\n (bsc#1051510).\n\n - macsec: fix refcnt leak in module exit routine\n (bsc#1051510).\n\n - media: dib0700: fix rc endpoint lookup (bsc#1051510).\n\n - media: flexcop-usb: fix endpoint sanity check\n (git-fixes).\n\n - media: go7007: Fix URB type for interrupt handling\n (bsc#1051510).\n\n - media: ov519: add missing endpoint sanity checks\n (bsc#1168829).\n\n - media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY\n support (bsc#1051510).\n\n - media: ov6650: Fix some format attributes not under\n control (bsc#1051510).\n\n - media: ov6650: Fix stored crop rectangle not in sync\n with hardware (bsc#1051510).\n\n - media: ov6650: Fix stored frame format not in sync with\n hardware (bsc#1051510).\n\n - media: stv06xx: add missing descriptor sanity checks\n (bsc#1168854).\n\n - media: tda10071: fix unsigned sign extension overflow\n (bsc#1051510).\n\n - media: usbtv: fix control-message timeouts\n (bsc#1051510).\n\n - media: v4l2-core: fix entity initialization in\n device_register_subdev (bsc#1051510).\n\n - media: vsp1: tidyup VI6_HGT_LBn_H() macro (bsc#1051510).\n\n - media: xirlink_cit: add missing descriptor sanity checks\n (bsc#1051510).\n\n - mfd: dln2: Fix sanity checking for endpoints\n (bsc#1051510).\n\n - misc: pci_endpoint_test: Fix to support > 10\n pci-endpoint-test devices (bsc#1051510).\n\n - mm/filemap.c: do not initiate writeback if mapping has\n no dirty pages (bsc#1168884).\n\n - mm/memory_hotplug.c: only respect mem= parameter during\n boot stage (bsc#1065600).\n\n - mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2\n (bsc#1051510).\n\n - mwifiex: set needed_headroom, not hard_header_len\n (bsc#1051510).\n\n - net/nfc: Avoid stalls when nfc_alloc_send_skb() returned\n NULL (bsc#1051510).\n\n - net/sched: flower: add missing validation of\n TCA_FLOWER_FLAGS (networking-stable-20_02_19).\n\n - net/sched: matchall: add missing validation of\n TCA_MATCHALL_FLAGS (networking-stable-20_02_19).\n\n - net/smc: fix leak of kernel memory to user space\n (networking-stable-20_02_19).\n\n - net: dsa: tag_qca: Make sure there is headroom for tag\n (networking-stable-20_02_19).\n\n - net: ena: Add PCI shutdown handler to allow safe kexec\n (bsc#1167421, bsc#1167423).\n\n - net: nfc: fix bounds checking bugs on 'pipe'\n (bsc#1051510).\n\n - net: phy: micrel: kszphy_resume(): add delay after\n genphy_resume() before accessing PHY registers\n (bsc#1051510).\n\n - net_sched: keep alloc_hash updated after hash allocation\n (git-fixes).\n\n - netfilter: conntrack: sctp: use distinct states for new\n SCTP connections (bsc#1159199).\n\n - nvme-multipath: also check for a disabled path if there\n is a single sibling (bsc#1158983).\n\n - nvme-multipath: do not select namespaces which are about\n to be removed (bsc#1158983).\n\n - nvme-multipath: factor out a nvme_path_is_disabled\n helper (bsc#1158983).\n\n - nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths\n (bsc#1158983).\n\n - nvme-multipath: fix possible I/O hang when paths are\n updated (bsc#1158983).\n\n - nvme-multipath: fix possible io hang after ctrl\n reconnect (bsc#1158983).\n\n - nvme-multipath: remove unused groups_only mode in ana\n log (bsc#1158983).\n\n - nvme-multipath: round-robin I/O policy (bsc#1158983).\n\n - nvme: fix a possible deadlock when passthru commands\n sent to a multipath device (bsc#1158983).\n\n - nvme: fix controller removal race with scan work\n (bsc#1158983).\n\n - objtool: Add is_static_jump() helper (bsc#1169514).\n\n - objtool: Add relocation check for alternative sections\n (bsc#1169514).\n\n - partitions/efi: Fix partition name parsing in GUID\n partition entry (bsc#1168763).\n\n - perf/amd/uncore: Replace manual sampling check with\n CAP_NO_INTERRUPT flag (bsc#1114279).\n\n - perf: qcom_l2: fix column exclusion check (git-fixes).\n\n - pinctrl: core: Remove extra kref_get which blocks hogs\n being freed (bsc#1051510).\n\n - platform/x86: pmc_atom: Add Lex 2I385SW to\n critclk_systems DMI table (bsc#1051510).\n\n - powerpc/64/tm: Do not let userspace set regs->trap via\n sigreturn (bsc#1118338 ltc#173734).\n\n - powerpc/64: mark start_here_multiplatform as __ref\n (bsc#1148868).\n\n - powerpc/64s: Fix section mismatch warnings from boot\n code (bsc#1148868).\n\n - powerpc/hash64/devmap: Use H_PAGE_THP_HUGE when setting\n up huge devmap PTE entries (bsc#1065729).\n\n - powerpc/kprobes: Ignore traps that happened in real mode\n (bsc#1065729).\n\n - powerpc/mm: Fix section mismatch warning in\n stop_machine_change_mapping() (bsc#1148868).\n\n - powerpc/pseries/ddw: Extend upper limit for huge DMA\n window for persistent memory (bsc#1142685 ltc#179509).\n\n - powerpc/pseries/iommu: Fix set but not used values\n (bsc#1142685 ltc#179509).\n\n - powerpc/pseries/iommu: Use memory@ nodes in max RAM\n address calculation (bsc#1142685 ltc#179509).\n\n - powerpc/vmlinux.lds: Explicitly retain .gnu.hash\n (bsc#1148868).\n\n - powerpc/xive: Replace msleep(x) with\n msleep(OPAL_BUSY_DELAY_MS) (bsc#1085030).\n\n - powerpc/xive: Use XIVE_BAD_IRQ instead of zero to catch\n non configured IPIs (bsc#1085030).\n\n - pwm: bcm2835: Dynamically allocate base (bsc#1051510).\n\n - pwm: meson: Fix confusing indentation (bsc#1051510).\n\n - pwm: pca9685: Fix PWM/GPIO inter-operation\n (bsc#1051510).\n\n - pwm: rcar: Fix late Runtime PM enablement (bsc#1051510).\n\n - pwm: renesas-tpu: Fix late Runtime PM enablement\n (bsc#1051510).\n\n - pxa168fb: fix release function mismatch in probe failure\n (bsc#1051510).\n\n - qmi_wwan: unconditionally reject 2 ep interfaces\n (bsc#1051510).\n\n - rtlwifi: rtl8192de: Fix missing callback that tests for\n hw release of buffer (git-fixes).\n\n - s390/mm: fix dynamic pagetable upgrade for hugetlbfs\n (bsc#1165182 LTC#184102).\n\n - s390/qeth: fix potential deadlock on workqueue flush\n (bsc#1165185 LTC#184108).\n\n - scsi: core: avoid repetitive logging of device offline\n messages (bsc#1145929).\n\n - scsi: core: kABI fix offline_already (bsc#1145929).\n\n - scsi: fc: Update Descriptor definition and add RDF and\n Link Integrity FPINs (bsc#1164777 bsc#1164780\n bsc#1165211).\n\n - scsi: ibmvfc: Fix NULL return compiler warning\n (bsc#1161951 ltc#183551). \n\n - scsi: lpfc: Change default SCSI LUN QD to 64\n (bsc#1164777 bsc#1164780 bsc#1165211 jsc#SLE-8654). \n\n - scsi: lpfc: Clean up hba max_lun_queue_depth checks\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Copyright updates for 12.6.0.4 patches\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix Fabric hostname registration if system\n hostname changes (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix MDS Latency Diagnostics Err-drop rates\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix RQ buffer leakage when no IOCBs\n available (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix broken Credit Recovery after driver load\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix compiler warning on frame size\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix coverity errors in fmdi attribute\n handling (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix crash after handling a pci error\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix crash in target side cable pulls hitting\n WAIT_FOR_UNREG (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix disablement of FC-AL on lpe35000 models\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix driver nvme rescan logging (bsc#1164777\n bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix erroneous cpu limit of 128 on I/O\n statistics (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix improper flag check for IO type\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix incomplete NVME discovery when target\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix kasan slab-out-of-bounds error in\n lpfc_unreg_login (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix lockdep error - register non-static key\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix lpfc overwrite of sg_cnt field in\n nvmefc_tgt_fcp_req (bsc#1164777 bsc#1164780\n bsc#1165211).\n\n - scsi: lpfc: Fix lpfc_io_buf resource leak in\n lpfc_get_scsi_buf_s4 error path (bsc#1164777 bsc#1164780\n bsc#1165211).\n\n - scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set\n func (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix missing check for CSF in Write Object\n Mbox Rsp (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix ras_log via debugfs (bsc#1164777\n bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix registration of ELS type support in fdmi\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix release of hwq to clear the eq\n relationship (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix scsi host template for SLI3 vports\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix unmap of dpp bars affecting next driver\n load (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Fix update of wq consumer index in\n lpfc_sli4_wq_release (bsc#1164777 bsc#1164780\n bsc#1165211).\n\n - scsi: lpfc: Fix: Rework setting of fdmi symbolic node\n name registration (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Make debugfs ktime stats generic for NVME\n and SCSI (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Make lpfc_defer_acc_rsp static (bsc#1164777\n bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Remove handler for obsolete ELS - Read Port\n Status (RPS) (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Remove prototype FIPS/DSS options from SLI-3\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Update lpfc version to 12.6.0.3 (bsc#1164777\n bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Update lpfc version to 12.6.0.4 (bsc#1164777\n bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: Update lpfc version to 12.8.0.0 (bsc#1164777\n bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: add RDF registration and Link Integrity FPIN\n logging (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: fix spelling mistake 'Notication' ->\n 'Notification' (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: lpfc: fix spelling mistakes of asynchronous\n (bsc#1164777 bsc#1164780 bsc#1165211).\n\n - scsi: qla2xxx: Fix I/Os being passed down when FC device\n is being deleted (bsc#1157424).\n\n - serdev: ttyport: restore client ops on deregistration\n (bsc#1051510).\n\n - staging: ccree: use signal safe completion wait\n (git-fixes).\n\n - staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device\n table (bsc#1051510).\n\n - staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi\n (bsc#1051510).\n\n - staging: wlan-ng: fix ODEBUG bug in\n prism2sta_disconnect_usb (bsc#1051510).\n\n - staging: wlan-ng: fix use-after-free Read in\n hfa384x_usbin_callback (bsc#1051510).\n\n - swiotlb: do not panic on mapping failures (bsc#1162171).\n\n - swiotlb: remove the overflow buffer (bsc#1162171).\n\n - thermal: devfreq_cooling: inline all stubs for\n CONFIG_DEVFREQ_THERMAL=n (bsc#1051510).\n\n - tpm: ibmvtpm: Wait for buffer to be set before\n proceeding (bsc#1065729).\n\n - tty/serial: atmel: manage shutdown in case of RS485 or\n ISO7816 mode (bsc#1051510).\n\n - tty: evh_bytechan: Fix out of bounds accesses\n (bsc#1051510).\n\n - tty: serial: imx: setup the correct sg entry for tx dma\n (bsc#1051510).\n\n - usb: audio-v2: Add uac2_effect_unit_descriptor\n definition (bsc#1051510).\n\n - usb: core: hub: do error out if\n usb_autopm_get_interface() fails (git-fixes).\n\n - usb: core: port: do error out if\n usb_autopm_get_interface() fails (git-fixes).\n\n - usb: dwc2: Fix in ISOC request length checking\n (git-fixes).\n\n - usb: gadget: composite: Fix bMaxPower for SuperSpeedPlus\n (git-fixes).\n\n - usb: gadget: f_fs: Fix use after free issue as part of\n queue failure (bsc#1051510).\n\n - usb: host: xhci-plat: add a shutdown (git-fixes).\n\n - usb: musb: Disable pullup at init (git-fixes).\n\n - usb: musb: fix crash with highmen PIO and usbmon\n (bsc#1051510).\n\n - usb: quirks: add NO_LPM quirk for Logitech Screen Share\n (git-fixes).\n\n - usb: quirks: add NO_LPM quirk for RTL8153 based ethernet\n adapters (git-fixes).\n\n - usb: storage: Add quirk for Samsung Fit flash\n (git-fixes).\n\n - usb: uas: fix a plug & unplug racing (git-fixes).\n\n - usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI\n controller 1022:145c (git-fixes).\n\n - virtio-blk: improve virtqueue error to BLK_STS\n (bsc#1167627).\n\n - virtio_ring: fix unmap of indirect descriptors\n (bsc#1162171).\n\n - x86/mce: Fix logic and comments around MSR_PPIN_CTL\n (bsc#1114279).\n\n - x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve\n existing changes (bsc#1114279).\n\n - xen/blkfront: fix memory allocation flags in\n blkfront_setup_indirect() (bsc#1168486).\n\n - xhci: Do not open code __print_symbolic() in xhci trace\n events (git-fixes).\n\n - xhci: apply XHCI_PME_STUCK_QUIRK to Intel Comet Lake\n platforms (git-fixes).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1051510\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1065600\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1065729\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1083647\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1085030\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1109911\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1111666\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1113956\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1114279\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1118338\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1120386\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1137325\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1142685\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1145051\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1145929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1148868\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1157424\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1158983\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1159037\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1159198\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1159199\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1161561\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1161951\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1162171\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1163403\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1163897\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1164284\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1164777\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1164780\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1164893\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1165019\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1165182\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1165185\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1165211\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1165823\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1165949\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1166780\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1166860\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1166861\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1166862\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1166864\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1166866\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1166867\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1166868\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1166870\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1166940\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1166982\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1167005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1167216\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1167288\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1167290\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1167316\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1167421\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1167423\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1167627\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1167629\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168075\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168202\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168273\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168276\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168295\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168367\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168424\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168443\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168486\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168552\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168760\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168762\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168763\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168764\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168765\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168829\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168854\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168881\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168884\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1168952\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1169013\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1169057\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1169307\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1169308\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1169390\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1169514\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1169625\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected the Linux Kernel packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-docs-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-kvmsmall-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-macros\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-build\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-build-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-qa\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-source-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/01/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/04/27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-debug-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-debug-base-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-debug-base-debuginfo-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-debug-debuginfo-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-debug-debugsource-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-debug-devel-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-debug-devel-debuginfo-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-default-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-default-base-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-default-base-debuginfo-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-default-debuginfo-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-default-debugsource-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-default-devel-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-default-devel-debuginfo-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-devel-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-docs-html-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-kvmsmall-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-kvmsmall-base-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-kvmsmall-base-debuginfo-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-kvmsmall-debuginfo-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-kvmsmall-debugsource-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-kvmsmall-devel-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-kvmsmall-devel-debuginfo-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-macros-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-obs-build-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-obs-build-debugsource-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-obs-qa-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-source-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-source-vanilla-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-syms-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-vanilla-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-vanilla-base-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-vanilla-base-debuginfo-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-vanilla-debuginfo-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-vanilla-debugsource-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-vanilla-devel-4.12.14-lp151.28.48.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"kernel-vanilla-devel-debuginfo-4.12.14-lp151.28.48.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel-debug / kernel-debug-base / kernel-debug-base-debuginfo / etc\");\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}}, {"lastseen": "2021-01-14T06:27:12", "description": "The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various\nsecurity and bugfixes.\n\nThe following security bugs were fixed :\n\nCVE-2020-8834: KVM on Power8 processors had a conflicting use of\nHSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in\nkvmppc_{save,restore}_tm, leading to a stack corruption. Because of\nthis, an attacker with the ability to run code in kernel space of a\nguest VM can cause the host kernel to panic (bnc#1168276).\n\nCVE-2020-11494: An issue was discovered in slc_bump in\ndrivers/net/can/slcan.c, which allowed attackers to read uninitialized\ncan_frame data, potentially containing sensitive information from\nkernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL\n(bnc#1168424).\n\nCVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks\nvalidation of an sk_family field, which might allow attackers to\ntrigger kernel stack corruption via crafted system calls\n(bnc#1167629).\n\nCVE-2019-9458: In the video driver there was a use after free due to a\nrace condition. This could lead to local escalation of privilege with\nno additional execution privileges needed (bnc#1168295).\n\nCVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a\nsystem crash (bnc#1120386).\n\nCVE-2019-19770: Fixed a use-after-free in the debugfs_remove function\n(bsc#1159198).\n\nCVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S\ndid not have save/restore functionality for PNV_POWERSAVE_AMR,\nPNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 3, "cvss3": {"score": 8.2, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}, "published": "2020-04-30T00:00:00", "title": "SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:1146-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-11494", "CVE-2019-19770", "CVE-2020-10942", "CVE-2020-8834", "CVE-2019-3701", "CVE-2019-9458", "CVE-2020-11669"], "modified": "2020-04-30T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-kvmsmall-devel-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debugsource", "p-cpe:/a:novell:suse_linux:kernel-vanilla-debugsource", "p-cpe:/a:novell:suse_linux:kernel-vanilla-livepatch-devel", "p-cpe:/a:novell:suse_linux:kernel-debug-base", "p-cpe:/a:novell:suse_linux:kernel-syms", "p-cpe:/a:novell:suse_linux:kernel-default-devel-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-base", "p-cpe:/a:novell:suse_linux:kernel-obs-qa", "p-cpe:/a:novell:suse_linux:kernel-vanilla-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-vanilla-base", "p-cpe:/a:novell:suse_linux:kernel-debug-livepatch-devel", "p-cpe:/a:novell:suse_linux:kernel-debug", "p-cpe:/a:novell:suse_linux:kernel-kvmsmall-livepatch-devel", "cpe:/o:novell:suse_linux:15", "p-cpe:/a:novell:suse_linux:kernel-obs-build-debugsource", "p-cpe:/a:novell:suse_linux:kernel-debug-base-debuginfo", "p-cpe:/a:novell:suse_linux:reiserfs-kmp-default", "p-cpe:/a:novell:suse_linux:kernel-vanilla", "p-cpe:/a:novell:suse_linux:kernel-kvmsmall", "p-cpe:/a:novell:suse_linux:kernel-kvmsmall-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-kvmsmall-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-zfcpdump-man", "p-cpe:/a:novell:suse_linux:kernel-debug-devel-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-vanilla-devel", "p-cpe:/a:novell:suse_linux:kselftests-kmp-default-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debuginfo", "p-cpe:/a:novell:suse_linux:kselftests-kmp-default", "p-cpe:/a:novell:suse_linux:kernel-debug-debugsource", "p-cpe:/a:novell:suse_linux:kernel-kvmsmall-base", "p-cpe:/a:novell:suse_linux:kernel-default-livepatch", "p-cpe:/a:novell:suse_linux:kernel-zfcpdump-debugsource", "p-cpe:/a:novell:suse_linux:kernel-vanilla-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-devel", "p-cpe:/a:novell:suse_linux:reiserfs-kmp-default-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-vanilla-devel-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-debug-devel", "p-cpe:/a:novell:suse_linux:kernel-default-man", "p-cpe:/a:novell:suse_linux:kernel-kvmsmall-debugsource", "p-cpe:/a:novell:suse_linux:kernel-kvmsmall-devel", "p-cpe:/a:novell:suse_linux:kernel-default", "p-cpe:/a:novell:suse_linux:kernel-zfcpdump-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-obs-build", "p-cpe:/a:novell:suse_linux:kernel-debug-debuginfo"], "id": "SUSE_SU-2020-1146-1.NASL", "href": "https://www.tenable.com/plugins/nessus/136168", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2020:1146-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(136168);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/13\");\n\n script_cve_id(\"CVE-2019-19770\", \"CVE-2019-3701\", \"CVE-2019-9458\", \"CVE-2020-10942\", \"CVE-2020-11494\", \"CVE-2020-11669\", \"CVE-2020-8834\");\n\n script_name(english:\"SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:1146-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various\nsecurity and bugfixes.\n\nThe following security bugs were fixed :\n\nCVE-2020-8834: KVM on Power8 processors had a conflicting use of\nHSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in\nkvmppc_{save,restore}_tm, leading to a stack corruption. Because of\nthis, an attacker with the ability to run code in kernel space of a\nguest VM can cause the host kernel to panic (bnc#1168276).\n\nCVE-2020-11494: An issue was discovered in slc_bump in\ndrivers/net/can/slcan.c, which allowed attackers to read uninitialized\ncan_frame data, potentially containing sensitive information from\nkernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL\n(bnc#1168424).\n\nCVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks\nvalidation of an sk_family field, which might allow attackers to\ntrigger kernel stack corruption via crafted system calls\n(bnc#1167629).\n\nCVE-2019-9458: In the video driver there was a use after free due to a\nrace condition. This could lead to local escalation of privilege with\nno additional execution privileges needed (bnc#1168295).\n\nCVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a\nsystem crash (bnc#1120386).\n\nCVE-2019-19770: Fixed a use-after-free in the debugfs_remove function\n(bsc#1159198).\n\nCVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S\ndid not have save/restore functionality for PNV_POWERSAVE_AMR,\nPNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1051510\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065600\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065729\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071995\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1083647\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1085030\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1109911\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1111666\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113956\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1114279\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1118338\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1120386\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1137325\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1142685\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1145051\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1145929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1148868\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1157424\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1158983\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1159037\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1159198\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1159199\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1161561\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1161951\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1162171\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1163403\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1163897\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1164284\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1164777\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1164780\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1164893\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1165019\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1165182\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1165185\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1165211\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1165823\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1165949\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1166780\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1166860\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1166861\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1166862\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1166864\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1166866\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1166867\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1166868\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1166870\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1166940\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1166982\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1167005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1167216\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1167288\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1167290\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1167316\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1167421\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1167423\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1167627\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1167629\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168075\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168202\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168273\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168276\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168295\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168367\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168424\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168443\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168486\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168552\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168760\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168762\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168763\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168764\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168765\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168829\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168854\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168881\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168884\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1168952\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1169013\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1169057\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1169307\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1169308\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1169390\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1169514\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1169625\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-19770/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-3701/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-9458/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-10942/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-11494/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-11669/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-8834/\"\n );\n # https://www.suse.com/support/update/announcement/2020/suse-su-20201146-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c3bcebc1\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Workstation Extension 15-SP1:zypper in -t patch\nSUSE-SLE-Product-WE-15-SP1-2020-1146=1\n\nSUSE Linux Enterprise Module for Open Buildservice Development Tools\n15-SP1:zypper in -t patch\nSUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-1146=1\n\nSUSE Linux Enterprise Module for Live Patching 15-SP1:zypper in -t\npatch SUSE-SLE-Module-Live-Patching-15-SP1-2020-1146=1\n\nSUSE Linux Enterprise Module for Legacy Software 15-SP1:zypper in -t\npatch SUSE-SLE-Module-Legacy-15-SP1-2020-1146=1\n\nSUSE Linux Enterprise Module for Development Tools 15-SP1:zypper in -t\npatch SUSE-SLE-Module-Development-Tools-15-SP1-2020-1146=1\n\nSUSE Linux Enterprise Module for Basesystem 15-SP1:zypper in -t patch\nSUSE-SLE-Module-Basesystem-15-SP1-2020-1146=1\n\nSUSE Linux Enterprise High Availability 15-SP1:zypper in -t patch\nSUSE-SLE-Product-HA-15-SP1-2020-1146=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-debug-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-debug-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-debug-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-debug-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-debug-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-debug-livepatch-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-livepatch\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-man\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-kvmsmall\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-kvmsmall-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-kvmsmall-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-kvmsmall-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-kvmsmall-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-kvmsmall-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-kvmsmall-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-kvmsmall-livepatch-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-obs-build\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-obs-build-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-obs-qa\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-vanilla-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-vanilla-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-vanilla-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-vanilla-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-vanilla-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-vanilla-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-vanilla-livepatch-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-zfcpdump-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-zfcpdump-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-zfcpdump-man\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kselftests-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kselftests-kmp-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:reiserfs-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:reiserfs-kmp-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/01/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/04/30\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED15|SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED15 / SLES15\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES15 SP1\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED15\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED15 SP1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-base-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-base-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-debugsource-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-devel-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-livepatch-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-base-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-base-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-debugsource-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-devel-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-livepatch-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"s390x\", reference:\"kernel-default-livepatch-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"s390x\", reference:\"kernel-default-man-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"s390x\", reference:\"kernel-zfcpdump-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"s390x\", reference:\"kernel-zfcpdump-debugsource-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"s390x\", reference:\"kernel-zfcpdump-man-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-default-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-default-base-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-default-base-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-default-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-default-debugsource-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-default-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-default-devel-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-obs-build-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-obs-build-debugsource-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-obs-qa-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-syms-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-vanilla-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-vanilla-base-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-vanilla-base-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-vanilla-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-vanilla-debugsource-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-vanilla-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-vanilla-devel-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kernel-vanilla-livepatch-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kselftests-kmp-default-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"kselftests-kmp-default-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"reiserfs-kmp-default-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"reiserfs-kmp-default-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-base-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-base-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-debugsource-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-devel-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-debug-livepatch-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-base-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-base-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-debugsource-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-devel-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-kvmsmall-livepatch-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"s390x\", reference:\"kernel-default-livepatch-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"s390x\", reference:\"kernel-default-man-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"s390x\", reference:\"kernel-zfcpdump-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"s390x\", reference:\"kernel-zfcpdump-debugsource-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"s390x\", reference:\"kernel-zfcpdump-man-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-default-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-default-base-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-default-base-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-default-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-default-debugsource-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-default-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-default-devel-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-obs-build-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-obs-build-debugsource-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-obs-qa-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-syms-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-vanilla-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-vanilla-base-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-vanilla-base-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-vanilla-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-vanilla-debugsource-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-vanilla-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-vanilla-devel-debuginfo-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kernel-vanilla-livepatch-devel-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kselftests-kmp-default-4.12.14-197.40.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"kselftests-kmp-default-debuginfo-4.12.14-197.40.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}}], "fedora": [{"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2019-3701"], "description": "This package contains the tools/ directory from the kernel source and the supporting documentation. ", "modified": "2019-01-15T02:34:34", "published": "2019-01-15T02:34:34", "id": "FEDORA:AAA6460491BA", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 29 Update: kernel-tools-4.19.14-300.fc29", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2019-3701"], "description": "This package contains the tools/ directory from the kernel source and the supporting documentation. ", "modified": "2019-01-15T01:54:14", "published": "2019-01-15T01:54:14", "id": "FEDORA:EF6BA6045A0C", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 28 Update: kernel-tools-4.19.14-200.fc28", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2019-3701"], "description": "Kernel-headers includes the C header files that specify the interface between the Linux kernel and userspace libraries and programs. The header files define structures and constants that are needed for building most standard programs and are also needed for rebuilding the glibc package. ", "modified": "2019-01-15T01:54:14", "published": "2019-01-15T01:54:14", "id": "FEDORA:D2B426045A04", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 28 Update: kernel-headers-4.19.14-200.fc28", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2019-3701"], "description": "Kernel-headers includes the C header files that specify the interface between the Linux kernel and userspace libraries and programs. The header files define structures and constants that are needed for building most standard programs and are also needed for rebuilding the glibc package. ", "modified": "2019-01-15T02:34:34", "published": "2019-01-15T02:34:34", "id": "FEDORA:5956060491DC", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 29 Update: kernel-headers-4.19.14-300.fc29", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2018-16862", "CVE-2018-18710", "CVE-2018-19407", "CVE-2018-19824", "CVE-2019-3701"], "description": "The kernel meta package ", "modified": "2019-01-15T02:34:33", "published": "2019-01-15T02:34:33", "id": "FEDORA:8FD3E60491BA", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 29 Update: kernel-4.19.14-300.fc29", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2018-16862", "CVE-2018-18710", "CVE-2018-19407", "CVE-2018-19824", "CVE-2019-3459", "CVE-2019-3460", "CVE-2019-3701"], "description": "The kernel meta package ", "modified": "2019-01-17T02:17:40", "published": "2019-01-17T02:17:40", "id": "FEDORA:E88866014636", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 29 Update: kernel-4.19.15-300.fc29", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2018-16862", "CVE-2018-16880", "CVE-2018-18710", "CVE-2018-19407", "CVE-2018-19824", "CVE-2019-3459", "CVE-2019-3460", "CVE-2019-3701"], "description": "The kernel meta package ", "modified": "2019-02-01T01:59:59", "published": "2019-02-01T01:59:59", "id": "FEDORA:DBB1B659CBE0", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 29 Update: kernel-4.20.5-200.fc29", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2018-16862", "CVE-2018-16880", "CVE-2018-18710", "CVE-2018-19407", "CVE-2018-19824", "CVE-2019-3459", "CVE-2019-3460", "CVE-2019-3701", "CVE-2019-7308"], "description": "The kernel meta package ", "modified": "2019-02-05T02:19:00", "published": "2019-02-05T02:19:00", "id": "FEDORA:F417F60477C5", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 29 Update: kernel-4.20.6-200.fc29", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2018-16862", "CVE-2018-16880", "CVE-2018-18710", "CVE-2018-19407", "CVE-2018-19824", "CVE-2019-3459", "CVE-2019-3460", "CVE-2019-3701", "CVE-2019-6974", "CVE-2019-7221", "CVE-2019-7222"], "description": "The kernel meta package ", "modified": "2019-02-16T01:58:02", "published": "2019-02-16T01:58:02", "id": "FEDORA:5B68260A5858", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 29 Update: kernel-4.20.8-200.fc29", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2018-16862", "CVE-2018-16880", "CVE-2018-18710", "CVE-2018-19407", "CVE-2018-19824", "CVE-2019-3459", "CVE-2019-3460", "CVE-2019-3701", "CVE-2019-6974", "CVE-2019-7221", "CVE-2019-7222", "CVE-2019-8912"], "description": "The kernel meta package ", "modified": "2019-02-26T03:08:48", "published": "2019-02-26T03:08:48", "id": "FEDORA:296826040AED", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 29 Update: kernel-4.20.11-200.fc29", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2019-05-29T18:32:12", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-3701"], "description": "The remote host is missing an update for the\n ", "modified": "2019-05-20T00:00:00", "published": "2019-01-15T00:00:00", "id": "OPENVAS:1361412562310875406", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875406", "type": "openvas", "title": "Fedora Update for kernel-tools FEDORA-2019-337484d88b", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for kernel-tools FEDORA-2019-337484d88b\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2019 Greenbone Networks GmbH, http://www.greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875406\");\n script_version(\"2019-05-20T06:45:30+0000\");\n script_cve_id(\"CVE-2019-3701\");\n script_tag(name:\"cvss_base\", value:\"4.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-05-20 06:45:30 +0000 (Mon, 20 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-01-15 04:01:47 +0100 (Tue, 15 Jan 2019)\");\n script_name(\"Fedora Update for kernel-tools FEDORA-2019-337484d88b\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC28\");\n\n script_xref(name:\"FEDORA\", value:\"2019-337484d88b\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V4JR6ZQUU3TAAAXI46HTQL2ZDJB2AGJF\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the\n 'kernel-tools' package(s) announced via the FEDORA-2019-337484d88b advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present\n on the target host.\");\n\n script_tag(name:\"affected\", value:\"kernel-tools on Fedora 28.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC28\")\n{\n\n if ((res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~4.19.14~200.fc28\", rls:\"FC28\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-01-27T18:37:03", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-3701", "CVE-2018-19985"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191234", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191234", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1234)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1234\");\n script_version(\"2020-01-23T11:36:02+0000\");\n script_cve_id(\"CVE-2018-19985\", \"CVE-2019-3701\");\n script_tag(name:\"cvss_base\", value:\"4.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:36:02 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:36:02 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1234)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROSVIRT-2\\.5\\.4\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1234\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1234\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'kernel' package(s) announced via the EulerOS-SA-2019-1234 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"An issue was discovered in can_can_gw_rcv() in the net/can/gw.c in the Linux kernel. The CAN driver may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames because of a missing check. A local user with CAP_NET_ADMIN capability granted in the initial namespace can exploit this vulnerability to cause a system crash and thus a denial of service (DoS).CVE-2019-3701\n\nA flaw was found in the Linux kernel in the function hso_probe() which reads if_num value from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hso_probe() or hso_get_config_data(). An attacker with a forged USB device and physical access to a system (needed to connect such a device) can cause a system crash and a denial of service.CVE-2018-19985\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Huawei EulerOS Virtualization 2.5.4.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROSVIRT-2.5.4\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~3.10.0~862.14.1.1_58\", rls:\"EULEROSVIRT-2.5.4\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~3.10.0~862.14.1.1_58\", rls:\"EULEROSVIRT-2.5.4\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~3.10.0~862.14.1.1_58\", rls:\"EULEROSVIRT-2.5.4\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~3.10.0~862.14.1.1_58\", rls:\"EULEROSVIRT-2.5.4\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs\", rpm:\"kernel-tools-libs~3.10.0~862.14.1.1_58\", rls:\"EULEROSVIRT-2.5.4\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs-devel\", rpm:\"kernel-tools-libs-devel~3.10.0~862.14.1.1_58\", rls:\"EULEROSVIRT-2.5.4\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-01-27T18:38:46", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-5848", "CVE-2018-16862", "CVE-2019-3701", "CVE-2019-9213", "CVE-2018-9516", "CVE-2018-10902", "CVE-2019-3819"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191259", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191259", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1259)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1259\");\n script_version(\"2020-01-23T11:36:40+0000\");\n script_cve_id(\"CVE-2018-10902\", \"CVE-2018-16862\", \"CVE-2018-5848\", \"CVE-2018-9516\", \"CVE-2019-3701\", \"CVE-2019-3819\", \"CVE-2019-9213\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:36:40 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:36:40 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1259)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROSVIRT-2\\.5\\.3\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1259\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1259\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'kernel' package(s) announced via the EulerOS-SA-2019-1259 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames. This is related to cgw_csum_xor_rel. An unprivileged user can trigger a system crash (general protection fault).(CVE-2019-3701)\n\nA flaw was found in mmap in the Linux kernel allowing the process to map a null page. This allows attackers to abuse this mechanism to turn null pointer dereferences into workable exploits.(CVE-2019-9213)\n\nA security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.CVE-2018-16862\n\nIt was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation.CVE-2018-10902\n\nIn the function wmi_set_ie() in the Linux kernel the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the ie_len argument can cause a buffer overflow and thus a memory corruption leading to a system crash or other or unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.CVE-2018-5848\n\nA flaw was found in the Linux kernel in the function hid_debug_events_read() in the drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a user space. A local privileged user ('root') can cause a system lock up and a denial of service.CVE-2019-3819\n\nA flaw was found in the Linux kernel in the hid_debug_events_read() function in the drivers/hid/hid-debug.c file. A lack of the certain checks may allow a privileged user ('root') to achieve an out-of-bounds write and thus receiving user space buffer corruption.CVE-2018-9516\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Huawei EulerOS Virtualization 2.5.3.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROSVIRT-2.5.3\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~3.10.0~514.44.5.10_136\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~3.10.0~514.44.5.10_136\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~3.10.0~514.44.5.10_136\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~3.10.0~514.44.5.10_136\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs\", rpm:\"kernel-tools-libs~3.10.0~514.44.5.10_136\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs-devel\", rpm:\"kernel-tools-libs-devel~3.10.0~514.44.5.10_136\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-04-28T16:56:23", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-11494", "CVE-2019-19770", "CVE-2020-10942", "CVE-2020-8834", "CVE-2019-3701", "CVE-2019-9458", "CVE-2020-11669"], "description": "The remote host is missing an update for the ", "modified": "2020-04-26T00:00:00", "published": "2020-04-24T00:00:00", "id": "OPENVAS:1361412562310853121", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310853121", "type": "openvas", "title": "openSUSE: Security Advisory for the (openSUSE-SU-2020:0543-1)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from the referenced\n# advisories, and are Copyright (C) by the respective right holder(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.853121\");\n script_version(\"2020-04-26T06:11:04+0000\");\n script_cve_id(\"CVE-2019-19770\", \"CVE-2019-3701\", \"CVE-2019-9458\", \"CVE-2020-10942\", \"CVE-2020-11494\", \"CVE-2020-11669\", \"CVE-2020-8834\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-04-26 06:11:04 +0000 (Sun, 26 Apr 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-04-24 03:00:39 +0000 (Fri, 24 Apr 2020)\");\n script_name(\"openSUSE: Security Advisory for the (openSUSE-SU-2020:0543-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.1\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2020:0543-1\");\n script_xref(name:\"URL\", value:\"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'the'\n package(s) announced via the openSUSE-SU-2020:0543-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The openSUSE Leap 15.1 kernel was updated to receive various security and\n bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2020-11669: An issue was discovered on the powerpc platform.\n arch/powerpc/kernel/idle_book3s.S did not have save/restore\n functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and\n PNV_POWERSAVE_AMOR, aka CID-53a712bae5dd (bnc#1169390).\n\n - CVE-2020-8834: KVM on Power8 processors had a conflicting use of\n HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in\n kvmppc_{save, restore}_tm, leading to a stack corruption. Because of\n this, an attacker with the ability run code in kernel space of a guest\n VM can cause the host kernel to panic. There were two commits that,\n according to the reporter, introduced the vulnerability: f024ee098476\n ('KVM: PPC: Book3S HV: Pull out TM state save/restore into separate\n procedures') 87a11bb6a7f7 ('KVM: PPC: Book3S HV: Work around XER[SO] bug\n in fake suspend mode') (bnc#1168276).\n\n - CVE-2020-11494: An issue was discovered in slc_bump in\n drivers/net/can/slcan.c, which allowed attackers to read uninitialized\n can_frame data, potentially containing sensitive information from kernel\n stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL, aka\n CID-b9258a2cece4 (bnc#1168424).\n\n - CVE-2019-9458: In the video driver there is a use after free due to a\n race condition. This could lead to local escalation of privilege with no\n additional execution privileges needed. User interaction is not needed\n for exploitation (bnc#1168295).\n\n - CVE-2019-3701: An issue was discovered in can_can_gw_rcv in\n net/can/gw.c. The CAN frame modification rules allow bitwise logical\n operations that can be also applied to the can_dlc field. The privileged\n user 'root' with CAP_NET_ADMIN can create a CAN frame modification rule\n that made the data length code a higher value than the available CAN\n frame data size. In combination with a configured checksum calculation\n where the result is stored relatively to the end of the data (e.g.\n cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in\n skb_shared_info) can be rewritten which finally can cause a system\n crash. Because of a missing check, the CAN drivers may write arbitrary\n content beyond the data registers in the CAN controller's I/O memory\n when processing can-gw manipulated outgoing frames (bnc#1120386).\n\n - CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacked\n validation of an sk_family field, which might allow attackers to trigger\n kernel stack corruption via crafted system calls (bnc#1167629).\n\n - CVE-2019-19770: A use-after- ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'the' package(s) on openSUSE Leap 15.1.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap15.1\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-docs\", rpm:\"kernel-docs~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-docs-html\", rpm:\"kernel-docs-html~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-macros\", rpm:\"kernel-macros~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-source\", rpm:\"kernel-source~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-source-vanilla\", rpm:\"kernel-source-vanilla~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug\", rpm:\"kernel-debug~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug-base\", rpm:\"kernel-debug-base~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug-base-debuginfo\", rpm:\"kernel-debug-base-debuginfo~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug-debuginfo\", rpm:\"kernel-debug-debuginfo~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug-debugsource\", rpm:\"kernel-debug-debugsource~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug-devel\", rpm:\"kernel-debug-devel~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug-devel-debuginfo\", rpm:\"kernel-debug-devel-debuginfo~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default\", rpm:\"kernel-default~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default-base\", rpm:\"kernel-default-base~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default-base-debuginfo\", rpm:\"kernel-default-base-debuginfo~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default-debuginfo\", rpm:\"kernel-default-debuginfo~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default-debugsource\", rpm:\"kernel-default-debugsource~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default-devel\", rpm:\"kernel-default-devel~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-default-devel-debuginfo\", rpm:\"kernel-default-devel-debuginfo~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall\", rpm:\"kernel-kvmsmall~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall-base\", rpm:\"kernel-kvmsmall-base~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall-base-debuginfo\", rpm:\"kernel-kvmsmall-base-debuginfo~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall-debuginfo\", rpm:\"kernel-kvmsmall-debuginfo~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall-debugsource\", rpm:\"kernel-kvmsmall-debugsource~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall-devel\", rpm:\"kernel-kvmsmall-devel~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-kvmsmall-devel-debuginfo\", rpm:\"kernel-kvmsmall-devel-debuginfo~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-obs-build\", rpm:\"kernel-obs-build~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-obs-build-debugsource\", rpm:\"kernel-obs-build-debugsource~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-obs-qa\", rpm:\"kernel-obs-qa~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-syms\", rpm:\"kernel-syms~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla\", rpm:\"kernel-vanilla~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla-base\", rpm:\"kernel-vanilla-base~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla-base-debuginfo\", rpm:\"kernel-vanilla-base-debuginfo~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla-debuginfo\", rpm:\"kernel-vanilla-debuginfo~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla-debugsource\", rpm:\"kernel-vanilla-debugsource~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla-devel\", rpm:\"kernel-vanilla-devel~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-vanilla-devel-debuginfo\", rpm:\"kernel-vanilla-devel-debuginfo~4.12.14~lp151.28.48.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}}, {"lastseen": "2019-05-29T18:32:14", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-3460", "CVE-2018-19824", "CVE-2018-16862", "CVE-2018-18710", "CVE-2019-3701", "CVE-2019-3459", "CVE-2018-19407", "CVE-2018-16880"], "description": "The remote host is missing an update for the ", "modified": "2019-05-20T00:00:00", "published": "2019-05-07T00:00:00", "id": "OPENVAS:1361412562310875946", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875946", "type": "openvas", "title": "Fedora Update for kernel FEDORA-2019-aabdaa013d", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875946\");\n script_version(\"2019-05-20T06:45:30+0000\");\n script_cve_id(\"CVE-2018-16880\", \"CVE-2019-3459\", \"CVE-2019-3460\", \"CVE-2019-3701\", \"CVE-2018-19824\", \"CVE-2018-16862\", \"CVE-2018-19407\", \"CVE-2018-18710\");\n script_tag(name:\"cvss_base\", value:\"6.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-05-20 06:45:30 +0000 (Mon, 20 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-05-07 02:29:09 +0000 (Tue, 07 May 2019)\");\n script_name(\"Fedora Update for kernel FEDORA-2019-aabdaa013d\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC29\");\n\n script_xref(name:\"FEDORA\", value:\"2019-aabdaa013d\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5IYT2ZAPBSYLJVJRJJ6YH6YFE7XIRPB\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'kernel'\n package(s) announced via the FEDORA-2019-aabdaa013d advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The kernel meta package\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Fedora 29.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC29\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~4.20.5~200.fc29\", rls:\"FC29\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:32:12", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-3460", "CVE-2018-19824", "CVE-2018-16862", "CVE-2018-18710", "CVE-2019-3701", "CVE-2019-3459", "CVE-2019-7308", "CVE-2018-19407", "CVE-2018-16880"], "description": "The remote host is missing an update for the ", "modified": "2019-05-20T00:00:00", "published": "2019-05-07T00:00:00", "id": "OPENVAS:1361412562310875801", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875801", "type": "openvas", "title": "Fedora Update for kernel FEDORA-2019-96b31a9602", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875801\");\n script_version(\"2019-05-20T06:45:30+0000\");\n script_cve_id(\"CVE-2018-16880\", \"CVE-2019-3459\", \"CVE-2019-3460\", \"CVE-2019-3701\", \"CVE-2018-19824\", \"CVE-2018-16862\", \"CVE-2018-19407\", \"CVE-2018-18710\", \"CVE-2019-7308\");\n script_tag(name:\"cvss_base\", value:\"6.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-05-20 06:45:30 +0000 (Mon, 20 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-05-07 02:21:22 +0000 (Tue, 07 May 2019)\");\n script_name(\"Fedora Update for kernel FEDORA-2019-96b31a9602\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC29\");\n\n script_xref(name:\"FEDORA\", value:\"2019-96b31a9602\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I46FW633VGVOFMM3OPMFTBOXYGP243AL\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'kernel'\n package(s) announced via the FEDORA-2019-96b31a9602 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The kernel meta package\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Fedora 29.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC29\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~4.20.6~200.fc29\", rls:\"FC29\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-27T18:36:33", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-10741", "CVE-2018-18281", "CVE-2018-18559", "CVE-2018-10883", "CVE-2019-3701", "CVE-2017-18360", "CVE-2018-20169", "CVE-2018-10902", "CVE-2018-1094", "CVE-2018-10879"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191131", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191131", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1131)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1131\");\n script_version(\"2020-01-23T11:32:22+0000\");\n script_cve_id(\"CVE-2016-10741\", \"CVE-2017-18360\", \"CVE-2018-10879\", \"CVE-2018-10883\", \"CVE-2018-10902\", \"CVE-2018-1094\", \"CVE-2018-18281\", \"CVE-2018-18559\", \"CVE-2018-20169\", \"CVE-2019-3701\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:32:22 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:32:22 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1131)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP2\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1131\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1131\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'kernel' package(s) announced via the EulerOS-SA-2019-1131 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"A division-by-zero in set_termios(), when debugging is enabled, was found in the Linux kernel. When the [io_ti] driver is loaded, a local unprivileged attacker can request incorrect high transfer speed in the change_port_settings() in the drivers/usb/serial/io_ti.c so that the divisor value becomes zero and causes a system crash resulting in a denial of service. (CVE-2017-18360)\n\nSince Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused.(CVE-2018-18281)\n\nA flaw was discovered in the Linux kernel's USB subsystem in the __usb_get_extra_descriptor() function in the drivers/usb/core/usb.c which mishandles a size check during the reading of an extra descriptor data. By using a specially crafted USB device which sends a forged extra descriptor, an unprivileged user with physical access to the system can potentially cause a privilege escalation or trigger a system crash or lock up and thus to cause a denial of service (DoS).(CVE-2018-20169)\n\nIt was found that the Linux kernel can hit a BUG_ON() statement in the __xfs_get_blocks() in the fs/xfs/xfs_aops.c because of a race condition between direct and memory-mapped I/O associated with a hole in a file that is handled with BUG_ON() instead of an I/O failure. This allows a local unprivileged attacker to cause a system crash and a denial of service.(CVE-2016-10741)\n\nA use-after-free flaw can occur in the Linux kernel due to a race condition between packet_do_bind() and packet_notifier() functions called for an AF_PACKET socket. An unprivileged, local user could use this flaw to induce kernel memory corruption on the system, leading to an unresponsive system or to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. (CVE-2018-18559)\n\nAn issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames. This is related to cgw_csum_xor_rel. An unprivileged user can trigger a system crash (general protection fault).(CVE-2019-3701)\n\nA flaw was found in the Linux kernel's ext4 filesystem. A local use ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Huawei EulerOS V2.0SP2.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP2\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~3.10.0~327.62.59.83.h140\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug\", rpm:\"kernel-debug~3.10.0~327.62.59.83.h140\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug-devel\", rpm:\"kernel-debug-devel~3.10.0~327.62.59.83.h140\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debuginfo\", rpm:\"kernel-debuginfo~3.10.0~327.62.59.83.h140\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debuginfo-common-x86_64\", rpm:\"kernel-debuginfo-common-x86_64~3.10.0~327.62.59.83.h140\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~3.10.0~327.62.59.83.h140\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~3.10.0~327.62.59.83.h140\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~3.10.0~327.62.59.83.h140\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs\", rpm:\"kernel-tools-libs~3.10.0~327.62.59.83.h140\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"perf\", rpm:\"perf~3.10.0~327.62.59.83.h140\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python-perf\", rpm:\"python-perf~3.10.0~327.62.59.83.h140\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:32:12", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-7222", "CVE-2019-3460", "CVE-2018-19824", "CVE-2018-16862", "CVE-2018-18710", "CVE-2019-7221", "CVE-2019-3701", "CVE-2019-6974", "CVE-2019-3459", "CVE-2018-19407", "CVE-2018-16880"], "description": "The remote host is missing an update for the ", "modified": "2019-05-20T00:00:00", "published": "2019-05-07T00:00:00", "id": "OPENVAS:1361412562310875628", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875628", "type": "openvas", "title": "Fedora Update for kernel FEDORA-2019-164946aa7f", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875628\");\n script_version(\"2019-05-20T06:45:30+0000\");\n script_cve_id(\"CVE-2019-7221\", \"CVE-2019-6974\", \"CVE-2019-7222\", \"CVE-2018-16880\", \"CVE-2019-3459\", \"CVE-2019-3460\", \"CVE-2019-3701\", \"CVE-2018-19824\", \"CVE-2018-16862\", \"CVE-2018-19407\", \"CVE-2018-18710\");\n script_tag(name:\"cvss_base\", value:\"6.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-05-20 06:45:30 +0000 (Mon, 20 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-05-07 02:13:18 +0000 (Tue, 07 May 2019)\");\n script_name(\"Fedora Update for kernel FEDORA-2019-164946aa7f\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC29\");\n\n script_xref(name:\"FEDORA\", value:\"2019-164946aa7f\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KDOXCX3QFVWYXH5CQMGDDE7H6MUG5XGG\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'kernel'\n package(s) announced via the FEDORA-2019-164946aa7f advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The kernel meta package\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Fedora 29.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC29\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~4.20.8~200.fc29\", rls:\"FC29\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:32:14", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-7222", "CVE-2019-3460", "CVE-2018-19824", "CVE-2019-8912", "CVE-2018-16862", "CVE-2018-18710", "CVE-2019-7221", "CVE-2019-3701", "CVE-2019-6974", "CVE-2019-3459", "CVE-2018-19407", "CVE-2018-16880"], "description": "The remote host is missing an update for the ", "modified": "2019-05-14T00:00:00", "published": "2019-05-07T00:00:00", "id": "OPENVAS:1361412562310875834", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875834", "type": "openvas", "title": "Fedora Update for kernel FEDORA-2019-7bdeed7fc5", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875834\");\n script_version(\"2019-05-14T05:04:40+0000\");\n script_cve_id(\"CVE-2019-8912\", \"CVE-2019-7221\", \"CVE-2019-6974\", \"CVE-2019-7222\", \"CVE-2018-16880\", \"CVE-2019-3459\", \"CVE-2019-3460\", \"CVE-2019-3701\", \"CVE-2018-19824\", \"CVE-2018-16862\", \"CVE-2018-19407\", \"CVE-2018-18710\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-05-14 05:04:40 +0000 (Tue, 14 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-05-07 02:22:54 +0000 (Tue, 07 May 2019)\");\n script_name(\"Fedora Update for kernel FEDORA-2019-7bdeed7fc5\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC29\");\n\n script_xref(name:\"FEDORA\", value:\"2019-7bdeed7fc5\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHPV6YAVRZGELKIO7LYXJNKRFHMOJJP7\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'kernel'\n package(s) announced via the FEDORA-2019-7bdeed7fc5 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The kernel meta package\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Fedora 29.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC29\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~4.20.11~200.fc29\", rls:\"FC29\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-27T18:37:28", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-1108", "CVE-2018-10880", "CVE-2018-10878", "CVE-2018-18690", "CVE-2018-10881", "CVE-2013-3076", "CVE-2019-3701", "CVE-2018-17972", "CVE-2018-18386", "CVE-2018-16658", "CVE-2018-14633", "CVE-2018-14646"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191028", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191028", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1028)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1028\");\n script_version(\"2020-01-23T15:42:05+0000\");\n script_cve_id(\"CVE-2013-3076\", \"CVE-2018-10878\", \"CVE-2018-10880\", \"CVE-2018-10881\", \"CVE-2018-1108\", \"CVE-2018-14633\", \"CVE-2018-14646\", \"CVE-2018-16658\", \"CVE-2018-17972\", \"CVE-2018-18386\", \"CVE-2018-18690\", \"CVE-2019-3701\");\n script_tag(name:\"cvss_base\", value:\"8.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 15:42:05 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:28:10 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1028)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP5\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1028\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1028\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'kernel' package(s) announced via the EulerOS-SA-2019-1028 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image.(CVE-2018-10878)\n\nAn issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames. This is related to cgw_csum_xor_rel. An unprivileged user can trigger a system crash (general protection fault).(CVE-2019-3701)\n\nA flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.(CVE-2018-10881)\n\nA flaw was found in the Linux kernel's ext4 filesystem code. A stack-out-of-bounds write in ext4_update_inline_data() is possible when mounting and writing to a crafted ext4 image. An attacker could use this to cause a system crash and a denial of service.(CVE-2018-10880)\n\nThe crypto API in the Linux kernel through 3.9-rc8 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c.(CVE-2013-3076)\n\n weakness was found in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.(CVE-2018-1108)\n\nAn issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel. An attacker with a local account can trick the stack unwinder code to leak stack contents to userspace. The fix allows only root to inspect the kernel stack of an arbitrary task.(CVE-2018-17972)\n\nA security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architectu ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Huawei EulerOS V2.0SP5.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP5\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~3.10.0~862.14.0.1.h80.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debuginfo\", rpm:\"kernel-debuginfo~3.10.0~862.14.0.1.h80.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debuginfo-common-x86_64\", rpm:\"kernel-debuginfo-common-x86_64~3.10.0~862.14.0.1.h80.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~3.10.0~862.14.0.1.h80.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~3.10.0~862.14.0.1.h80.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~3.10.0~862.14.0.1.h80.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs\", rpm:\"kernel-tools-libs~3.10.0~862.14.0.1.h80.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"perf\", rpm:\"perf~3.10.0~862.14.0.1.h80.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python-perf\", rpm:\"python-perf~3.10.0~862.14.0.1.h80.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 8.3, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:C"}}], "oraclelinux": [{"lastseen": "2019-05-29T18:34:18", "bulletinFamily": "unix", "cvelist": ["CVE-2018-10882", "CVE-2018-1066", "CVE-2018-10881", "CVE-2019-3701"], "description": "[4.1.12-124.26.7]\n- ib_core: initialize shpd field when allocating 'struct ib_pd' (Mukesh Kacker) [Orabug: 29384815] \n- Revert 'x86/apic: Make arch_setup_hwirq NUMA node aware' (Brian Maly) [Orabug: 29542185] \n- qlcnic: fix Tx descriptor corruption on 82xx devices (Shahed Shaikh) [Orabug: 27708787] \n- block: Fix a race between blk_cleanup_queue() and timeout handling (Bart Van Assche) [Orabug: 29158186] \n- can: gw: ensure DLC boundaries after CAN frame modification (Oliver Hartkopp) [Orabug: 29215299] {CVE-2019-3701} {CVE-2019-3701}\n- CIFS: Enable encryption during session setup phase (Pavel Shilovsky) [Orabug: 29338239] {CVE-2018-1066}\n- ext4: clear i_data in ext4_inode_info when removing inline data (Theodore Ts'o) [Orabug: 29540709] {CVE-2018-10881} {CVE-2018-10881}\n- ext4: add more inode number paranoia checks (Theodore Ts'o) [Orabug: 29545566] {CVE-2018-10882} {CVE-2018-10882}\n- Revert 'KVM: nVMX: Eliminate vmcs02 pool' (Boris Ostrovsky) [Orabug: 29542029] \n- Revert 'KVM: VMX: introduce alloc_loaded_vmcs' (Boris Ostrovsky) [Orabug: 29542029] \n- Revert 'KVM: VMX: make MSR bitmaps per-VCPU' (Boris Ostrovsky) [Orabug: 29542029] \n- Revert 'KVM: x86: pass host_initiated to functions that read MSRs' (Boris Ostrovsky) [Orabug: 29542029] \n- Revert 'KVM/x86: Add IBPB support' (Boris Ostrovsky) [Orabug: 29542029] \n- Revert 'KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL - reloaded' (Boris Ostrovsky) [Orabug: 29542029] \n- Revert 'KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL' (Boris Ostrovsky) [Orabug: 29542029] \n- Revert 'KVM: SVM: Add MSR-based feature support for serializing LFENCE' (Boris Ostrovsky) [Orabug: 29542029] \n- Revert 'x86/cpufeatures: rename X86_FEATURE_AMD_SSBD to X86_FEATURE_LS_CFG_SSBD' (Boris Ostrovsky) [Orabug: 29542029] \n- Revert 'x86/bugs: Add AMD's SPEC_CTRL MSR usage' (Boris Ostrovsky) [Orabug: 29542029] \n- Revert 'x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR' (Boris Ostrovsky) [Orabug: 29542029] \n- arch: x86: remove unsued SET_IBPB from spec_ctrl.h (Mihai Carabas) [Orabug: 29336760] \n- x86: cpu: microcode: fix late loading SpectreV2 bugs eval (Mihai Carabas) [Orabug: 29336760] \n- x86: cpu: microcode: fix late loading SSBD and L1TF bugs eval (Mihai Carabas) [Orabug: 29336760] \n- x86: cpu: microcode: Re-evaluate bugs in a CPU after microcode loading (Mihai Carabas) [Orabug: 29336760] \n- x86: cpu: microcode: update flags for all cpus (Mihai Carabas) [Orabug: 29336760]\n[4.1.12-124.26.6]\n- x86/apic: Make arch_setup_hwirq NUMA node aware (Henry Willard) [Orabug: 29292411]", "edition": 2, "modified": "2019-03-31T00:00:00", "published": "2019-03-31T00:00:00", "id": "ELSA-2019-4596", "href": "http://linux.oracle.com/errata/ELSA-2019-4596.html", "title": "Unbreakable Enterprise kernel security update", "type": "oraclelinux", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:38:23", "bulletinFamily": "unix", "cvelist": ["CVE-2018-10882", "CVE-2018-10877", "CVE-2018-10881", "CVE-2019-3701", "CVE-2018-10879"], "description": "kernel-uek\n[3.8.13-118.32.1]\n- x86/fpu: Factor out memset(xstate, 0) in fpu_finit() paths (Oleg Nesterov) [Orabug: 29012034] \n- x86/fpu: Always allow FPU in interrupt if use_eager_fpu() (Oleg Nesterov) [Orabug: 29012034] \n- x86/fpu: Fix 32-bit signal frame handling (Dave Hansen) [Orabug: 29012034] \n- x86/fpu: Don't do __thread_fpu_end() if use_eager_fpu() (Oleg Nesterov) [Orabug: 29012034] \n- x86/fpu: Don't reset fpu_counter (Oleg Nesterov) [Orabug: 29012034] \n- x86, fpu: Fix math_state_restore() race with kernel_fpu_begin() (Oleg Nesterov) [Orabug: 29012034] \n- x86, fpu: Introduce per-cpu in_kernel_fpu state (Oleg Nesterov) [Orabug: 29012034] \n- x86, fpu: Don't abuse has_fpu in __kernel_fpu_begin/end() (Oleg Nesterov) [Orabug: 29012034] \n- x86: Allow FPU to be used at interrupt time even with eagerfpu (Pekka Riikonen) [Orabug: 29012034] \n- can: gw: ensure DLC boundaries after CAN frame modification (Oliver Hartkopp) [Orabug: 29215300] {CVE-2019-3701} {CVE-2019-3701}\n- ext4: verify the depth of extent tree in ext4_find_extent() (Theodore Ts'o) [Orabug: 29396713] {CVE-2018-10877} {CVE-2018-10877}\n- ext4: always verify the magic number in xattr blocks (Theodore Ts'o) [Orabug: 29437128] {CVE-2018-10879} {CVE-2018-10879}\n- ext4: add corruption check in ext4_xattr_set_entry() (Theodore Ts'o) [Orabug: 29437128] {CVE-2018-10879} {CVE-2018-10879}\n- ext4: clear i_data in ext4_inode_info when removing inline data (Theodore Ts'o) [Orabug: 29540710] {CVE-2018-10881} {CVE-2018-10881}\n- ext4: add more inode number paranoia checks (Theodore Ts'o) [Orabug: 29545567] {CVE-2018-10882} {CVE-2018-10882}", "edition": 3, "modified": "2019-04-08T00:00:00", "published": "2019-04-08T00:00:00", "id": "ELSA-2019-4600", "href": "http://linux.oracle.com/errata/ELSA-2019-4600.html", "title": "Unbreakable Enterprise kernel security update", "type": "oraclelinux", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:36:14", "bulletinFamily": "unix", "cvelist": ["CVE-2019-7222", "CVE-2019-8980", "CVE-2019-8912", "CVE-2019-7221", "CVE-2019-3701", "CVE-2019-6974", "CVE-2019-9213"], "description": "[4.14.35-1844.4.5]\n- x86/apic/x2apic: set back affinity of a single interrupt to one cpu (Mridula Shastry) [Orabug: 29510342]\n[4.14.35-1844.4.4]\n- ext4: fix data corruption caused by unaligned direct AIO (Lukas Czerner) [Orabug: 29598590] \n- swiotlb: checking whether swiotlb buffer is full with io_tlb_used (Dongli Zhang) [Orabug: 29587097] \n- swiotlb: add debugfs to track swiotlb buffer usage (Dongli Zhang) [Orabug: 29587097] \n- swiotlb: fix comment on swiotlb_bounce() (Dongli Zhang) [Orabug: 29587097] \n- scsi: target: add device product id and revision configfs attributes (Alan Adamson) [Orabug: 29344881] \n- scsi: target: remove hardcoded T10 Vendor ID in INQUIRY response (David Disseldorp) [Orabug: 29344881] \n- scsi: target: add device vendor_id configfs attribute (David Disseldorp) [Orabug: 29344881] \n- scsi: target: consistently null-terminate t10_wwn strings (David Disseldorp) [Orabug: 29344881] \n- scsi: target: use consistent left-aligned ASCII INQUIRY data (David Disseldorp) [Orabug: 29344881] \n- x86/speculation: Keep enhanced IBRS on when prctl is used for SSBD control (Alejandro Jimenez) [Orabug: 29526400] \n- drm/amdkfd: fix amdkfd use-after-free GP fault (Randy Dunlap) [Orabug: 29534199]\n[4.14.35-1844.4.3]\n- can: gw: ensure DLC boundaries after CAN frame modification (Oliver Hartkopp) [Orabug: 29215297] {CVE-2019-3701} {CVE-2019-3701}\n[4.14.35-1844.4.2]\n- x86/speculation: Clean up enhanced IBRS checks in bugs.c (Alejandro Jimenez) [Orabug: 29423796] \n- x86/speculation: Keep enhanced IBRS on when spec_store_bypass_disable=on is used (Alejandro Jimenez) [Orabug: 29423796] \n- kvm/speculation: Allow KVM guests to use SSBD even if host does not (Alejandro Jimenez) [Orabug: 29423796] \n- exec: Fix mem leak in kernel_read_file (YueHaibing) [Orabug: 29454858] {CVE-2019-8980}\n- net: crypto set sk to NULL when af_alg_release. (Mao Wenan) [Orabug: 29454874] {CVE-2019-8912}\n- {net, IB}/mlx5: Raise fatal IB event when sys error occurs (Daniel Jurgens) [Orabug: 29479744] \n- net/mlx5e: Avoid query PPCNT register if not supported by the device (Eyal Davidovich) [Orabug: 29479795] \n- mm: enforce min addr even if capable() in expand_downwards() (Jann Horn) [Orabug: 29501977] {CVE-2019-9213}\n- [UEK-5] IB/mlx5_core: Use kzalloc when allocating PD (Erez Alfasi) [Orabug: 29479806] \n- IB/mlx5: Change debugfs to have per port contents (Parav Pandit) [Orabug: 29486784] \n- Revert 'IB/mlx5: Change debugfs to have per port contents' (Qing Huang) [Orabug: 29486784] \n- scsi: scsi_transport_iscsi: modify detected conn err to KERN_ERR (Fred Herard) [Orabug: 29487789] \n- xen/blkfront: avoid NULL blkfront_info dereference on device removal (Vasilis Liaskovitis) [Orabug: 29489795] \n- qlcnic: fix Tx descriptor corruption on 82xx devices (Shahed Shaikh) [Orabug: 29495427]\n[4.14.35-1844.4.1]\n- scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task (Anoob Soman) [Orabug: 29024514] \n- scsi: scsi_transport_iscsi: redirect conn error to console (Fred Herard) [Orabug: 29469713] \n- Revert x86/apic/x2apic: set affinity of a single interrupt to one cpu (Mridula Shastry) [Orabug: 29469651] \n- net/mlx5: Fix error handling in load one (Maor Gottlieb) [Orabug: 29019396] \n- net/mlx5: Fix mlx5_get_uars_page to return error code (Eran Ben Elisha) [Orabug: 29019396] \n- net/mlx5: Fix memory leak in bad flow of mlx5_alloc_irq_vectors (Alaa Hleihel) [Orabug: 29019396] \n- net/mlx4_core: Fix wrong calculation of free counters (Eran Ben Elisha) [Orabug: 29019396] \n- net/mlx5: Free IRQs in shutdown path (Daniel Jurgens) [Orabug: 29019427] \n- net/mlx5e: DCBNL fix min inline header size for dscp (Huy Nguyen) [Orabug: 29019427] \n- IB/mlx4: Fix integer overflow when calculating optimal MTT size (Jack Morgenstein) [Orabug: 29019427] \n- net/mlx5: Fix mlx5_get_vector_affinity function (Israel Rukshin) [Orabug: 29019427] \n- net/mlx5e: Fixed sleeping inside atomic context (Aviad Yehezkel) [Orabug: 29019427] \n- IB/core: Generate GID change event regardless of RoCE GID table property (Parav Pandit) [Orabug: 29019427] \n- net/mlx5: Vport, Use 'kvfree()' for memory allocated by 'kvzalloc()' (Christophe JAILLET) [Orabug: 29019430] \n- IB/mlx4: Use 4K pages for kernel QP's WQE buffer (Jack Morgenstein) [Orabug: 29019795] \n- net/mlx5: Add missing SET_DRIVER_VERSION command translation (Noa Osherovich) [Orabug: 29447325] \n- net/mlx5: E-Switch, Fix memory leak when creating switchdev mode FDB tables (Raed Salem) [Orabug: 29447325] \n- net/mlx5: Fix debugfs cleanup in the device init/remove flow (Jack Morgenstein) [Orabug: 29447325] \n- net/mlx5: Check for error in mlx5_attach_interface (Huy Nguyen) [Orabug: 29447325] \n- net/mlx5: Fix use-after-free in self-healing flow (Jack Morgenstein) [Orabug: 29447325] \n- uek-rpm: update list of removed files, generated by depmod on install stage (Alexander Burmashev) [Orabug: 29460369]\n[4.14.35-1844.4.0]\n- fs/dcache.c: add cond_resched() in shrink_dentry_list() (Nikolay Borisov) [Orabug: 29450975] \n- net_failover: delay taking over primary device to accommodate udevd renaming (Si-Wei Liu) \n- hugetlbfs: fix races and page leaks during migration (Mike Kravetz) [Orabug: 29443877] \n- rds: update correct congestion map for loopback transport (Mukesh Kacker) [Orabug: 29431289] \n- KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) (Peter Shier) [Orabug: 29408638] {CVE-2019-7221}\n- KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) (Paolo Bonzini) [Orabug: 29408618] {CVE-2019-7222}\n- kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) (Jann Horn) [Orabug: 29408541] {CVE-2019-6974}\n- ib_core: initialize shpd field when allocating 'struct ib_pd' (Mukesh Kacker) [Orabug: 29384900] \n- bnxt_en: Return linux standard errors in bnxt_ethtool.c (Vasundhara Volam) [Orabug: 29261957] \n- bnxt_en: Don't set ETS on unused TCs. (Michael Chan) [Orabug: 29261957] \n- bnxt_en: get the reduced max_irqs by the ones used by RDMA (Vasundhara Volam) [Orabug: 29261957] \n- bnxt_en: free hwrm resources, if driver probe fails. (Venkat Duvvuru) [Orabug: 29261957] \n- bnxt_en: Fix enables field in HWRM_QUEUE_COS2BW_CFG request (Vasundhara Volam) [Orabug: 29261957] \n- bnxt_en: Fix VNIC reservations on the PF. (Michael Chan) [Orabug: 29261957]", "edition": 3, "modified": "2019-04-12T00:00:00", "published": "2019-04-12T00:00:00", "id": "ELSA-2019-4612", "href": "http://linux.oracle.com/errata/ELSA-2019-4612.html", "title": "Unbreakable Enterprise kernel security update", "type": "oraclelinux", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "suse": [{"lastseen": "2020-04-23T16:52:14", "bulletinFamily": "unix", "cvelist": ["CVE-2020-11494", "CVE-2019-19770", "CVE-2020-10942", "CVE-2020-8834", "CVE-2019-3701", "CVE-2019-9458", "CVE-2020-11669"], "description": "The openSUSE Leap 15.1 kernel was updated to receive various security and\n bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2020-11669: An issue was discovered on the powerpc platform.\n arch/powerpc/kernel/idle_book3s.S did not have save/restore\n functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and\n PNV_POWERSAVE_AMOR, aka CID-53a712bae5dd (bnc#1169390).\n - CVE-2020-8834: KVM on Power8 processors had a conflicting use of\n HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in\n kvmppc_{save,restore}_tm, leading to a stack corruption. Because of\n this, an attacker with the ability run code in kernel space of a guest\n VM can cause the host kernel to panic. There were two commits that,\n according to the reporter, introduced the vulnerability: f024ee098476\n ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate\n procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug\n in fake suspend mode") (bnc#1168276).\n - CVE-2020-11494: An issue was discovered in slc_bump in\n drivers/net/can/slcan.c, which allowed attackers to read uninitialized\n can_frame data, potentially containing sensitive information from kernel\n stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL, aka\n CID-b9258a2cece4 (bnc#1168424).\n - CVE-2019-9458: In the video driver there is a use after free due to a\n race condition. This could lead to local escalation of privilege with no\n additional execution privileges needed. User interaction is not needed\n for exploitation (bnc#1168295).\n - CVE-2019-3701: An issue was discovered in can_can_gw_rcv in\n net/can/gw.c. The CAN frame modification rules allow bitwise logical\n operations that can be also applied to the can_dlc field. The privileged\n user "root" with CAP_NET_ADMIN can create a CAN frame modification rule\n that made the data length code a higher value than the available CAN\n frame data size. In combination with a configured checksum calculation\n where the result is stored relatively to the end of the data (e.g.\n cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in\n skb_shared_info) can be rewritten which finally can cause a system\n crash. Because of a missing check, the CAN drivers may write arbitrary\n content beyond the data registers in the CAN controller's I/O memory\n when processing can-gw manipulated outgoing frames (bnc#1120386).\n - CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacked\n validation of an sk_family field, which might allow attackers to trigger\n kernel stack corruption via crafted system calls (bnc#1167629).\n - CVE-2019-19770: A use-after-free in the debugfs_remove function in\n fs/debugfs/inode.c was fixed. (bnc#1159198).\n\n The following non-security bugs were fixed:\n\n - ACPI: watchdog: Fix gas->access_width usage (bsc#1051510).\n - ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro (bsc#1051510).\n - ALSA: ali5451: remove redundant variable capture_flag (bsc#1051510).\n - ALSA: core: Add snd_device_get_state() helper (bsc#1051510).\n - ALSA: core: Replace zero-length array with flexible-array member\n (bsc#1051510).\n - ALSA: emu10k1: Fix endianness annotations (bsc#1051510).\n - ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA\n X99 Classified motherboard (bsc#1051510).\n - ALSA: hda/ca0132 - Replace zero-length array with flexible-array member\n (bsc#1051510).\n - ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662\n (git-fixes).\n - ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662\n (git-fixes).\n - ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups\n (bsc#1051510).\n - ALSA: hda/realtek - Set principled PC Beep configuration for ALC256\n (bsc#1051510).\n - ALSA: hda/realtek - a fake key event is triggered by running shutup\n (bsc#1051510).\n - ALSA: hda/realtek: Enable mute LED on an HP system (bsc#1051510).\n - ALSA: hda/realtek: Fix pop noise on ALC225 (git-fixes).\n - ALSA: hda: Fix potential access overflow in beep helper (bsc#1051510).\n - ALSA: hda: Use scnprintf() for string truncation (bsc#1051510).\n - ALSA: hda: default enable CA0132 DSP support (bsc#1051510).\n - ALSA: hda: remove redundant assignment to variable timeout (bsc#1051510).\n - ALSA: hda_codec: Replace zero-length array with flexible-array member\n (bsc#1051510).\n - ALSA: hdsp: remove redundant assignment to variable err (bsc#1051510).\n - ALSA: ice1724: Fix invalid access for enumerated ctl items (bsc#1051510).\n - ALSA: info: remove redundant assignment to variable c (bsc#1051510).\n - ALSA: korg1212: fix if-statement empty body warnings (bsc#1051510).\n - ALSA: line6: Fix endless MIDI read loop (git-fixes).\n - ALSA: pcm.h: add for_each_pcm_streams() (bsc#1051510).\n - ALSA: pcm: Fix superfluous snprintf() usage (bsc#1051510).\n - ALSA: pcm: Use a macro for parameter masks to reduce the needed cast\n (bsc#1051510).\n - ALSA: pcm: oss: Avoid plugin buffer overflow (git-fixes).\n - ALSA: pcm: oss: Fix regression by buffer overflow fix (bsc#1051510).\n - ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks\n (git-fixes).\n - ALSA: pcm: oss: Unlock mutex temporarily for sleeping at read/write\n (bsc#1051510).\n - ALSA: seq: oss: Fix running status after receiving sysex (git-fixes).\n - ALSA: seq: virmidi: Fix running status after receiving sysex (git-fixes).\n - ALSA: usb-audio: Add delayed_register option (bsc#1051510).\n - ALSA: usb-audio: Add support for MOTU MicroBook IIc (bsc#1051510).\n - ALSA: usb-audio: Create a registration quirk for Kingston HyperX Amp\n (0951:16d8) (bsc#1051510).\n - ALSA: usb-audio: Do not create a mixer element with bogus volume range\n (bsc#1051510).\n - ALSA: usb-audio: Fix case when USB MIDI interface has more than one\n extra endpoint descriptor (bsc#1051510).\n - ALSA: usb-audio: Fix mixer controls' USB interface for Kingston HyperX\n Amp (0951:16d8) (bsc#1051510).\n - ALSA: usb-audio: Inform devices that need delayed registration\n (bsc#1051510).\n - ALSA: usb-audio: Parse source ID of UAC2 effect unit (bsc#1051510).\n - ALSA: usb-audio: Rewrite registration quirk handling (bsc#1051510).\n - ALSA: usb-midi: Replace zero-length array with flexible-array member\n (bsc#1051510).\n - ALSA: usx2y: use for_each_pcm_streams() macro (bsc#1051510).\n - ALSA: via82xx: Fix endianness annotations (bsc#1051510).\n - ASoC: Intel: atom: Take the drv->lock mutex before calling\n sst_send_slot_map() (bsc#1051510).\n - ASoC: Intel: mrfld: fix incorrect check on p->sink (bsc#1051510).\n - ASoC: Intel: mrfld: return error codes when an error occurs\n (bsc#1051510).\n - ASoC: jz4740-i2s: Fix divider written at incorrect offset in register\n (bsc#1051510).\n - ASoC: sun8i-codec: Remove unused dev from codec struct (bsc#1051510).\n - Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl (bsc#1051510).\n - Btrfs: clean up error handling in btrfs_truncate() (bsc#1165949).\n - Btrfs: do not reset bio->bi_ops while writing bio (bsc#1168273).\n - Btrfs: fix missing delayed iputs on unmount (bsc#1165949).\n - Btrfs: fix qgroup double free after failure to reserve metadata for\n delalloc (bsc#1165949).\n - Btrfs: fix race leading to metadata space leak after task received\n signal (bsc#1165949).\n - Btrfs: fix unwritten extent buffers and hangs on future writeback\n attempts (bsc#1168273).\n - Btrfs: make plug in writing meta blocks really work (bsc#1168273).\n - Btrfs: only check delayed ref usage in should_end_transaction\n (bsc#1165949).\n - Btrfs: remove bio_flags which indicates a meta block of log-tree\n (bsc#1168273).\n - Crypto: chelsio - Fixes a deadlock between rtnl_lock and uld_mutex\n (bsc#1111666).\n - Crypto: chelsio - Fixes a hang issue during driver registration\n (bsc#1111666).\n - Deprecate NR_UNSTABLE_NFS, use NR_WRITEBACK (bsc#1163403).\n - HID: apple: Add support for recent firmware on Magic Keyboards\n (bsc#1051510).\n - IB/hfi1: convert to debugfs_file_get() and -put() (bsc#1159198\n bsc#1109911). Prerequisite for bsc#1159198.\n - Input: add safety guards to input_set_keycode() (bsc#1168075).\n - Input: avoid BIT() macro usage in the serio.h UAPI header (bsc#1051510).\n - Input: raydium_i2c_ts - fix error codes in raydium_i2c_boot_trigger()\n (bsc#1051510).\n - Input: synaptics - enable RMI on HP Envy 13-ad105ng (bsc#1051510).\n - MM: replace PF_LESS_THROTTLE with PF_LOCAL_THROTTLE (bsc#1163403).\n - NFC: fdp: Fix a signedness bug in fdp_nci_send_patch() (bsc#1051510).\n - NFS: send state management on a single connection (bsc#1167005).\n - OMAP: DSS2: remove non-zero check on variable r (bsc#1114279)\n - PCI/AER: Factor message prefixes with dev_fmt() (bsc#1161561).\n - PCI/AER: Log which device prevents error recovery (bsc#1161561).\n - PCI/AER: Remove ERR_FATAL code from ERR_NONFATAL path (bsc#1161561).\n - PCI/ASPM: Clear the correct bits when enabling L1 substates\n (bsc#1051510).\n - PCI/ERR: Always report current recovery status for udev (bsc#1161561).\n - PCI/ERR: Handle fatal error recovery (bsc#1161561).\n - PCI/ERR: Remove duplicated include from err.c (bsc#1161561).\n - PCI/ERR: Simplify broadcast callouts (bsc#1161561).\n - PCI/portdrv: Remove pcie_port_bus_type link order dependency\n (bsc#1161561).\n - PCI/switchtec: Fix init_completion race condition with poll_wait()\n (bsc#1051510).\n - PCI: Simplify disconnected marking (bsc#1161561).\n - PCI: Unify device inaccessible (bsc#1161561).\n - PCI: endpoint: Fix clearing start entry in configfs (bsc#1051510).\n - PCI: pciehp: Fix MSI interrupt race (bsc#1159037).\n - PCI: portdrv: Initialize service drivers directly (bsc#1161561).\n - PM: core: Fix handling of devices deleted during system-wide resume\n (git-fixes).\n - SUNRPC: defer slow parts of rpc_free_client() to a workqueue\n (bsc#1168202).\n - USB: Disable LPM on WD19's Realtek Hub (git-fixes).\n - USB: Fix novation SourceControl XL after suspend (git-fixes).\n - USB: cdc-acm: fix rounding error in TIOCSSERIAL (git-fixes).\n - USB: hub: Do not record a connect-change event during reset-resume\n (git-fixes).\n - USB: misc: iowarrior: add support for 2 OEMed devices (git-fixes).\n - USB: misc: iowarrior: add support for the 100 device (git-fixes).\n - USB: misc: iowarrior: add support for the 28 and 28L devices (git-fixes).\n - USB: serial: io_edgeport: fix slab-out-of-bounds read in\n edge_interrupt_callback (bsc#1051510).\n - USB: serial: option: add ME910G1 ECM composition 0x110b (git-fixes).\n - USB: serial: pl2303: add device-id for HP LD381 (git-fixes).\n - ahci: Add support for Amazon's Annapurna Labs SATA controller\n (bsc#1169013).\n - apei/ghes: Do not delay GHES polling (bsc#1166982).\n - ath9k: Handle txpower changes even when TPC is disabled (bsc#1051510).\n - batman-adv: Avoid spurious warnings from bat_v neigh_cmp implementation\n (bsc#1051510).\n - batman-adv: Do not schedule OGM for disabled interface (bsc#1051510).\n - batman-adv: prevent TT request storms by not sending inconsistent TT\n TLVLs (bsc#1051510).\n - binfmt_elf: Do not move brk for INTERP-less ET_EXEC (bsc#1169013).\n - binfmt_elf: move brk out of mmap when doing direct loader exec\n (bsc#1169013).\n - blk-mq: Allow blocking queue tag iter callbacks (bsc#1167316).\n - block, bfq: fix use-after-free in bfq_idle_slice_timer_body\n (bsc#1168760).\n - block: keep bdi->io_pages in sync with max_sectors_kb for stacked\n devices (bsc#1168762).\n - bnxt_en: Support all variants of the 5750X chip family (bsc#1167216).\n - bpf: Explicitly memset some bpf info structures declared on the stack\n (bsc#1083647).\n - bpf: Explicitly memset the bpf_attr structure (bsc#1083647).\n - brcmfmac: abort and release host after error (bsc#1111666).\n - btrfs: Account for trans_block_rsv in may_commit_transaction\n (bsc#1165949).\n - btrfs: Add enospc_debug printing in metadata_reserve_bytes (bsc#1165949).\n - btrfs: Do mandatory tree block check before submitting bio (bsc#1168273).\n - btrfs: Improve global reserve stealing logic (bsc#1165949).\n - btrfs: Output ENOSPC debug info in inc_block_group_ro (bsc#1165949).\n - btrfs: Remove btrfs_inode::delayed_iput_count (bsc#1165949).\n - btrfs: Remove fs_info from do_chunk_alloc (bsc#1165949).\n - btrfs: Remove redundant argument of flush_space (bsc#1165949).\n - btrfs: Remove redundant mirror_num arg (bsc#1168273).\n - btrfs: Rename bin_search -> btrfs_bin_search (bsc#1168273).\n - btrfs: add a flush step for delayed iputs (bsc#1165949).\n - btrfs: add assertions for releasing trans handle reservations\n (bsc#1165949).\n - btrfs: add btrfs_delete_ref_head helper (bsc#1165949).\n - btrfs: add enospc debug messages for ticket failure (bsc#1165949).\n - btrfs: add new flushing states for the delayed refs rsv (bsc#1165949).\n - btrfs: add space reservation tracepoint for reserved bytes (bsc#1165949).\n - btrfs: adjust dirty_metadata_bytes after writeback failure of extent\n buffer (bsc#1168273).\n - btrfs: allow us to use up to 90% of the global rsv for unlink\n (bsc#1165949).\n - btrfs: always reserve our entire size for the global reserve\n (bsc#1165949).\n - btrfs: assert on non-empty delayed iputs (bsc##1165949).\n - btrfs: be more explicit about allowed flush states (bsc#1165949).\n - btrfs: call btrfs_create_pending_block_groups unconditionally\n (bsc#1165949).\n - btrfs: catch cow on deleting snapshots (bsc#1165949).\n - btrfs: change the minimum global reserve size (bsc#1165949).\n - btrfs: check if there are free block groups for commit (bsc#1165949).\n - btrfs: cleanup extent_op handling (bsc#1165949).\n - btrfs: cleanup root usage by btrfs_get_alloc_profile (bsc#1165949).\n - btrfs: cleanup the target logic in __btrfs_block_rsv_release\n (bsc#1165949).\n - btrfs: clear space cache inode generation always (bsc#1165949).\n - btrfs: delayed-ref: pass delayed_refs directly to btrfs_delayed_ref_lock\n (bsc#1165949).\n - btrfs: do not account global reserve in can_overcommit (bsc#1165949).\n - btrfs: do not allow reservations if we have pending tickets\n (bsc#1165949).\n - btrfs: do not call btrfs_start_delalloc_roots in flushoncommit\n (bsc#1165949).\n - btrfs: do not end the transaction for delayed refs in throttle\n (bsc#1165949).\n - btrfs: do not enospc all tickets on flush failure (bsc#1165949).\n - btrfs: do not run delayed refs in the end transaction logic\n (bsc#1165949).\n - btrfs: do not run delayed_iputs in commit (bsc##1165949).\n - btrfs: do not use ctl->free_space for max_extent_size (bsc##1165949).\n - btrfs: do not use global reserve for chunk allocation (bsc#1165949).\n - btrfs: drop get_extent from extent_page_data (bsc#1168273).\n - btrfs: drop min_size from evict_refill_and_join (bsc##1165949).\n - btrfs: drop unused space_info parameter from create_space_info\n (bsc#1165949).\n - btrfs: dump block_rsv details when dumping space info (bsc#1165949).\n - btrfs: export __btrfs_block_rsv_release (bsc#1165949).\n - btrfs: export block group accounting helpers (bsc#1165949).\n - btrfs: export block_rsv_use_bytes (bsc#1165949).\n - btrfs: export btrfs_block_rsv_add_bytes (bsc#1165949).\n - btrfs: export space_info_add_*_bytes (bsc#1165949).\n - btrfs: export the block group caching helpers (bsc#1165949).\n - btrfs: export the caching control helpers (bsc#1165949).\n - btrfs: export the excluded extents helpers (bsc#1165949).\n - btrfs: extent-tree: Add lockdep assert when updating space info\n (bsc#1165949).\n - btrfs: extent-tree: Add trace events for space info numbers update\n (bsc#1165949).\n - btrfs: extent-tree: Detect bytes_may_use underflow earlier (bsc#1165949).\n - btrfs: extent-tree: Detect bytes_pinned underflow earlier (bsc#1165949).\n - btrfs: extent_io: Handle errors better in btree_write_cache_pages()\n (bsc#1168273).\n - btrfs: extent_io: Handle errors better in extent_write_full_page()\n (bsc#1168273).\n - btrfs: extent_io: Handle errors better in extent_write_locked_range()\n (bsc#1168273).\n - btrfs: extent_io: Handle errors better in extent_writepages()\n (bsc#1168273).\n - btrfs: extent_io: Kill dead condition in extent_write_cache_pages()\n (bsc#1168273).\n - btrfs: extent_io: Kill the forward declaration of flush_write_bio\n (bsc#1168273).\n - btrfs: extent_io: Move the BUG_ON() in flush_write_bio() one level up\n (bsc#1168273).\n - btrfs: extent_io: add proper error handling to\n lock_extent_buffer_for_io() (bsc#1168273).\n - btrfs: factor our read/write stage off csum_tree_block into its callers\n (bsc#1168273).\n - btrfs: factor out the ticket flush handling (bsc#1165949).\n - btrfs: fix insert_reserved error handling (bsc##1165949).\n - btrfs: fix may_commit_transaction to deal with no partial filling\n (bsc#1165949).\n - btrfs: fix truncate throttling (bsc#1165949).\n - btrfs: force chunk allocation if our global rsv is larger than metadata\n (bsc#1165949).\n - btrfs: introduce an evict flushing state (bsc#1165949).\n - btrfs: introduce delayed_refs_rsv (bsc#1165949).\n - btrfs: loop in inode_rsv_refill (bsc#1165949).\n - btrfs: make btrfs_destroy_delayed_refs use btrfs_delayed_ref_lock\n (bsc#1165949).\n - btrfs: make btrfs_destroy_delayed_refs use btrfs_delete_ref_head\n (bsc#1165949).\n - btrfs: make caching_thread use btrfs_find_next_key (bsc#1165949).\n - btrfs: merge two flush_write_bio helpers (bsc#1168273).\n - btrfs: migrate btrfs_trans_release_chunk_metadata (bsc#1165949).\n - btrfs: migrate inc/dec_block_group_ro code (bsc#1165949).\n - btrfs: migrate nocow and reservation helpers (bsc#1165949).\n - btrfs: migrate the alloc_profile helpers (bsc#1165949).\n - btrfs: migrate the block group caching code (bsc#1165949).\n - btrfs: migrate the block group cleanup code (bsc#1165949).\n - btrfs: migrate the block group lookup code (bsc#1165949).\n - btrfs: migrate the block group read/creation code (bsc#1165949).\n - btrfs: migrate the block group ref counting stuff (bsc#1165949).\n - btrfs: migrate the block group removal code (bsc#1165949).\n - btrfs: migrate the block group space accounting helpers (bsc#1165949).\n - btrfs: migrate the block-rsv code to block-rsv.c (bsc#1165949).\n - btrfs: migrate the chunk allocation code (bsc#1165949).\n - btrfs: migrate the delalloc space stuff to it's own home (bsc#1165949).\n - btrfs: migrate the delayed refs rsv code (bsc#1165949).\n - btrfs: migrate the dirty bg writeout code (bsc#1165949).\n - btrfs: migrate the global_block_rsv helpers to block-rsv.c (bsc#1165949).\n - btrfs: move and export can_overcommit (bsc#1165949).\n - btrfs: move basic block_group definitions to their own header\n (bsc#1165949).\n - btrfs: move btrfs_add_free_space out of a header file (bsc#1165949).\n - btrfs: move btrfs_block_rsv definitions into it's own header\n (bsc#1165949).\n - btrfs: move btrfs_raid_group values to btrfs_raid_attr table\n (bsc#1165949).\n - btrfs: move btrfs_space_info_add_*_bytes to space-info.c (bsc#1165949).\n - btrfs: move dump_space_info to space-info.c (bsc#1165949).\n - btrfs: move reserve_metadata_bytes and supporting code to space-info.c\n (bsc#1165949).\n - btrfs: move space_info to space-info.h (bsc#1165949).\n - btrfs: move the space info update macro to space-info.h (bsc#1165949).\n - btrfs: move the space_info handling code to space-info.c (bsc#1165949).\n - btrfs: move the subvolume reservation stuff out of extent-tree.c\n (bsc#1165949).\n - btrfs: only check priority tickets for priority flushing (bsc#1165949).\n - btrfs: only free reserved extent if we didn't insert it (bsc##1165949).\n - btrfs: only reserve metadata_size for inodes (bsc#1165949).\n - btrfs: only track ref_heads in delayed_ref_updates (bsc#1165949).\n - btrfs: pass root to various extent ref mod functions (bsc#1165949).\n - btrfs: qgroup: Do not hold qgroup_ioctl_lock in btrfs_qgroup_inherit()\n (bsc#1165823).\n - btrfs: qgroup: Mark qgroup inconsistent if we're inherting snapshot to a\n new qgroup (bsc#1165823).\n - btrfs: refactor block group replication factor calculation to a helper\n (bsc#1165949).\n - btrfs: refactor priority_reclaim_metadata_space (bsc#1165949).\n - btrfs: refactor the ticket wakeup code (bsc#1165949).\n - btrfs: release metadata before running delayed refs (bsc##1165949).\n - btrfs: remove orig_bytes from reserve_ticket (bsc#1165949).\n - btrfs: rename btrfs_space_info_add_old_bytes (bsc#1165949).\n - btrfs: rename do_chunk_alloc to btrfs_chunk_alloc (bsc#1165949).\n - btrfs: rename the btrfs_calc_*_metadata_size helpers (bsc#1165949).\n - btrfs: replace cleaner_delayed_iput_mutex with a waitqueue (bsc#1165949).\n - btrfs: reserve delalloc metadata differently (bsc#1165949).\n - btrfs: reserve extra space during evict (bsc#1165949).\n - btrfs: reset max_extent_size on clear in a bitmap (bsc##1165949).\n - btrfs: reset max_extent_size properly (bsc##1165949).\n - btrfs: rework btrfs_check_space_for_delayed_refs (bsc#1165949).\n - btrfs: rework wake_all_tickets (bsc#1165949).\n - btrfs: roll tracepoint into btrfs_space_info_update helper (bsc#1165949).\n - btrfs: run btrfs_try_granting_tickets if a priority ticket fails\n (bsc#1165949).\n - btrfs: run delayed iput at unlink time (bsc#1165949).\n - btrfs: run delayed iputs before committing (bsc#1165949).\n - btrfs: set max_extent_size properly (bsc##1165949).\n - btrfs: sink extent_write_full_page tree argument (bsc#1168273).\n - btrfs: sink extent_write_locked_range tree parameter (bsc#1168273).\n - btrfs: sink flush_fn to extent_write_cache_pages (bsc#1168273).\n - btrfs: sink get_extent parameter to extent_write_full_page (bsc#1168273).\n - btrfs: sink get_extent parameter to extent_write_locked_range\n (bsc#1168273).\n - btrfs: sink get_extent parameter to extent_fiemap (bsc#1168273).\n - btrfs: sink get_extent parameter to extent_readpages (bsc#1168273).\n - btrfs: sink get_extent parameter to extent_writepages (bsc#1168273).\n - btrfs: sink get_extent parameter to get_extent_skip_holes (bsc#1168273).\n - btrfs: sink writepage parameter to extent_write_cache_pages\n (bsc#1168273).\n - btrfs: stop partially refilling tickets when releasing space\n (bsc#1165949).\n - btrfs: stop using block_rsv_release_bytes everywhere (bsc#1165949).\n - btrfs: switch to on-stack csum buffer in csum_tree_block (bsc#1168273).\n - btrfs: temporarily export btrfs_get_restripe_target (bsc#1165949).\n - btrfs: temporarily export fragment_free_space (bsc#1165949).\n - btrfs: temporarily export inc_block_group_ro (bsc#1165949).\n - btrfs: track DIO bytes in flight (bsc#1165949).\n - btrfs: tree-checker: Remove comprehensive root owner check (bsc#1168273).\n - btrfs: unexport can_overcommit (bsc#1165949).\n - btrfs: unexport the temporary exported functions (bsc#1165949).\n - btrfs: unify error handling for ticket flushing (bsc#1165949).\n - btrfs: unify extent_page_data type passed as void (bsc#1168273).\n - btrfs: update may_commit_transaction to use the delayed refs rsv\n (bsc#1165949).\n - btrfs: use btrfs_try_granting_tickets in update_global_rsv (bsc#1165949).\n - btrfs: wait on caching when putting the bg cache (bsc#1165949).\n - btrfs: wait on ordered extents on abort cleanup (bsc#1165949).\n - btrfs: wakeup cleaner thread when adding delayed iput (bsc#1165949).\n - ceph: canonicalize server path in place (bsc#1168443).\n - ceph: check POOL_FLAG_FULL/NEARFULL in addition to OSDMAP_FULL/NEARFULL\n (bsc#1169307).\n - ceph: remove the extra slashes in the server path (bsc#1168443).\n - cfg80211: check reg_rule for NULL in handle_channel_custom()\n (bsc#1051510).\n - cfg80211: check wiphy driver existence for drvinfo report (bsc#1051510).\n - cgroup: memcg: net: do not associate sock with unrelated cgroup\n (bsc#1167290).\n - cifs: ignore cached share root handle closing errors (bsc#1166780).\n - clk: imx: Align imx sc clock msg structs to 4 (bsc#1111666).\n - clk: imx: Align imx sc clock msg structs to 4 (git-fixes).\n - clk: qcom: rcg: Return failure for RCG update (bsc#1051510).\n - configfs: Fix bool initialization/comparison (bsc#1051510).\n - cpufreq: Register drivers only after CPU devices have been registered\n (bsc#1051510).\n - cpuidle: Do not unset the driver if it is there already (bsc#1051510).\n - crypto: arm64/sha-ce - implement export/import (bsc#1051510).\n - crypto: mxs-dcp - fix scatterlist linearization for hash (bsc#1051510).\n - crypto: tcrypt - fix printed skcipher [a]sync mode (bsc#1051510).\n - debugfs: add support for more elaborate ->d_fsdata (bsc#1159198\n bsc#1109911). Prerequisite for bsc#1159198.\n - debugfs: call debugfs_real_fops() only after debugfs_file_get()\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n - debugfs: call debugfs_real_fops() only after debugfs_file_get()\n (bsc#1159198). Prerequisite for bsc#1159198.\n - debugfs: convert to debugfs_file_get() and -put() (bsc#1159198\n bsc#1109911). Prerequisite for bsc#1159198.\n - debugfs: debugfs_real_fops(): drop __must_hold sparse annotation\n (bsc#1159198 bsc#1109911). Prerequisite for bsc#1159198.\n - debugfs: debugfs_use_start/finish do not exist anymore (bsc#1159198).\n Prerequisite for bsc#1159198.\n - debugfs: defer debugfs_fsdata allocation to first usage (bsc#1159198\n bsc#1109911). Prerequisite for bsc#1159198.\n - debugfs: defer debugfs_fsdata allocation to first usage (bsc#1159198).\n Prerequisite for bsc#1159198.\n - debugfs: fix debugfs_real_fops() build error (bsc#1159198 bsc#1109911).\n Prerequisite for bsc#1159198.\n - debugfs: implement per-file removal protection (bsc#1159198\n bsc#1109911). Prerequisite for bsc#1159198.\n - debugfs: purge obsolete SRCU based removal protection (bsc#1159198\n bsc#1109911). Prerequisite for bsc#1159198.\n - debugfs: simplify __debugfs_remove_file() (bsc#1159198). Prerequisite\n for bsc#1159198.\n - dmaengine: ste_dma40: fix unneeded variable warning (bsc#1051510).\n - drm/amd/amdgpu: Fix GPR read from debugfs (v2) (bsc#1113956)\n - drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017\n (bsc#1111666).\n - drm/amd/display: Fix wrongly passed static prefix (bsc#1111666).\n - drm/amd/display: remove duplicated assignment to grph_obj_type\n (bsc#1051510).\n - drm/amdgpu: fix typo for vcn1 idle check (bsc#1111666).\n - drm/bochs: downgrade pci_request_region failure from error to warning\n (bsc#1051510).\n - drm/bridge: dw-hdmi: fix AVI frame colorimetry (bsc#1051510).\n - drm/drm_dp_mst:remove set but not used variable 'origlen' (bsc#1051510).\n - drm/exynos: dsi: fix workaround for the legacy clock name (bsc#1111666).\n - drm/exynos: dsi: propagate error value and silence meaningless warning\n (bsc#1111666).\n - drm/lease: fix WARNING in idr_destroy (bsc#1113956)\n - drm/msm: Set dma maximum segment size for mdss (bsc#1051510).\n - drm/msm: Use the correct dma_sync calls harder (bsc#1051510).\n - drm/msm: Use the correct dma_sync calls in msm_gem (bsc#1051510).\n - drm/msm: stop abusing dma_map/unmap for cache (bsc#1051510).\n - drm/sun4i: dsi: Use NULL to signify "no panel" (bsc#1111666).\n - drm/v3d: Replace wait_for macros to remove use of msleep (bsc#1111666).\n - drm/vc4: Fix HDMI mode validation (git-fixes).\n - drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read()\n (bsc#1051510).\n - dt-bindings: allow up to four clocks for orion-mdio (bsc#1051510).\n - efi: Do not attempt to map RCI2 config table if it does not exist\n (jsc#ECO-366, bsc#1168367).\n - efi: Export Runtime Configuration Interface table to sysfs (jsc#ECO-366,\n bsc#1168367).\n - efi: Fix a race and a buffer overflow while reading efivars via sysfs\n (bsc#1164893).\n - efi: x86: move efi_is_table_address() into arch/x86 (jsc#ECO-366,\n bsc#1168367).\n - ext4: Avoid ENOSPC when avoiding to reuse recently deleted inodes\n (bsc#1165019).\n - ext4: Check for non-zero journal inum in ext4_calculate_overhead\n (bsc#1167288).\n - ext4: add cond_resched() to __ext4_find_entry() (bsc#1166862).\n - ext4: do not assume that mmp_nodename/bdevname have NUL (bsc#1166860).\n - ext4: fix a data race in EXT4_I(inode)->i_disksize (bsc#1166861).\n - ext4: fix incorrect group count in ext4_fill_super error message\n (bsc#1168765).\n - ext4: fix incorrect inodes per group in error message (bsc#1168764).\n - ext4: fix potential race between online resizing and write operations\n (bsc#1166864).\n - ext4: fix potential race between s_flex_groups online resizing and\n access (bsc#1166867).\n - ext4: fix potential race between s_group_info online resizing and access\n (bsc#1166866).\n - ext4: fix race between writepages and enabling EXT4_EXTENTS_FL\n (bsc#1166870).\n - ext4: fix support for inode sizes > 1024 bytes (bsc#1164284).\n - ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()\n (bsc#1166940).\n - ext4: rename s_journal_flag_rwsem to s_writepages_rwsem (bsc#1166868).\n - ext4: validate the debug_want_extra_isize mount option at parse time\n (bsc#1163897).\n - fat: fix uninit-memory access for partial initialized inode\n (bsc#1051510).\n - fat: work around race with userspace's read via blockdev while mounting\n (bsc#1051510).\n - fbdev/g364fb: Fix build failure (bsc#1051510).\n - fbdev: potential information leak in do_fb_ioctl() (bsc#1114279)\n - fbmem: Adjust indentation in fb_prepare_logo and fb_blank (bsc#1114279)\n - firmware: arm_sdei: fix double-lock on hibernate with shared events\n (bsc#1111666).\n - firmware: arm_sdei: fix possible double-lock on hibernate error path\n (bsc#1111666).\n - ftrace/kprobe: Show the maxactive number on kprobe_events (git-fixes).\n - i2c: hix5hd2: add missed clk_disable_unprepare in remove (bsc#1051510).\n - i2c: jz4780: silence log flood on txabrt (bsc#1051510).\n - ibmvfc: do not send implicit logouts prior to NPIV login (bsc#1169625\n ltc#184611).\n - iio: gyro: adis16136: check ret val for non-zero vs less-than-zero\n (bsc#1051510).\n - iio: imu: adis16400: check ret val for non-zero vs less-than-zero\n (bsc#1051510).\n - iio: imu: adis16480: check ret val for non-zero vs less-than-zero\n (bsc#1051510).\n - iio: imu: adis: check ret val for non-zero vs less-than-zero\n (bsc#1051510).\n - iio: magnetometer: ak8974: Fix negative raw values in sysfs\n (bsc#1051510).\n - iio: potentiostat: lmp9100: fix\n iio_triggered_buffer_{predisable,postenable} positions (bsc#1051510).\n - intel_th: Fix user-visible error codes (bsc#1051510).\n - intel_th: pci: Add Elkhart Lake CPU support (bsc#1051510).\n - iommu/amd: Fix the configuration of GCR3 table root pointer\n (bsc#1169057).\n - ipmi: fix hung processes in __get_guid() (bsc#1111666).\n - ipmi:ssif: Handle a possible NULL pointer reference (bsc#1051510).\n - ipvlan: do not add hardware address of master to its unicast filter list\n (bsc#1137325).\n - irqchip/bcm2835: Quiesce IRQs left enabled by bootloader (bsc#1051510).\n - irqdomain: Fix a memory leak in irq_domain_push_irq() (bsc#1051510).\n - kABI workaround for pcie_port_bus_type change (bsc#1161561).\n - kABI: fixes for debugfs per-file removal protection backports\n (bsc#1159198 bsc#1109911).\n - kABI: restore debugfs_remove_recursive() (bsc#1159198).\n - kabi fix for (bsc#1168202).\n - libceph: fix alloc_msg_with_page_vector() memory leaks (bsc#1169308).\n - libfs: fix infoleak in simple_attr_read() (bsc#1168881).\n - lpfc: add support for translating an RSCN rcv into a discovery rescan\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - lpfc: add support to generate RSCN events for nport (bsc#1164777\n bsc#1164780 bsc#1165211).\n - mac80211: Do not send mesh HWMP PREQ if HWMP is disabled (bsc#1051510).\n - mac80211: consider more elements in parsing CRC (bsc#1051510).\n - mac80211: free peer keys before vif down in mesh (bsc#1051510).\n - mac80211: mesh: fix RCU warning (bsc#1051510).\n - mac80211: only warn once on chanctx_conf being NULL (bsc#1051510).\n - mac80211: rx: avoid RCU list traversal under mutex (bsc#1051510).\n - macsec: add missing attribute validation for port (bsc#1051510).\n - macsec: fix refcnt leak in module exit routine (bsc#1051510).\n - media: dib0700: fix rc endpoint lookup (bsc#1051510).\n - media: flexcop-usb: fix endpoint sanity check (git-fixes).\n - media: go7007: Fix URB type for interrupt handling (bsc#1051510).\n - media: ov519: add missing endpoint sanity checks (bsc#1168829).\n - media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support\n (bsc#1051510).\n - media: ov6650: Fix some format attributes not under control\n (bsc#1051510).\n - media: ov6650: Fix stored crop rectangle not in sync with hardware\n (bsc#1051510).\n - media: ov6650: Fix stored frame format not in sync with hardware\n (bsc#1051510).\n - media: stv06xx: add missing descriptor sanity checks (bsc#1168854).\n - media: tda10071: fix unsigned sign extension overflow (bsc#1051510).\n - media: usbtv: fix control-message timeouts (bsc#1051510).\n - media: v4l2-core: fix entity initialization in device_register_subdev\n (bsc#1051510).\n - media: vsp1: tidyup VI6_HGT_LBn_H() macro (bsc#1051510).\n - media: xirlink_cit: add missing descriptor sanity checks (bsc#1051510).\n - mfd: dln2: Fix sanity checking for endpoints (bsc#1051510).\n - misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices\n (bsc#1051510).\n - mm/filemap.c: do not initiate writeback if mapping has no dirty pages\n (bsc#1168884).\n - mm/memory_hotplug.c: only respect mem= parameter during boot stage\n (bsc#1065600).\n - mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2 (bsc#1051510).\n - mwifiex: set needed_headroom, not hard_header_len (bsc#1051510).\n - net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL\n (bsc#1051510).\n - net/sched: flower: add missing validation of TCA_FLOWER_FLAGS\n (networking-stable-20_02_19).\n - net/sched: matchall: add missing validation of TCA_MATCHALL_FLAGS\n (networking-stable-20_02_19).\n - net/smc: fix leak of kernel memory to user space\n (networking-stable-20_02_19).\n - net: dsa: tag_qca: Make sure there is headroom for tag\n (networking-stable-20_02_19).\n - net: ena: Add PCI shutdown handler to allow safe kexec (bsc#1167421,\n bsc#1167423).\n - net: nfc: fix bounds checking bugs on "pipe" (bsc#1051510).\n - net: phy: micrel: kszphy_resume(): add delay after genphy_resume()\n before accessing PHY registers (bsc#1051510).\n - net_sched: keep alloc_hash updated after hash allocation (git-fixes).\n - netfilter: conntrack: sctp: use distinct states for new SCTP connections\n (bsc#1159199).\n - nvme-multipath: also check for a disabled path if there is a single\n sibling (bsc#1158983).\n - nvme-multipath: do not select namespaces which are about to be removed\n (bsc#1158983).\n - nvme-multipath: factor out a nvme_path_is_disabled helper (bsc#1158983).\n - nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths (bsc#1158983).\n - nvme-multipath: fix possible I/O hang when paths are updated\n (bsc#1158983).\n - nvme-multipath: fix possible io hang after ctrl reconnect (bsc#1158983).\n - nvme-multipath: remove unused groups_only mode in ana log (bsc#1158983).\n - nvme-multipath: round-robin I/O policy (bsc#1158983).\n - nvme: fix a possible deadlock when passthru commands sent to a multipath\n device (bsc#1158983).\n - nvme: fix controller removal race with scan work (bsc#1158983).\n - objtool: Add is_static_jump() helper (bsc#1169514).\n - objtool: Add relocation check for alternative sections (bsc#1169514).\n - partitions/efi: Fix partition name parsing in GUID partition entry\n (bsc#1168763).\n - perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT\n flag (bsc#1114279).\n - perf: qcom_l2: fix column exclusion check (git-fixes).\n - pinctrl: core: Remove extra kref_get which blocks hogs being freed\n (bsc#1051510).\n - platform/x86: pmc_atom: Add Lex 2I385SW to critclk_systems DMI table\n (bsc#1051510).\n - powerpc/64/tm: Do not let userspace set regs->trap via sigreturn\n (bsc#1118338 ltc#173734).\n - powerpc/64: mark start_here_multiplatform as __ref (bsc#1148868).\n - powerpc/64s: Fix section mismatch warnings from boot code (bsc#1148868).\n - powerpc/hash64/devmap: Use H_PAGE_THP_HUGE when setting up huge devmap\n PTE entries (bsc#1065729).\n - powerpc/kprobes: Ignore traps that happened in real mode (bsc#1065729).\n - powerpc/mm: Fix section mismatch warning in\n stop_machine_change_mapping() (bsc#1148868).\n - powerpc/pseries/ddw: Extend upper limit for huge DMA window for\n persistent memory (bsc#1142685 ltc#179509).\n - powerpc/pseries/iommu: Fix set but not used values (bsc#1142685\n ltc#179509).\n - powerpc/pseries/iommu: Use memory@ nodes in max RAM address calculation\n (bsc#1142685 ltc#179509).\n - powerpc/vmlinux.lds: Explicitly retain .gnu.hash (bsc#1148868).\n - powerpc/xive: Replace msleep(x) with msleep(OPAL_BUSY_DELAY_MS)\n (bsc#1085030).\n - powerpc/xive: Use XIVE_BAD_IRQ instead of zero to catch non configured\n IPIs (bsc#1085030).\n - pwm: bcm2835: Dynamically allocate base (bsc#1051510).\n - pwm: meson: Fix confusing indentation (bsc#1051510).\n - pwm: pca9685: Fix PWM/GPIO inter-operation (bsc#1051510).\n - pwm: rcar: Fix late Runtime PM enablement (bsc#1051510).\n - pwm: renesas-tpu: Fix late Runtime PM enablement (bsc#1051510).\n - pxa168fb: fix release function mismatch in probe failure (bsc#1051510).\n - qmi_wwan: unconditionally reject 2 ep interfaces (bsc#1051510).\n - rtlwifi: rtl8192de: Fix missing callback that tests for hw release of\n buffer (git-fixes).\n - s390/mm: fix dynamic pagetable upgrade for hugetlbfs (bsc#1165182\n LTC#184102).\n - s390/qeth: fix potential deadlock on workqueue flush (bsc#1165185\n LTC#184108).\n - scsi: core: avoid repetitive logging of device offline messages\n (bsc#1145929).\n - scsi: core: kABI fix offline_already (bsc#1145929).\n - scsi: fc: Update Descriptor definition and add RDF and Link Integrity\n FPINs (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: ibmvfc: Fix NULL return compiler warning (bsc#1161951 ltc#183551).\n - scsi: lpfc: Change default SCSI LUN QD to 64 (bsc#1164777 bsc#1164780\n bsc#1165211 jsc#SLE-8654).\n - scsi: lpfc: Clean up hba max_lun_queue_depth checks (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Copyright updates for 12.6.0.4 patches (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix Fabric hostname registration if system hostname changes\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix MDS Latency Diagnostics Err-drop rates (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix RQ buffer leakage when no IOCBs available (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix broken Credit Recovery after driver load (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix compiler warning on frame size (bsc#1164777 bsc#1164780\n bsc#1165211).\n - scsi: lpfc: Fix coverity errors in fmdi attribute handling (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix crash after handling a pci error (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix crash in target side cable pulls hitting WAIT_FOR_UNREG\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix disablement of FC-AL on lpe35000 models (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix driver nvme rescan logging (bsc#1164777 bsc#1164780\n bsc#1165211).\n - scsi: lpfc: Fix erroneous cpu limit of 128 on I/O statistics\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix improper flag check for IO type (bsc#1164777 bsc#1164780\n bsc#1165211).\n - scsi: lpfc: Fix incomplete NVME discovery when target (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix lockdep error - register non-static key (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix lpfc overwrite of sg_cnt field in nvmefc_tgt_fcp_req\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix lpfc_io_buf resource leak in lpfc_get_scsi_buf_s4 error\n path (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix missing check for CSF in Write Object Mbox Rsp\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix ras_log via debugfs (bsc#1164777 bsc#1164780\n bsc#1165211).\n - scsi: lpfc: Fix registration of ELS type support in fdmi (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix release of hwq to clear the eq relationship (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix scsi host template for SLI3 vports (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix unmap of dpp bars affecting next driver load\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix update of wq consumer index in lpfc_sli4_wq_release\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: Fix: Rework setting of fdmi symbolic node name registration\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: Make debugfs ktime stats generic for NVME and SCSI\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: Make lpfc_defer_acc_rsp static (bsc#1164777 bsc#1164780\n bsc#1165211).\n - scsi: lpfc: Remove handler for obsolete ELS - Read Port Status (RPS)\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: Remove prototype FIPS/DSS options from SLI-3 (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: lpfc: Update lpfc version to 12.6.0.3 (bsc#1164777 bsc#1164780\n bsc#1165211).\n - scsi: lpfc: Update lpfc version to 12.6.0.4 (bsc#1164777 bsc#1164780\n bsc#1165211).\n - scsi: lpfc: Update lpfc version to 12.8.0.0 (bsc#1164777 bsc#1164780\n bsc#1165211).\n - scsi: lpfc: add RDF registration and Link Integrity FPIN logging\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: fix spelling mistake "Notication" -> "Notification"\n (bsc#1164777 bsc#1164780 bsc#1165211).\n - scsi: lpfc: fix spelling mistakes of asynchronous (bsc#1164777\n bsc#1164780 bsc#1165211).\n - scsi: qla2xxx: Fix I/Os being passed down when FC device is being\n deleted (bsc#1157424).\n - serdev: ttyport: restore client ops on deregistration (bsc#1051510).\n - staging: ccree: use signal safe completion wait (git-fixes).\n - staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table\n (bsc#1051510).\n - staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi (bsc#1051510).\n - staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb\n (bsc#1051510).\n - staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback\n (bsc#1051510).\n - swiotlb: do not panic on mapping failures (bsc#1162171).\n - swiotlb: remove the overflow buffer (bsc#1162171).\n - thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n\n (bsc#1051510).\n - tpm: ibmvtpm: Wait for buffer to be set before proceeding (bsc#1065729).\n - tty/serial: atmel: manage shutdown in case of RS485 or ISO7816 mode\n (bsc#1051510).\n - tty: evh_bytechan: Fix out of bounds accesses (bsc#1051510).\n - tty: serial: imx: setup the correct sg entry for tx dma (bsc#1051510).\n - usb: audio-v2: Add uac2_effect_unit_descriptor definition (bsc#1051510).\n - usb: core: hub: do error out if usb_autopm_get_interface() fails\n (git-fixes).\n - usb: core: port: do error out if usb_autopm_get_interface() fails\n (git-fixes).\n - usb: dwc2: Fix in ISOC request length checking (git-fixes).\n - usb: gadget: composite: Fix bMaxPower for SuperSpeedPlus (git-fixes).\n - usb: gadget: f_fs: Fix use after free issue as part of queue failure\n (bsc#1051510).\n - usb: host: xhci-plat: add a shutdown (git-fixes).\n - usb: musb: Disable pullup at init (git-fixes).\n - usb: musb: fix crash with highmen PIO and usbmon (bsc#1051510).\n - usb: quirks: add NO_LPM quirk for Logitech Screen Share (git-fixes).\n - usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters\n (git-fixes).\n - usb: storage: Add quirk for Samsung Fit flash (git-fixes).\n - usb: uas: fix a plug & unplug racing (git-fixes).\n - usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c\n (git-fixes).\n - virtio-blk: improve virtqueue error to BLK_STS (bsc#1167627).\n - virtio_ring: fix unmap of indirect descriptors (bsc#1162171).\n - x86/mce: Fix logic and comments around MSR_PPIN_CTL (bsc#1114279).\n - x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes\n (bsc#1114279).\n - xen/blkfront: fix memory allocation flags in blkfront_setup_indirect()\n (bsc#1168486).\n - xhci: Do not open code __print_symbolic() in xhci trace events\n (git-fixes).\n - xhci: apply XHCI_PME_STUCK_QUIRK to Intel Comet Lake platforms\n (git-fixes).\n\n", "edition": 1, "modified": "2020-04-23T15:31:46", "published": "2020-04-23T15:31:46", "id": "OPENSUSE-SU-2020:0543-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html", "title": "Security update for the Linux Kernel (important)", "type": "suse", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}}], "debian": [{"lastseen": "2020-08-12T00:55:30", "bulletinFamily": "unix", "cvelist": ["CVE-2019-7222", "CVE-2019-3460", "CVE-2018-19824", "CVE-2019-8980", "CVE-2018-14625", "CVE-2019-7221", "CVE-2018-16884", "CVE-2019-3701", "CVE-2019-6974", "CVE-2019-3459", "CVE-2019-9213", "CVE-2018-20169", "CVE-2018-1000026", "CVE-2019-3819", "CVE-2018-19985"], "description": "Package : linux-4.9\nVersion : 4.9.168-1~deb8u1\nCVE ID : CVE-2018-14625 CVE-2018-16884 CVE-2018-19824 CVE-2018-19985 \n CVE-2018-20169 CVE-2018-1000026 CVE-2019-3459 CVE-2019-3460 \n CVE-2019-3701 CVE-2019-3819 CVE-2019-6974 CVE-2019-7221 \n CVE-2019-7222 CVE-2019-8980 CVE-2019-9213\nDebian Bug : 904385 918103 922306\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2018-14625\n\n A use-after-free bug was found in the vhost driver for the Virtual\n Socket protocol. If this driver is used to communicate with a\n malicious virtual machine guest, the guest could read sensitive\n information from the host kernel.\n\nCVE-2018-16884\n\n A flaw was found in the NFS 4.1 client implementation. Mounting\n NFS shares in multiple network namespaces at the same time could\n lead to a user-after-free. Local users might be able to use this\n for denial of service (memory corruption or crash) or possibly\n for privilege escalation.\n\n This can be mitigated by disabling unprivileged users from\n creating user namespaces, which is the default in Debian.\n\nCVE-2018-19824\n\n Hui Peng and Mathias Payer discovered a use-after-free bug in the\n USB audio driver. A physically present attacker able to attach a\n specially designed USB device could use this for privilege\n escalation.\n\nCVE-2018-19985\n\n Hui Peng and Mathias Payer discovered a missing bounds check in the\n hso USB serial driver. A physically present user able to attach a\n specially designed USB device could use this to read sensitive\n information from the kernel or to cause a denial of service\n (crash).\n\nCVE-2018-20169\n\n Hui Peng and Mathias Payer discovered missing bounds checks in the\n USB core. A physically present attacker able to attach a specially\n designed USB device could use this to cause a denial of service\n (crash) or possibly for privilege escalation.\n\nCVE-2018-1000026\n\n It was discovered that Linux could forward aggregated network\n packets with a segmentation size too large for the output device.\n In the specific case of Broadcom NetXtremeII 10Gb adapters, this\n would result in a denial of service (firmware crash). This update\n adds a mitigation to the bnx2x driver for this hardware.\n\nCVE-2019-3459, CVE-2019-3460\n\n Shlomi Oberman, Yuli Shapiro and Karamba Security Ltd. research\n team discovered missing range checks in the Bluetooth L2CAP\n implementation. If Bluetooth is enabled, a nearby attacker\n could use these to read sensitive information from the kernel.\n\nCVE-2019-3701\n\n Muyu Yu and Marcus Meissner reported that the CAN gateway\n implementation allowed the frame length to be modified, typically\n resulting in out-of-bounds memory-mapped I/O writes. On a system\n with CAN devices present, a local user with CAP_NET_ADMIN\n capability in the initial net namespace could use this to cause a\n crash (oops) or other hardware-dependent impact.\n\nCVE-2019-3819\n\n A potential infinite loop was discovered in the HID debugfs\n interface exposed under /sys/kernel/debug/hid. A user with access\n to these files could use this for denial of service.\n\n This interface is only accessible to root by default, which fully\n mitigates the issue.\n\nCVE-2019-6974\n\n Jann Horn reported a use-after-free bug in KVM. A local user\n with access to /dev/kvm could use this to cause a denial of\n service (memory corruption or crash) or possibly for privilege\n escalation.\n\nCVE-2019-7221\n\n Jim Mattson and Felix Wilhelm reported a user-after-free bug in\n KVM's nested VMX implementation. On systems with Intel CPUs, a\n local user with access to /dev/kvm could use this to cause a\n denial of service (memory corruption or crash) or possibly for\n privilege escalation.\n\n Nested VMX is disabled by default, which fully mitigates the\n issue.\n\nCVE-2019-7222\n\n Felix Wilhelm reported an information leak in KVM for x86.\n A local user with access to /dev/kvm could use this to read\n sensitive information from the kernel.\n\nCVE-2019-8980\n\n A bug was discovered in the kernel_read_file() function used to\n load firmware files. In certain error conditions it could leak\n memory, which might lead to a denial of service. This is probbaly\n not exploitable in a Debian system.\n\nCVE-2019-9213\n\n Jann Horn reported that privileged tasks could cause stack\n segments, including those in other processes, to grow downward to\n address 0. On systems lacking SMAP (x86) or PAN (ARM), this\n exacerbated other vulnerabilities: a null pointer dereference\n could be exploited for privilege escalation rather than only for\n denial of service.\n\nFor Debian 8 "Jessie", these problems have been fixed in version\n4.9.168-1~deb8u1. This version also includes fixes for Debian bugs\n#904385, #918103, and #922306; and other fixes included in upstream\nstable updates.\n\nWe recommend that you upgrade your linux-4.9 and linux-latest-4.9\npackages. You will need to use "apt-get upgrade --with-new-pkgs"\nor "apt upgrade" as the binary package names have changed.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n\n-- \nBen Hutchings - Debian developer, member of kernel, installer and LTS teams\n", "edition": 10, "modified": "2019-05-03T10:08:07", "published": "2019-05-03T10:08:07", "id": "DEBIAN:DLA-1771-1:3CE68", "href": "https://lists.debian.org/debian-lts-announce/2019/debian-lts-announce-201905/msg00002.html", "title": "[SECURITY] [DLA 1771-1] linux-4.9 security update", "type": "debian", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-08-12T01:03:20", "bulletinFamily": "unix", "cvelist": ["CVE-2019-7222", "CVE-2017-5753", "CVE-2018-13053", "CVE-2018-19824", "CVE-2018-18690", "CVE-2016-10741", "CVE-2018-5848", "CVE-2018-5953", "CVE-2018-16862", "CVE-2017-13305", "CVE-2018-18710", "CVE-2018-18281", "CVE-2019-7221", "CVE-2018-16884", "CVE-2019-3701", "CVE-2018-17972", "CVE-2019-6974", "CVE-2019-9213", "CVE-2018-20169", "CVE-2018-3639", "CVE-2019-3819", "CVE-2018-19985", "CVE-2018-12896", "CVE-2018-20511"], "description": "Package : linux\nVersion : 3.16.64-2\nCVE ID : CVE-2016-10741 CVE-2017-5753 CVE-2017-13305 CVE-2018-3639\n CVE-2018-5848 CVE-2018-5953 CVE-2018-12896 CVE-2018-13053\n CVE-2018-16862 CVE-2018-16884 CVE-2018-17972 CVE-2018-18281\n CVE-2018-18690 CVE-2018-18710 CVE-2018-19824 CVE-2018-19985\n CVE-2018-20169 CVE-2018-20511 CVE-2019-3701 CVE-2019-3819\n CVE-2019-6974 CVE-2019-7221 CVE-2019-7222 CVE-2019-9213\nDebian Bug : 925919\n\nThe linux update issued as DLA-1731-1 caused a regression in the\nvmxnet3 (VMware virtual network adapter) driver. This update corrects\nthat regression, and an earlier regression in the CIFS network\nfilesystem implementation introduced in DLA-1422-1. For reference the\noriginal advisory text follows.\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2016-10741\n\n A race condition was discovered in XFS that would result in a\n crash (BUG). A local user permitted to write to an XFS volume\n could use this for denial of service.\n\nCVE-2017-5753\n\n Further instances of code that was vulnerable to Spectre variant 1\n (bounds-check bypass) have been mitigated.\n\nCVE-2017-13305\n\n A memory over-read was discovered in the keys subsystem's\n encrypted key type. A local user could use this for denial of\n service or possibly to read sensitive information.\n\nCVE-2018-3639 (SSB)\n\n Multiple researchers have discovered that Speculative Store Bypass\n (SSB), a feature implemented in many processors, could be used to\n read sensitive information from another context. In particular,\n code in a software sandbox may be able to read sensitive\n information from outside the sandbox. This issue is also known as\n Spectre variant 4.\n\n This update fixes bugs in the mitigations for SSB for AMD\n processors.\n\nCVE-2018-5848\n\n The wil6210 wifi driver did not properly validate lengths in scan\n and connection requests, leading to a possible buffer overflow.\n On systems using this driver, a local user with the CAP_NET_ADMIN\n capability could use this for denial of service (memory corruption\n or crash) or potentially for privilege escalation.\n\nCVE-2018-5953\n\n The swiotlb subsystem printed kernel memory addresses to the\n system log, which could help a local attacker to exploit other\n vulnerabilities.\n\nCVE-2018-12896, CVE-2018-13053\n\n Team OWL337 reported possible integer overflows in the POSIX\n timer implementation. These might have some security impact.\n\nCVE-2018-16862\n\n Vasily Averin and Pavel Tikhomirov from Virtuozzo Kernel Team\n discovered that the cleancache memory management feature did not\n invalidate cached data for deleted files. On Xen guests using the\n tmem driver, local users could potentially read data from other\n users' deleted files if they were able to create new files on the\n same volume.\n\nCVE-2018-16884\n\n A flaw was found in the NFS 4.1 client implementation. Mounting\n NFS shares in multiple network namespaces at the same time could\n lead to a user-after-free. Local users might be able to use this\n for denial of service (memory corruption or crash) or possibly\n for privilege escalation.\n\n This can be mitigated by disabling unprivileged users from\n creating user namespaces, which is the default in Debian.\n\nCVE-2018-17972\n\n Jann Horn reported that the /proc/*/stack files in procfs leaked\n sensitive data from the kernel. These files are now only readable\n by users with the CAP_SYS_ADMIN capability (usually only root)\n\nCVE-2018-18281\n\n Jann Horn reported a race condition in the virtual memory manager\n that can result in a process briefly having access to memory after\n it is freed and reallocated. A local user permitted to create\n containers could possibly exploit this for denial of service\n (memory corruption) or for privilege escalation.\n\nCVE-2018-18690\n\n Kanda Motohiro reported that XFS did not correctly handle some\n xattr (extended attribute) writes that require changing the disk\n format of the xattr. A user with access to an XFS volume could use\n this for denial of service.\n\nCVE-2018-18710\n\n It was discovered that the cdrom driver does not correctly\n validate the parameter to the CDROM_SELECT_DISC ioctl. A user with\n access to a cdrom device could use this to read sensitive\n information from the kernel or to cause a denial of service\n (crash).\n\nCVE-2018-19824\n\n Hui Peng and Mathias Payer discovered a use-after-free bug in the\n USB audio driver. A physically present attacker able to attach a\n specially designed USB device could use this for privilege\n escalation.\n\nCVE-2018-19985\n\n Hui Peng and Mathias Payer discovered a missing bounds check in the\n hso USB serial driver. A physically present user able to attach a\n specially designed USB device could use this to read sensitive\n information from the kernel or to cause a denial of service\n (crash).\n\nCVE-2018-20169\n\n Hui Peng and Mathias Payer discovered missing bounds checks in the\n USB core. A physically present attacker able to attach a specially\n designed USB device could use this to cause a denial of service\n (crash) or possibly for privilege escalation.\n\nCVE-2018-20511\n\n InfoSect reported an information leak in the AppleTalk IP/DDP\n implemntation. A local user with CAP_NET_ADMIN capability could\n use this to read sensitive information from the kernel.\n\nCVE-2019-3701\n\n Muyu Yu and Marcus Meissner reported that the CAN gateway\n implementation allowed the frame length to be modified, typically\n resulting in out-of-bounds memory-mapped I/O writes. On a system\n with CAN devices present, a local user with CAP_NET_ADMIN\n capability in the initial net namespace could use this to cause a\n crash (oops) or other hardware-dependent impact.\n\nCVE-2019-3819\n\n A potential infinite loop was discovered in the HID debugfs\n interface exposed under /sys/kernel/debug/hid. A user with access\n to these files could use this for denial of service.\n\n This interface is only accessible to root by default, which fully\n mitigates the issue.\n\nCVE-2019-6974\n\n Jann Horn reported a use-after-free bug in KVM. A local user\n with access to /dev/kvm could use this to cause a denial of\n service (memory corruption or crash) or possibly for privilege\n escalation.\n\nCVE-2019-7221\n\n Jim Mattson and Felix Wilhelm reported a user-after-free bug in\n KVM's nested VMX implementation. On systems with Intel CPUs, a\n local user with access to /dev/kvm could use this to cause a\n denial of service (memory corruption or crash) or possibly for\n privilege escalation.\n\n Nested VMX is disabled by default, which fully mitigates the\n issue.\n\nCVE-2019-7222\n\n Felix Wilhelm reported an information leak in KVM for x86.\n A local user with access to /dev/kvm could use this to read\n sensitive information from the kernel.\n\nCVE-2019-9213\n\n Jann Horn reported that privileged tasks could cause stack\n segments, including those in other processes, to grow downward to\n address 0. On systems lacking SMAP (x86) or PAN (ARM), this\n exacerbated other vulnerabilities: a null pointer dereference\n could be exploited for privilege escalation rather than only for\n denial of service.\n\nFor Debian 8 "Jessie", these problems have been fixed in version\n3.16.64-1.\n\nWe recommend that you upgrade your linux packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n\n-- \nBen Hutchings - Debian developer, member of kernel, installer and LTS teams\n", "edition": 14, "modified": "2019-04-01T18:39:17", "published": "2019-04-01T18:39:17", "id": "DEBIAN:DLA-1731-2:E6E1E", "href": "https://lists.debian.org/debian-lts-announce/2019/debian-lts-announce-201904/msg00004.html", "title": "[SECURITY] [DLA 1731-2] linux regression update", "type": "debian", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-08-12T01:06:55", "bulletinFamily": "unix", "cvelist": ["CVE-2019-7222", "CVE-2017-5753", "CVE-2018-13053", "CVE-2018-19824", "CVE-2018-18690", "CVE-2016-10741", "CVE-2018-5848", "CVE-2018-5953", "CVE-2018-16862", "CVE-2017-13305", "CVE-2018-18710", "CVE-2018-18281", "CVE-2019-7221", "CVE-2018-16884", "CVE-2019-3701", "CVE-2018-17972", "CVE-2019-6974", "CVE-2019-9213", "CVE-2018-20169", "CVE-2018-3639", "CVE-2019-3819", "CVE-2018-19985", "CVE-2018-12896", "CVE-2018-20511"], "description": "Package : linux\nVersion : 3.16.64-1\nCVE ID : CVE-2016-10741 CVE-2017-5753 CVE-2017-13305 CVE-2018-3639\n CVE-2018-5848 CVE-2018-5953 CVE-2018-12896 CVE-2018-13053\n CVE-2018-16862 CVE-2018-16884 CVE-2018-17972 CVE-2018-18281\n CVE-2018-18690 CVE-2018-18710 CVE-2018-19824 CVE-2018-19985\n CVE-2018-20169 CVE-2018-20511 CVE-2019-3701 CVE-2019-3819\n CVE-2019-6974 CVE-2019-7221 CVE-2019-7222 CVE-2019-9213\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2016-10741\n\n A race condition was discovered in XFS that would result in a\n crash (BUG). A local user permitted to write to an XFS volume\n could use this for denial of service.\n\nCVE-2017-5753\n\n Further instances of code that was vulnerable to Spectre variant 1\n (bounds-check bypass) have been mitigated.\n\nCVE-2017-13305\n\n A memory over-read was discovered in the keys subsystem's\n encrypted key type. A local user could use this for denial of\n service or possibly to read sensitive information.\n\nCVE-2018-3639 (SSB)\n\n Multiple researchers have discovered that Speculative Store Bypass\n (SSB), a feature implemented in many processors, could be used to\n read sensitive information from another context. In particular,\n code in a software sandbox may be able to read sensitive\n information from outside the sandbox. This issue is also known as\n Spectre variant 4.\n\n This update fixes bugs in the mitigations for SSB for AMD\n processors.\n\nCVE-2018-5848\n\n The wil6210 wifi driver did not properly validate lengths in scan\n and connection requests, leading to a possible buffer overflow.\n On systems using this driver, a local user with the CAP_NET_ADMIN\n capability could use this for denial of service (memory corruption\n or crash) or potentially for privilege escalation.\n\nCVE-2018-5953\n\n The swiotlb subsystem printed kernel memory addresses to the\n system log, which could help a local attacker to exploit other\n vulnerabilities.\n\nCVE-2018-12896, CVE-2018-13053\n\n Team OWL337 reported possible integer overflows in the POSIX\n timer implementation. These might have some security impact.\n\nCVE-2018-16862\n\n Vasily Averin and Pavel Tikhomirov from Virtuozzo Kernel Team\n discovered that the cleancache memory management feature did not\n invalidate cached data for deleted files. On Xen guests using the\n tmem driver, local users could potentially read data from other\n users' deleted files if they were able to create new files on the\n same volume.\n\nCVE-2018-16884\n\n A flaw was found in the NFS 4.1 client implementation. Mounting\n NFS shares in multiple network namespaces at the same time could\n lead to a user-after-free. Local users might be able to use this\n for denial of service (memory corruption or crash) or possibly\n for privilege escalation.\n\n This can be mitigated by disabling unprivileged users from\n creating user namespaces, which is the default in Debian.\n\nCVE-2018-17972\n\n Jann Horn reported that the /proc/*/stack files in procfs leaked\n sensitive data from the kernel. These files are now only readable\n by users with the CAP_SYS_ADMIN capability (usually only root)\n\nCVE-2018-18281\n\n Jann Horn reported a race condition in the virtual memory manager\n that can result in a process briefly having access to memory after\n it is freed and reallocated. A local user permitted to create\n containers could possibly exploit this for denial of service\n (memory corruption) or for privilege escalation.\n\nCVE-2018-18690\n\n Kanda Motohiro reported that XFS did not correctly handle some\n xattr (extended attribute) writes that require changing the disk\n format of the xattr. A user with access to an XFS volume could use\n this for denial of service.\n\nCVE-2018-18710\n\n It was discovered that the cdrom driver does not correctly\n validate the parameter to the CDROM_SELECT_DISC ioctl. A user with\n access to a cdrom device could use this to read sensitive\n information from the kernel or to cause a denial of service\n (crash).\n\nCVE-2018-19824\n\n Hui Peng and Mathias Payer discovered a use-after-free bug in the\n USB audio driver. A physically present attacker able to attach a\n specially designed USB device could use this for privilege\n escalation.\n\nCVE-2018-19985\n\n Hui Peng and Mathias Payer discovered a missing bounds check in the\n hso USB serial driver. A physically present user able to attach a\n specially designed USB device could use this to read sensitive\n information from the kernel or to cause a denial of service\n (crash).\n\nCVE-2018-20169\n\n Hui Peng and Mathias Payer discovered missing bounds checks in the\n USB core. A physically present attacker able to attach a specially\n designed USB device could use this to cause a denial of service\n (crash) or possibly for privilege escalation.\n\nCVE-2018-20511\n\n InfoSect reported an information leak in the AppleTalk IP/DDP\n implemntation. A local user with CAP_NET_ADMIN capability could\n use this to read sensitive information from the kernel.\n\nCVE-2019-3701\n\n Muyu Yu and Marcus Meissner reported that the CAN gateway\n implementation allowed the frame length to be modified, typically\n resulting in out-of-bounds memory-mapped I/O writes. On a system\n with CAN devices present, a local user with CAP_NET_ADMIN\n capability in the initial net namespace could use this to cause a\n crash (oops) or other hardware-dependent impact.\n\nCVE-2019-3819\n\n A potential infinite loop was discovered in the HID debugfs\n interface exposed under /sys/kernel/debug/hid. A user with access\n to these files could use this for denial of service.\n\n This interface is only accessible to root by default, which fully\n mitigates the issue.\n\nCVE-2019-6974\n\n Jann Horn reported a use-after-free bug in KVM. A local user\n with access to /dev/kvm could use this to cause a denial of\n service (memory corruption or crash) or possibly for privilege\n escalation.\n\nCVE-2019-7221\n\n Jim Mattson and Felix Wilhelm reported a user-after-free bug in\n KVM's nested VMX implementation. On systems with Intel CPUs, a\n local user with access to /dev/kvm could use this to cause a\n denial of service (memory corruption or crash) or possibly for\n privilege escalation.\n\n Nested VMX is disabled by default, which fully mitigates the\n issue.\n\nCVE-2019-7222\n\n Felix Wilhelm reported an information leak in KVM for x86.\n A local user with access to /dev/kvm could use this to read\n sensitive information from the kernel.\n\nCVE-2019-9213\n\n Jann Horn reported that privileged tasks could cause stack\n segments, including those in other processes, to grow downward to\n address 0. On systems lacking SMAP (x86) or PAN (ARM), this\n exacerbated other vulnerabilities: a null pointer dereference\n could be exploited for privilege escalation rather than only for\n denial of service.\n\nFor Debian 8 "Jessie", these problems have been fixed in version\n3.16.64-1.\n\nWe recommend that you upgrade your linux packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n\n-- \nBen Hutchings - Debian developer, member of kernel, installer and LTS teams\n", "edition": 14, "modified": "2019-03-27T16:39:42", "published": "2019-03-27T16:39:42", "id": "DEBIAN:DLA-1731-1:D19BD", "href": "https://lists.debian.org/debian-lts-announce/2019/debian-lts-announce-201903/msg00034.html", "title": "[SECURITY] [DLA 1731-1] linux security update", "type": "debian", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "ubuntu": [{"lastseen": "2020-07-02T11:42:11", "bulletinFamily": "unix", "cvelist": ["CVE-2018-9517", "CVE-2019-7222", "CVE-2018-14610", "CVE-2019-3460", "CVE-2018-13100", "CVE-2017-18249", "CVE-2018-13099", "CVE-2018-14614", "CVE-2019-7221", "CVE-2018-16884", "CVE-2019-3701", "CVE-2019-6974", "CVE-2018-14612", "CVE-2019-3459", "CVE-2019-9213", "CVE-2018-14611", "CVE-2018-13097", "CVE-2019-3819", "CVE-2018-14616", "CVE-2018-14613"], "description": "It was discovered that a race condition existed in the f2fs file system \nimplementation in the Linux kernel. A local attacker could use this to \ncause a denial of service. (CVE-2017-18249)\n\nWen Xu discovered that the f2fs file system implementation in the Linux \nkernel did not properly validate metadata. An attacker could use this to \nconstruct a malicious f2fs image that, when mounted, could cause a denial \nof service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100, \nCVE-2018-14614, CVE-2018-14616)\n\nWen Xu and Po-Ning Tseng discovered that btrfs file system implementation \nin the Linux kernel did not properly validate metadata. An attacker could \nuse this to construct a malicious btrfs image that, when mounted, could \ncause a denial of service (system crash). (CVE-2018-14610, CVE-2018-14611, \nCVE-2018-14612, CVE-2018-14613)\n\nVasily Averin and Evgenii Shatokhin discovered that a use-after-free \nvulnerability existed in the NFS41+ subsystem when multiple network \nnamespaces are in use. A local attacker in a container could use this to \ncause a denial of service (system crash) or possibly execute arbitrary \ncode. (CVE-2018-16884)\n\nIt was discovered that a use-after-free vulnerability existed in the PPP \nover L2TP implementation in the Linux kernel. A privileged local attacker \ncould use this to possibly execute arbitrary code. (CVE-2018-9517)\n\nShlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information \nleak in the Bluetooth implementation of the Linux kernel. An attacker \nwithin Bluetooth range could use this to expose sensitive information \n(kernel memory). (CVE-2019-3459, CVE-2019-3460)\n\nJann Horn discovered that the KVM implementation in the Linux kernel \ncontained a use-after-free vulnerability. An attacker in a guest VM with \naccess to /dev/kvm could use this to cause a denial of service (guest VM \ncrash). (CVE-2019-6974)\n\nJim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in \nthe KVM subsystem of the Linux kernel, when using nested virtual machines. \nA local attacker in a guest VM could use this to cause a denial of service \n(system crash) or possibly execute arbitrary code in the host system. \n(CVE-2019-7221)\n\nFelix Wilhelm discovered that an information leak vulnerability existed in \nthe KVM subsystem of the Linux kernel, when nested virtualization is used. \nA local attacker could use this to expose sensitive information (host \nsystem memory to a guest VM). (CVE-2019-7222)\n\nJann Horn discovered that the mmap implementation in the Linux kernel did \nnot properly check for the mmap minimum address in some situations. A local \nattacker could use this to assist exploiting a kernel NULL pointer \ndereference vulnerability. (CVE-2019-9213)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in some \nsituations did not properly restrict the field size when processing \noutgoing frames. A local attacker with CAP_NET_ADMIN privileges could use \nthis to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux kernel's \nHID subsystem did not properly validate passed parameters in some \nsituations. A local privileged attacker could use this to cause a denial of \nservice (infinite loop). (CVE-2019-3819)", "edition": 3, "modified": "2019-04-02T00:00:00", "published": "2019-04-02T00:00:00", "id": "USN-3932-1", "href": "https://ubuntu.com/security/notices/USN-3932-1", "title": "Linux kernel vulnerabilities", "type": "ubuntu", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-02T11:41:06", "bulletinFamily": "unix", "cvelist": ["CVE-2018-9517", "CVE-2019-7222", "CVE-2018-14610", "CVE-2019-3460", "CVE-2018-13100", "CVE-2017-18249", "CVE-2018-13099", "CVE-2018-14614", "CVE-2019-7221", "CVE-2018-16884", "CVE-2019-3701", "CVE-2019-6974", "CVE-2018-14612", "CVE-2019-3459", "CVE-2019-9213", "CVE-2018-14611", "CVE-2018-13097", "CVE-2019-3819", "CVE-2018-14616", "CVE-2018-14613"], "description": "USN-3932-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 \nLTS. This update provides the corresponding updates for the Linux \nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu \n14.04 LTS.\n\nIt was discovered that a race condition existed in the f2fs file system \nimplementation in the Linux kernel. A local attacker could use this to \ncause a denial of service. (CVE-2017-18249)\n\nWen Xu discovered that the f2fs file system implementation in the Linux \nkernel did not properly validate metadata. An attacker could use this to \nconstruct a malicious f2fs image that, when mounted, could cause a denial \nof service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100, \nCVE-2018-14614, CVE-2018-14616)\n\nWen Xu and Po-Ning Tseng discovered that btrfs file system implementation \nin the Linux kernel did not properly validate metadata. An attacker could \nuse this to construct a malicious btrfs image that, when mounted, could \ncause a denial of service (system crash). (CVE-2018-14610, CVE-2018-14611, \nCVE-2018-14612, CVE-2018-14613)\n\nVasily Averin and Evgenii Shatokhin discovered that a use-after-free \nvulnerability existed in the NFS41+ subsystem when multiple network \nnamespaces are in use. A local attacker in a container could use this to \ncause a denial of service (system crash) or possibly execute arbitrary \ncode. (CVE-2018-16884)\n\nIt was discovered that a use-after-free vulnerability existed in the PPP \nover L2TP implementation in the Linux kernel. A privileged local attacker \ncould use this to possibly execute arbitrary code. (CVE-2018-9517)\n\nShlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information \nleak in the Bluetooth implementation of the Linux kernel. An attacker \nwithin Bluetooth range could use this to expose sensitive information \n(kernel memory). (CVE-2019-3459, CVE-2019-3460)\n\nJann Horn discovered that the KVM implementation in the Linux kernel \ncontained a use-after-free vulnerability. An attacker in a guest VM with \naccess to /dev/kvm could use this to cause a denial of service (guest VM \ncrash). (CVE-2019-6974)\n\nJim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in \nthe KVM subsystem of the Linux kernel, when using nested virtual machines. \nA local attacker in a guest VM could use this to cause a denial of service \n(system crash) or possibly execute arbitrary code in the host system. \n(CVE-2019-7221)\n\nFelix Wilhelm discovered that an information leak vulnerability existed in \nthe KVM subsystem of the Linux kernel, when nested virtualization is used. \nA local attacker could use this to expose sensitive information (host \nsystem memory to a guest VM). (CVE-2019-7222)\n\nJann Horn discovered that the mmap implementation in the Linux kernel did \nnot properly check for the mmap minimum address in some situations. A local \nattacker could use this to assist exploiting a kernel NULL pointer \ndereference vulnerability. (CVE-2019-9213)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in some \nsituations did not properly restrict the field size when processing \noutgoing frames. A local attacker with CAP_NET_ADMIN privileges could use \nthis to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux kernel's \nHID subsystem did not properly validate passed parameters in some \nsituations. A local privileged attacker could use this to cause a denial of \nservice (infinite loop). (CVE-2019-3819)", "edition": 3, "modified": "2019-04-02T00:00:00", "published": "2019-04-02T00:00:00", "id": "USN-3932-2", "href": "https://ubuntu.com/security/notices/USN-3932-2", "title": "Linux kernel (Xenial HWE) vulnerabilities", "type": "ubuntu", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-02T11:34:33", "bulletinFamily": "unix", "cvelist": ["CVE-2019-14763", "CVE-2019-15218", "CVE-2019-15090", "CVE-2019-3900", "CVE-2019-0136", "CVE-2019-14284", "CVE-2019-10639", "CVE-2018-20784", "CVE-2019-15216", "CVE-2019-15211", "CVE-2019-13648", "CVE-2019-9506", "CVE-2019-15215", "CVE-2019-13631", "CVE-2019-10207", "CVE-2019-15220", "CVE-2019-11810", "CVE-2019-15212", "CVE-2019-11599", "CVE-2019-15221", "CVE-2019-10638", "CVE-2019-3701", "CVE-2019-15292", "CVE-2019-11487", "CVE-2019-15214", "CVE-2019-3819", "CVE-2018-19985", "CVE-2019-14283"], "description": "USN 4115-1 fixed vulnerabilities in the Linux 4.15 kernel for Ubuntu \n18.04 LTS and Ubuntu 16.04 LTS. Unfortunately, as part of the update, \na regression was introduced that caused a kernel crash when handling \nfragmented packets in some situations. This update addresses the issue.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\nHui Peng and Mathias Payer discovered that the Option USB High Speed driver \nin the Linux kernel did not properly validate metadata received from the \ndevice. A physically proximate attacker could use this to cause a denial of \nservice (system crash). (CVE-2018-19985)\n\nZhipeng Xie discovered that an infinite loop could triggered in the CFS \nLinux kernel process scheduler. A local attacker could possibly use this to \ncause a denial of service. (CVE-2018-20784)\n\nIt was discovered that the Intel Wi-Fi device driver in the Linux kernel did \nnot properly validate certain Tunneled Direct Link Setup (TDLS). A \nphysically proximate attacker could use this to cause a denial of service \n(Wi-Fi disconnect). (CVE-2019-0136)\n\nIt was discovered that the Bluetooth UART implementation in the Linux \nkernel did not properly check for missing tty operations. A local attacker \ncould use this to cause a denial of service. (CVE-2019-10207)\n\nAmit Klein and Benny Pinkas discovered that the Linux kernel did not \nsufficiently randomize IP ID values generated for connectionless networking \nprotocols. A remote attacker could use this to track particular Linux \ndevices. (CVE-2019-10638)\n\nAmit Klein and Benny Pinkas discovered that the location of kernel \naddresses could be exposed by the implementation of connection-less network \nprotocols in the Linux kernel. A remote attacker could possibly use this to \nassist in the exploitation of another vulnerability in the Linux kernel. \n(CVE-2019-10639)\n\nIt was discovered that an integer overflow existed in the Linux kernel when \nreference counting pages, leading to potential use-after-free issues. A \nlocal attacker could use this to cause a denial of service (system crash) \nor possibly execute arbitrary code. (CVE-2019-11487)\n\nJann Horn discovered that a race condition existed in the Linux kernel when \nperforming core dumps. A local attacker could use this to cause a denial of \nservice (system crash) or expose sensitive information. (CVE-2019-11599)\n\nIt was discovered that a null pointer dereference vulnerability existed in \nthe LSI Logic MegaRAID driver in the Linux kernel. A local attacker could \nuse this to cause a denial of service (system crash). (CVE-2019-11810)\n\nIt was discovered that the GTCO tablet input driver in the Linux kernel did \nnot properly bounds check the initial HID report sent by the device. A \nphysically proximate attacker could use this to cause a denial of service \n(system crash) or possibly execute arbitrary code. (CVE-2019-13631)\n\nPraveen Pandey discovered that the Linux kernel did not properly validate \nsent signals in some situations on PowerPC systems with transactional \nmemory disabled. A local attacker could use this to cause a denial of \nservice. (CVE-2019-13648)\n\nIt was discovered that the floppy driver in the Linux kernel did not \nproperly validate meta data, leading to a buffer overread. A local attacker \ncould use this to cause a denial of service (system crash). \n(CVE-2019-14283)\n\nIt was discovered that the floppy driver in the Linux kernel did not \nproperly validate ioctl() calls, leading to a division-by-zero. A local \nattacker could use this to cause a denial of service (system crash). \n(CVE-2019-14284)\n\nTuba Yavuz discovered that a race condition existed in the DesignWare USB3 \nDRD Controller device driver in the Linux kernel. A physically proximate \nattacker could use this to cause a denial of service. (CVE-2019-14763)\n\nIt was discovered that an out-of-bounds read existed in the QLogic QEDI \niSCSI Initiator Driver in the Linux kernel. A local attacker could possibly \nuse this to expose sensitive information (kernel memory). (CVE-2019-15090)\n\nIt was discovered that the Raremono AM/FM/SW radio device driver in the \nLinux kernel did not properly allocate memory, leading to a use-after-free. \nA physically proximate attacker could use this to cause a denial of service \nor possibly execute arbitrary code. (CVE-2019-15211)\n\nIt was discovered at a double-free error existed in the USB Rio 500 device \ndriver for the Linux kernel. A physically proximate attacker could use this \nto cause a denial of service. (CVE-2019-15212)\n\nIt was discovered that a race condition existed in the Advanced Linux Sound \nArchitecture (ALSA) subsystem of the Linux kernel, leading to a potential \nuse-after-free. A physically proximate attacker could use this to cause a \ndenial of service (system crash) or possibly execute arbitrary code. \n(CVE-2019-15214)\n\nIt was discovered that a race condition existed in the CPiA2 video4linux \ndevice driver for the Linux kernel, leading to a use-after-free. A \nphysically proximate attacker could use this to cause a denial of service \n(system crash) or possibly execute arbitrary code. (CVE-2019-15215)\n\nIt was discovered that a race condition existed in the Softmac USB Prism54 \ndevice driver in the Linux kernel. A physically proximate attacker could \nuse this to cause a denial of service (system crash). (CVE-2019-15220)\n\nIt was discovered that a use-after-free vulnerability existed in the \nAppleTalk implementation in the Linux kernel if an error occurs during \ninitialization. A local attacker could use this to cause a denial of \nservice (system crash). (CVE-2019-15292)\n\nJason Wang discovered that an infinite loop vulnerability existed in the \nvirtio net driver in the Linux kernel. A local attacker in a guest VM could \npossibly use this to cause a denial of service in the host system. \n(CVE-2019-3900)\n\nDaniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen discovered \nthat the Bluetooth protocol BR/EDR specification did not properly require \nsufficiently strong encryption key lengths. A physically proximate attacker \ncould use this to expose sensitive information. (CVE-2019-9506)\n\nIt was discovered that a race condition existed in the USB YUREX device \ndriver in the Linux kernel. A physically proximate attacker could use this \nto cause a denial of service (system crash). (CVE-2019-15216)\n\nIt was discovered that the Siano USB MDTV receiver device driver in the \nLinux kernel made improper assumptions about the device characteristics. A \nphysically proximate attacker could use this cause a denial of service \n(system crash). (CVE-2019-15218)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux kernel \ndid not properly validate data size information from the device. A \nphysically proximate attacker could use this to cause a denial of service \n(system crash). (CVE-2019-15221)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in some \nsituations did not properly restrict the field size when processing \noutgoing frames. A local attacker with CAP_NET_ADMIN privileges could use \nthis to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux kernel's \nHID subsystem did not properly validate passed parameters in some \nsituations. A local privileged attacker could use this to cause a denial of \nservice (infinite loop). (CVE-2019-3819)", "edition": 2, "modified": "2019-09-11T00:00:00", "published": "2019-09-11T00:00:00", "id": "USN-4115-2", "href": "https://ubuntu.com/security/notices/USN-4115-2", "title": "Linux kernel regression", "type": "ubuntu", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-02T11:32:45", "bulletinFamily": "unix", "cvelist": ["CVE-2019-14763", "CVE-2019-15218", "CVE-2019-15090", "CVE-2019-3900", "CVE-2019-0136", "CVE-2019-14284", "CVE-2019-10639", "CVE-2018-20784", "CVE-2019-15216", "CVE-2019-15211", "CVE-2019-13648", "CVE-2019-9506", "CVE-2019-15215", "CVE-2019-13631", "CVE-2019-10207", "CVE-2019-15220", "CVE-2019-11810", "CVE-2019-15212", "CVE-2019-11599", "CVE-2019-15221", "CVE-2019-10638", "CVE-2019-3701", "CVE-2019-15292", "CVE-2019-11487", "CVE-2019-15214", "CVE-2019-3819", "CVE-2018-19985", "CVE-2019-14283"], "description": "Hui Peng and Mathias Payer discovered that the Option USB High Speed driver \nin the Linux kernel did not properly validate metadata received from the \ndevice. A physically proximate attacker could use this to cause a denial of \nservice (system crash). (CVE-2018-19985)\n\nZhipeng Xie discovered that an infinite loop could be triggered in the CFS \nLinux kernel process scheduler. A local attacker could possibly use this to \ncause a denial of service. (CVE-2018-20784)\n\nIt was discovered that the Intel Wi-Fi device driver in the Linux kernel did \nnot properly validate certain Tunneled Direct Link Setup (TDLS). A \nphysically proximate attacker could use this to cause a denial of service \n(Wi-Fi disconnect). (CVE-2019-0136)\n\nIt was discovered that the Bluetooth UART implementation in the Linux \nkernel did not properly check for missing tty operations. A local attacker \ncould use this to cause a denial of service. (CVE-2019-10207)\n\nAmit Klein and Benny Pinkas discovered that the Linux kernel did not \nsufficiently randomize IP ID values generated for connectionless networking \nprotocols. A remote attacker could use this to track particular Linux \ndevices. (CVE-2019-10638)\n\nAmit Klein and Benny Pinkas discovered that the location of kernel \naddresses could be exposed by the implementation of connection-less network \nprotocols in the Linux kernel. A remote attacker could possibly use this to \nassist in the exploitation of another vulnerability in the Linux kernel. \n(CVE-2019-10639)\n\nIt was discovered that an integer overflow existed in the Linux kernel when \nreference counting pages, leading to potential use-after-free issues. A \nlocal attacker could use this to cause a denial of service (system crash) \nor possibly execute arbitrary code. (CVE-2019-11487)\n\nJann Horn discovered that a race condition existed in the Linux kernel when \nperforming core dumps. A local attacker could use this to cause a denial of \nservice (system crash) or expose sensitive information. (CVE-2019-11599)\n\nIt was discovered that a null pointer dereference vulnerability existed in \nthe LSI Logic MegaRAID driver in the Linux kernel. A local attacker could \nuse this to cause a denial of service (system crash). (CVE-2019-11810)\n\nIt was discovered that the GTCO tablet input driver in the Linux kernel did \nnot properly bounds check the initial HID report sent by the device. A \nphysically proximate attacker could use this to cause a denial of service \n(system crash) or possibly execute arbitrary code. (CVE-2019-13631)\n\nPraveen Pandey discovered that the Linux kernel did not properly validate \nsent signals in some situations on PowerPC systems with transactional \nmemory disabled. A local attacker could use this to cause a denial of \nservice. (CVE-2019-13648)\n\nIt was discovered that the floppy driver in the Linux kernel did not \nproperly validate meta data, leading to a buffer overread. A local attacker \ncould use this to cause a denial of service (system crash). \n(CVE-2019-14283)\n\nIt was discovered that the floppy driver in the Linux kernel did not \nproperly validate ioctl() calls, leading to a division-by-zero. A local \nattacker could use this to cause a denial of service (system crash). \n(CVE-2019-14284)\n\nTuba Yavuz discovered that a race condition existed in the DesignWare USB3 \nDRD Controller device driver in the Linux kernel. A physically proximate \nattacker could use this to cause a denial of service. (CVE-2019-14763)\n\nIt was discovered that an out-of-bounds read existed in the QLogic QEDI \niSCSI Initiator Driver in the Linux kernel. A local attacker could possibly \nuse this to expose sensitive information (kernel memory). (CVE-2019-15090)\n\nIt was discovered that the Raremono AM/FM/SW radio device driver in the \nLinux kernel did not properly allocate memory, leading to a use-after-free. \nA physically proximate attacker could use this to cause a denial of service \nor possibly execute arbitrary code. (CVE-2019-15211)\n\nIt was discovered at a double-free error existed in the USB Rio 500 device \ndriver for the Linux kernel. A physically proximate attacker could use this \nto cause a denial of service. (CVE-2019-15212)\n\nIt was discovered that a race condition existed in the Advanced Linux Sound \nArchitecture (ALSA) subsystem of the Linux kernel, leading to a potential \nuse-after-free. A physically proximate attacker could use this to cause a \ndenial of service (system crash) or possibly execute arbitrary code. \n(CVE-2019-15214)\n\nIt was discovered that a race condition existed in the CPiA2 video4linux \ndevice driver for the Linux kernel, leading to a use-after-free. A \nphysically proximate attacker could use this to cause a denial of service \n(system crash) or possibly execute arbitrary code. (CVE-2019-15215)\n\nIt was discovered that a race condition existed in the Softmac USB Prism54 \ndevice driver in the Linux kernel. A physically proximate attacker could \nuse this to cause a denial of service (system crash). (CVE-2019-15220)\n\nIt was discovered that a use-after-free vulnerability existed in the \nAppleTalk implementation in the Linux kernel if an error occurs during \ninitialization. A local attacker could use this to cause a denial of \nservice (system crash). (CVE-2019-15292)\n\nJason Wang discovered that an infinite loop vulnerability existed in the \nvirtio net driver in the Linux kernel. A local attacker in a guest VM could \npossibly use this to cause a denial of service in the host system. \n(CVE-2019-3900)\n\nDaniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen discovered \nthat the Bluetooth protocol BR/EDR specification did not properly require \nsufficiently strong encryption key lengths. A physically proximate attacker \ncould use this to expose sensitive information. (CVE-2019-9506)\n\nIt was discovered that a race condition existed in the USB YUREX device \ndriver in the Linux kernel. A physically proximate attacker could use this \nto cause a denial of service (system crash). (CVE-2019-15216)\n\nIt was discovered that the Siano USB MDTV receiver device driver in the \nLinux kernel made improper assumptions about the device characteristics. A \nphysically proximate attacker could use this cause a denial of service \n(system crash). (CVE-2019-15218)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux kernel \ndid not properly validate data size information from the device. A \nphysically proximate attacker could use this to cause a denial of service \n(system crash). (CVE-2019-15221)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in some \nsituations did not properly restrict the field size when processing \noutgoing frames. A local attacker with CAP_NET_ADMIN privileges could use \nthis to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux kernel's \nHID subsystem did not properly validate passed parameters in some \nsituations. A local privileged attacker could use this to cause a denial of \nservice (infinite loop). (CVE-2019-3819)", "edition": 3, "modified": "2019-09-02T00:00:00", "published": "2019-09-02T00:00:00", "id": "USN-4115-1", "href": "https://ubuntu.com/security/notices/USN-4115-1", "title": "Linux kernel vulnerabilities", "type": "ubuntu", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "cloudfoundry": [{"lastseen": "2019-05-29T18:33:04", "bulletinFamily": "software", "cvelist": ["CVE-2018-9517", "CVE-2019-7222", "CVE-2018-14610", "CVE-2019-3460", "CVE-2018-13100", "CVE-2017-18249", "CVE-2018-13099", "CVE-2018-14614", "CVE-2019-7221", "CVE-2018-16884", "CVE-2019-3701", "CVE-2019-6974", "CVE-2018-14612", "CVE-2019-3459", "CVE-2019-9213", "CVE-2018-14611", "CVE-2018-13097", "CVE-2019-3819", "CVE-2018-14616", "CVE-2018-14613"], "description": "# \n\n# Severity\n\nMedium\n\n# Vendor\n\nCanonical Ubuntu\n\n# Versions Affected\n\n * Canonical Ubuntu 14.04\n\n# Description\n\nUSN-3932-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.\n\nIt was discovered that a race condition existed in the f2fs file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2017-18249)\n\nWen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100, CVE-2018-14614, CVE-2018-14616)\n\nWen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not properly validate metadata. An attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613)\n\nVasily Averin and Evgenii Shatokhin discovered that a use-after-free vulnerability existed in the NFS41+ subsystem when multiple network namespaces are in use. A local attacker in a container could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-16884)\n\nIt was discovered that a use-after-free vulnerability existed in the PPP over L2TP implementation in the Linux kernel. A privileged local attacker could use this to possibly execute arbitrary code. (CVE-2018-9517)\n\nShlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)\n\nJann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)\n\nJim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)\n\nFelix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM). (CVE-2019-7222)\n\nJann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux kernel\u2019s HID subsystem did not properly validate passed parameters in some situations. A local privileged attacker could use this to cause a denial of service (infinite loop). (CVE-2019-3819)\n\nCVEs contained in this USN include: CVE-2019-3459, CVE-2019-3460, CVE-2019-6974, CVE-2019-7222, CVE-2019-9213, CVE-2017-18249, CVE-2018-13097, CVE-2018-13099, CVE-2018-13100, CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613, CVE-2018-14614, CVE-2018-14616, CVE-2018-16884, CVE-2018-9517, CVE-2019-3701, CVE-2019-3819, CVE-2019-7221\n\n# Affected Cloud Foundry Products and Versions\n\n_Severity is medium unless otherwise noted._\n\n * Cloud Foundry BOSH trusty-stemcells are vulnerable, including: \n * 3586.x versions prior to 3586.96\n * 3541.x versions prior to 3541.93\n * 3468.x versions prior to 3468.109\n * 3445.x versions prior to 3445.107\n * 3421.x versions prior to 3421.124\n * All other stemcells not listed.\n\n# Mitigation\n\nUsers of affected products are strongly encouraged to follow one of the mitigations below:\n\n * The Cloud Foundry project recommends upgrading the following BOSH trusty-stemcells: \n * Upgrade 3586.x versions to 3586.96\n * Upgrade 3541.x versions to 3541.93\n * Upgrade 3468.x versions to 3468.109\n * Upgrade 3445.x versions to 3445.107\n * Upgrade 3421.x versions to 3421.124\n * All other stemcells should be upgraded to the latest version available on [bosh.io](<https://bosh.io/stemcells/#ubuntu-trusty>).\n\n# References\n\n * [USN-3932-2](<https://usn.ubuntu.com/3932-2>)\n * [CVE-2019-3459](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-3459>)\n * [CVE-2019-3460](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-3460>)\n * [CVE-2019-6974](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-6974>)\n * [CVE-2019-7222](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-7222>)\n * [CVE-2019-9213](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-9213>)\n * [CVE-2017-18249](<https://people.canonical.com/~ubuntu-security/cve/CVE-2017-18249>)\n * [CVE-2018-13097](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-13097>)\n * [CVE-2018-13099](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-13099>)\n * [CVE-2018-13100](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-13100>)\n * [CVE-2018-14610](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14610>)\n * [CVE-2018-14611](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14611>)\n * [CVE-2018-14612](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14612>)\n * [CVE-2018-14613](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14613>)\n * [CVE-2018-14614](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14614>)\n * [CVE-2018-14616](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14616>)\n * [CVE-2018-16884](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16884>)\n * [CVE-2018-9517](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-9517>)\n * [CVE-2019-3701](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-3701>)\n * [CVE-2019-3819](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-3819>)\n * [CVE-2019-7221](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-7221>)\n", "edition": 2, "modified": "2019-04-12T00:00:00", "published": "2019-04-12T00:00:00", "id": "CFOUNDRY:63AC599C6730C4293761CECD360AA195", "href": "https://www.cloudfoundry.org/blog/usn-3932-2/", "title": "USN-3932-2: Linux kernel (Xenial HWE) vulnerabilities | Cloud Foundry", "type": "cloudfoundry", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-10-01T00:29:01", "bulletinFamily": "software", "cvelist": ["CVE-2019-14763", "CVE-2019-15218", "CVE-2019-15090", "CVE-2019-3900", "CVE-2019-0136", "CVE-2019-14284", "CVE-2019-10639", "CVE-2018-20784", "CVE-2019-15216", "CVE-2019-15211", "CVE-2019-13648", "CVE-2019-9506", "CVE-2019-15215", "CVE-2019-13631", "CVE-2019-10207", "CVE-2019-15220", "CVE-2019-11810", "CVE-2019-15212", "CVE-2019-11599", "CVE-2019-15221", "CVE-2019-10638", "CVE-2019-3701", "CVE-2019-15292", "CVE-2019-11487", "CVE-2019-15214", "CVE-2019-3819", "CVE-2018-19985", "CVE-2019-14283"], "description": "# \n\n## Severity\n\nMedium\n\n## Vendor\n\nCanonical Ubuntu\n\n## Versions Affected\n\n * Canonical Ubuntu 16.04\n\n## Description\n\nUSN 4115-1 fixed vulnerabilities in the Linux 4.15 kernel for Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. Unfortunately, as part of the update, a regression was introduced that caused a kernel crash when handling fragmented packets in some situations. This update addresses the issue.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\nHui Peng and Mathias Payer discovered that the Option USB High Speed driver in the Linux kernel did not properly validate metadata received from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19985)\n\nZhipeng Xie discovered that an infinite loop could triggered in the CFS Linux kernel process scheduler. A local attacker could possibly use this to cause a denial of service. (CVE-2018-20784)\n\nIt was discovered that the Intel Wi-Fi device driver in the Linux kernel did not properly validate certain Tunneled Direct Link Setup (TDLS). A physically proximate attacker could use this to cause a denial of service (Wi-Fi disconnect). (CVE-2019-0136)\n\nIt was discovered that the Bluetooth UART implementation in the Linux kernel did not properly check for missing tty operations. A local attacker could use this to cause a denial of service. (CVE-2019-10207)\n\nAmit Klein and Benny Pinkas discovered that the Linux kernel did not sufficiently randomize IP ID values generated for connectionless networking protocols. A remote attacker could use this to track particular Linux devices. (CVE-2019-10638)\n\nAmit Klein and Benny Pinkas discovered that the location of kernel addresses could be exposed by the implementation of connection-less network protocols in the Linux kernel. A remote attacker could possibly use this to assist in the exploitation of another vulnerability in the Linux kernel. (CVE-2019-10639)\n\nIt was discovered that an integer overflow existed in the Linux kernel when reference counting pages, leading to potential use-after-free issues. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-11487)\n\nJann Horn discovered that a race condition existed in the Linux kernel when performing core dumps. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2019-11599)\n\nIt was discovered that a null pointer dereference vulnerability existed in the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-11810)\n\nIt was discovered that the GTCO tablet input driver in the Linux kernel did not properly bounds check the initial HID report sent by the device. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-13631)\n\nPraveen Pandey discovered that the Linux kernel did not properly validate sent signals in some situations on PowerPC systems with transactional memory disabled. A local attacker could use this to cause a denial of service. (CVE-2019-13648)\n\nIt was discovered that the floppy driver in the Linux kernel did not properly validate meta data, leading to a buffer overread. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-14283)\n\nIt was discovered that the floppy driver in the Linux kernel did not properly validate ioctl() calls, leading to a division-by-zero. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-14284)\n\nTuba Yavuz discovered that a race condition existed in the DesignWare USB3 DRD Controller device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service. (CVE-2019-14763)\n\nIt was discovered that an out-of-bounds read existed in the QLogic QEDI iSCSI Initiator Driver in the Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2019-15090)\n\nIt was discovered that the Raremono AM/FM/SW radio device driver in the Linux kernel did not properly allocate memory, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2019-15211)\n\nIt was discovered at a double-free error existed in the USB Rio 500 device driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service. (CVE-2019-15212)\n\nIt was discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel, leading to a potential use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15214)\n\nIt was discovered that a race condition existed in the CPiA2 video4linux device driver for the Linux kernel, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15215)\n\nIt was discovered that a race condition existed in the Softmac USB Prism54 device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15220)\n\nIt was discovered that a use-after-free vulnerability existed in the AppleTalk implementation in the Linux kernel if an error occurs during initialization. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-15292)\n\nJason Wang discovered that an infinite loop vulnerability existed in the virtio net driver in the Linux kernel. A local attacker in a guest VM could possibly use this to cause a denial of service in the host system. (CVE-2019-3900)\n\nDaniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen discovered that the Bluetooth protocol BR/EDR specification did not properly require sufficiently strong encryption key lengths. A physically proximate attacker could use this to expose sensitive information. (CVE-2019-9506)\n\nIt was discovered that a race condition existed in the USB YUREX device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15216)\n\nIt was discovered that the Siano USB MDTV receiver device driver in the Linux kernel made improper assumptions about the device characteristics. A physically proximate attacker could use this cause a denial of service (system crash). (CVE-2019-15218)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux kernel did not properly validate data size information from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15221)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux kernel\u2019s HID subsystem did not properly validate passed parameters in some situations. A local privileged attacker could use this to cause a denial of service (infinite loop). (CVE-2019-3819)\n\nCVEs contained in this USN include: CVE-2018-19985, CVE-2019-3701, CVE-2019-3819, CVE-2018-20784, CVE-2019-11487, CVE-2019-11599, CVE-2019-11810, CVE-2019-3900, CVE-2019-0136, CVE-2019-10207, CVE-2019-10638, CVE-2019-10639, CVE-2019-13631, CVE-2019-14283, CVE-2019-14284, CVE-2019-14763, CVE-2019-15090, CVE-2019-15211, CVE-2019-15212, CVE-2019-15214, CVE-2019-15215, CVE-2019-15216, CVE-2019-15218, CVE-2019-15220, CVE-2019-15221, CVE-2019-15292, CVE-2019-9506, CVE-2019-13648\n\n## Affected Cloud Foundry Products and Versions\n\n_Severity is medium unless otherwise noted._\n\n * Cloud Foundry BOSH xenial-stemcells are vulnerable, including: \n * 456.x versions prior to 456.25\n * 315.x versions prior to 315.97\n * 250.x versions prior to 250.110\n * 170.x versions prior to 170.133\n * 97.x versions prior to 97.159\n * All other stemcells not listed.\n\n## Mitigation\n\nUsers of affected products are strongly encouraged to follow one of the mitigations below:\n\n * The Cloud Foundry project recommends upgrading the following BOSH xenial-stemcells: \n * Upgrade 456.x versions to 456.25\n * Upgrade 315.x versions to 315.97\n * Upgrade 250.x versions to 250.110\n * Upgrade 170.x versions to 170.133\n * Upgrade 97.x versions to 97.159\n * All other stemcells should be upgraded to the latest version available on [bosh.io](<https://bosh.io/stemcells/#ubuntu-xenial>).\n\n## References\n\n * [USN-4115-2](<https://usn.ubuntu.com/4115-2>)\n * [CVE-2018-19985](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-19985>)\n * [CVE-2019-3701](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-3701>)\n * [CVE-2019-3819](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-3819>)\n * [CVE-2018-20784](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20784>)\n * [CVE-2019-11487](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11487>)\n * [CVE-2019-11599](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11599>)\n * [CVE-2019-11810](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11810>)\n * [CVE-2019-3900](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3900>)\n * [CVE-2019-0136](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-0136>)\n * [CVE-2019-10207](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-10207>)\n * [CVE-2019-10638](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-10638>)\n * [CVE-2019-10639](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-10639>)\n * [CVE-2019-13631](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-13631>)\n * [CVE-2019-14283](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-14283>)\n * [CVE-2019-14284](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-14284>)\n * [CVE-2019-14763](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-14763>)\n * [CVE-2019-15090](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15090>)\n * [CVE-2019-15211](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15211>)\n * [CVE-2019-15212](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15212>)\n * [CVE-2019-15214](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15214>)\n * [CVE-2019-15215](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15215>)\n * [CVE-2019-15216](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15216>)\n * [CVE-2019-15218](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15218>)\n * [CVE-2019-15220](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15220>)\n * [CVE-2019-15221](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15221>)\n * [CVE-2019-15292](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15292>)\n * [CVE-2019-9506](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-9506>)\n * [CVE-2019-13648](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-13648>)\n", "edition": 1, "modified": "2019-09-30T00:00:00", "published": "2019-09-30T00:00:00", "id": "CFOUNDRY:BD71AB043932448695E8B3D20302D582", "href": "https://www.cloudfoundry.org/blog/usn-4115-2/", "title": "USN-4115-2: Linux kernel regression | Cloud Foundry", "type": "cloudfoundry", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-10-01T04:29:38", "bulletinFamily": "software", "cvelist": ["CVE-2019-14763", "CVE-2019-15218", "CVE-2019-15090", "CVE-2019-3900", "CVE-2019-0136", "CVE-2019-14284", "CVE-2019-10639", "CVE-2018-20784", "CVE-2019-15216", "CVE-2019-15211", "CVE-2019-13648", "CVE-2019-9506", "CVE-2019-15215", "CVE-2019-13631", "CVE-2019-10207", "CVE-2019-15220", "CVE-2019-11810", "CVE-2019-15212", "CVE-2019-11599", "CVE-2019-15221", "CVE-2019-10638", "CVE-2019-3701", "CVE-2019-15292", "CVE-2019-11487", "CVE-2019-15214", "CVE-2019-3819", "CVE-2018-19985", "CVE-2019-14283"], "description": "# \n\n## Severity\n\nMedium\n\n## Vendor\n\nCanonical Ubuntu\n\n## Versions Affected\n\n * Canonical Ubuntu 16.04\n\n## Description\n\nHui Peng and Mathias Payer discovered that the Option USB High Speed driver in the Linux kernel did not properly validate metadata received from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19985)\n\nZhipeng Xie discovered that an infinite loop could triggered in the CFS Linux kernel process scheduler. A local attacker could possibly use this to cause a denial of service. (CVE-2018-20784)\n\nIt was discovered that the Intel wifi device driver in the Linux kernel did not properly validate certain Tunneled Direct Link Setup (TDLS). A physically proximate attacker could use this to cause a denial of service (wifi disconnect). (CVE-2019-0136)\n\nIt was discovered that the Bluetooth UART implementation in the Linux kernel did not properly check for missing tty operations. A local attacker could use this to cause a denial of service. (CVE-2019-10207)\n\nAmit Klein and Benny Pinkas discovered that the Linux kernel did not sufficiently randomize IP ID values generated for connectionless networking protocols. A remote attacker could use this to track particular Linux devices. (CVE-2019-10638)\n\nAmit Klein and Benny Pinkas discovered that the location of kernel addresses could exposed by the implementation of connection-less network protocols in the Linux kernel. A remote attacker could possibly use this to assist in the exploitation of another vulnerability in the Linux kernel. (CVE-2019-10639)\n\nIt was discovered that an integer overflow existed in the Linux kernel when reference counting pages, leading to potential use-after-free issues. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-11487)\n\nJann Horn discovered that a race condition existed in the Linux kernel when performing core dumps. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2019-11599)\n\nIt was discovered that a null pointer dereference vulnerability existed in the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-11810)\n\nIt was discovered that the GTCO tablet input driver in the Linux kernel did not properly bounds check the initial HID report sent by the device. A physically proximate attacker could use to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-13631)\n\nPraveen Pandey discovered that the Linux kernel did not properly validate sent signals in some situations on PowerPC systems with transactional memory disabled. A local attacker could use this to cause a denial of service. (CVE-2019-13648)\n\nIt was discovered that the floppy driver in the Linux kernel did not properly validate meta data, leading to a buffer overread. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-14283)\n\nIt was discovered that the floppy driver in the Linux kernel did not properly validate ioctl() calls, leading to a division-by-zero. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-14284)\n\nTuba Yavuz discovered that a race condition existed in the DesignWare USB3 DRD Controller device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service. (CVE-2019-14763)\n\nIt was discovered that an out-of-bounds read existed in the QLogic QEDI iSCSI Initiator Driver in the Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2019-15090)\n\nIt was discovered that the Raremono AM/FM/SW radio device driver in the Linux kernel did not properly allocate memory, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2019-15211)\n\nIt was discovered at a double-free error existed in the USB Rio 500 device driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service. (CVE-2019-15212)\n\nIt was discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel, leading to a potential use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) pro possibly execute arbitrary code. (CVE-2019-15214)\n\nIt was discovered that a race condition existed in the CPiA2 video4linux device driver for the Linux kernel, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15215)\n\nIt was discovered that a race condition existed in the Softmac USB Prism54 device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15220)\n\nIt was discovered that a use-after-free vulnerability existed in the Appletalk implementation in the Linux kernel if an error occurs during initialization. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-15292)\n\nJason Wang discovered that an infinite loop vulnerability existed in the virtio net driver in the Linux kernel. A local attacker in a guest VM could possibly use this to cause a denial of service in the host system. (CVE-2019-3900)\n\nDaniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen discovered that the Bluetooth protocol BR/EDR specification did not properly require sufficiently strong encryption key lengths. A physicall proximate attacker could use this to expose sensitive information. (CVE-2019-9506)\n\nIt was discovered that a race condition existed in the USB YUREX device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15216)\n\nIt was discovered that the Siano USB MDTV receiver device driver in the Linux kernel made improper assumptions about the device characteristics. A physically proximate attacker could use this cause a denial of service (system crash). (CVE-2019-15218)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux kernel did not properly validate data size information from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15221)\n\nMuyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code. (CVE-2019-3701)\n\nVladis Dronov discovered that the debug interface for the Linux kernel\u2019s HID subsystem did not properly validate passed parameters in some situations. A local privileged attacker could use this to cause a denial of service (infinite loop). (CVE-2019-3819)\n\nCVEs contained in this USN include: CVE-2018-19985, CVE-2019-3701, CVE-2019-3819, CVE-2018-20784, CVE-2019-11487, CVE-2019-11599, CVE-2019-11810, CVE-2019-3900, CVE-2019-0136, CVE-2019-10207, CVE-2019-10638, CVE-2019-10639, CVE-2019-13631, CVE-2019-14283, CVE-2019-14284, CVE-2019-14763, CVE-2019-15090, CVE-2019-15211, CVE-2019-15212, CVE-2019-15214, CVE-2019-15215, CVE-2019-15216, CVE-2019-15218, CVE-2019-15220, CVE-2019-15221, CVE-2019-15292, CVE-2019-9506, CVE-2019-13648\n\n## Affected Cloud Foundry Products and Versions\n\n_Severity is medium unless otherwise noted._\n\n * Cloud Foundry BOSH xenial-stemcells are vulnerable, including: \n * 456.x versions prior to 456.22\n * 315.x versions prior to 315.93\n * 250.x versions prior to 250.106\n * 170.x versions prior to 170.129\n * 97.x versions prior to 97.156\n * All other stemcells not listed.\n\n## Mitigation\n\nUsers of affected products are strongly encouraged to follow one of the mitigations below:\n\n * The Cloud Foundry project recommends upgrading the following BOSH xenial-stemcells: \n * Upgrade 456.x versions to 456.22\n * Upgrade 315.x versions to 315.93\n * Upgrade 250.x versions to 250.106\n * Upgrade 170.x versions to 170.129\n * Upgrade 97.x versions to 97.156\n * All other stemcells should be upgraded to the latest version available on [bosh.io](<https://bosh.io/stemcells/#ubuntu-xenial>).\n\n## References\n\n * [USN-4115-1](<https://usn.ubuntu.com/4115-1>)\n * [CVE-2018-19985](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-19985>)\n * [CVE-2019-3701](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-3701>)\n * [CVE-2019-3819](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-3819>)\n * [CVE-2018-20784](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20784>)\n * [CVE-2019-11487](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11487>)\n * [CVE-2019-11599](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11599>)\n * [CVE-2019-11810](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11810>)\n * [CVE-2019-3900](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3900>)\n * [CVE-2019-0136](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-0136>)\n * [CVE-2019-10207](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-10207>)\n * [CVE-2019-10638](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-10638>)\n * [CVE-2019-10639](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-10639>)\n * [CVE-2019-13631](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-13631>)\n * [CVE-2019-14283](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-14283>)\n * [CVE-2019-14284](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-14284>)\n * [CVE-2019-14763](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-14763>)\n * [CVE-2019-15090](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15090>)\n * [CVE-2019-15211](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15211>)\n * [CVE-2019-15212](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15212>)\n * [CVE-2019-15214](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15214>)\n * [CVE-2019-15215](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15215>)\n * [CVE-2019-15216](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15216>)\n * [CVE-2019-15218](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15218>)\n * [CVE-2019-15220](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15220>)\n * [CVE-2019-15221](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15221>)\n * [CVE-2019-15292](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15292>)\n * [CVE-2019-9506](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-9506>)\n * [CVE-2019-13648](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-13648>)\n", "edition": 1, "modified": "2019-09-30T00:00:00", "published": "2019-09-30T00:00:00", "id": "CFOUNDRY:A005A5D22D18F966EBF6C011F833E895", "href": "https://www.cloudfoundry.org/blog/usn-4115-1/", "title": "USN-4115-1: Linux kernel vulnerabilities | Cloud Foundry", "type": "cloudfoundry", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "slackware": [{"lastseen": "2020-10-25T16:36:21", "bulletinFamily": "unix", "cvelist": ["CVE-2017-18241", "CVE-2017-18249", "CVE-2018-10880", "CVE-2018-1120", "CVE-2018-12896", "CVE-2018-13053", "CVE-2018-13096", "CVE-2018-13097", "CVE-2018-13099", "CVE-2018-13100", "CVE-2018-14610", "CVE-2018-14611", "CVE-2018-14612", "CVE-2018-14613", "CVE-2018-14614", "CVE-2018-14616", "CVE-2018-14633", "CVE-2018-16862", "CVE-2018-16884", "CVE-2018-17972", "CVE-2018-18021", "CVE-2018-18281", "CVE-2018-18690", "CVE-2018-18710", "CVE-2018-19824", "CVE-2018-19985", "CVE-2018-20169", "CVE-2018-20511", "CVE-2018-5848", "CVE-2018-7755", "CVE-2019-3701"], "description": "New kernel packages are available for Slackware 14.2 to fix security issues.\n\nHere are the details from the Slackware 14.2 ChangeLog:\n\npatches/packages/linux-4.4.172/*: Upgraded.\n These updates fix various bugs and many (mostly minor) security issues.\n Be sure to upgrade your initrd after upgrading the kernel packages.\n If you use lilo to boot your machine, be sure lilo.conf points to the correct\n kernel and initrd and run lilo as root to update the bootloader.\n If you use elilo to boot your machine, you should run eliloconfig to copy the\n kernel and initrd to the EFI System Partition.\n For more information, see:\n Fixed in 4.4.159:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20511\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14633\n Fixed in 4.4.160:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7755\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18021\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10880\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13053\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17972\n Fixed in 4.4.163:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18281\n Fixed in 4.4.164:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18710\n Fixed in 4.4.167:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19824\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16862\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20169\n Fixed in 4.4.168:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1120\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5848\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12896\n Fixed in 4.4.169:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18241\n Fixed in 4.4.170:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19985\n Fixed in 4.4.171:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16884\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14611\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14610\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14613\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14612\n Fixed in 4.4.172:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14616\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13096\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13097\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14614\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13099\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13100\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3701\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18690\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18249\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated packages for Slackware 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.172/kernel-firmware-20190118_a8b75ca-noarch-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.172/kernel-generic-4.4.172-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.172/kernel-generic-smp-4.4.172_smp-i686-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.172/kernel-headers-4.4.172_smp-x86-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.172/kernel-huge-4.4.172-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.172/kernel-huge-smp-4.4.172_smp-i686-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.172/kernel-modules-4.4.172-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.172/kernel-modules-smp-4.4.172_smp-i686-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.172/kernel-source-4.4.172_smp-noarch-1.txz\n\nUpdated packages for Slackware x86_64 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.172/kernel-firmware-20190118_a8b75ca-noarch-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.172/kernel-generic-4.4.172-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.172/kernel-headers-4.4.172-x86-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.172/kernel-huge-4.4.172-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.172/kernel-modules-4.4.172-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.172/kernel-source-4.4.172-noarch-1.txz\n\n\nMD5 signatures:\n\nSlackware 14.2 packages:\n8d01bb64cfd41d9a7a899ff7d9a42e80 kernel-firmware-20190118_a8b75ca-noarch-1.txz\nc6a8fdb1a81ab10f782935fbe4da2f99 kernel-generic-4.4.172-i586-1.txz\n6adb11dad81d3a0638eeba7b5042cc60 kernel-generic-smp-4.4.172_smp-i686-1.txz\nf322aa6fab133056419a3bbd9032cdd8 kernel-headers-4.4.172_smp-x86-1.txz\ne27fe36e4bac4a3ab782173dc567654f kernel-huge-4.4.172-i586-1.txz\n45d6ff4328ad6f85c70322edaa382c30 kernel-huge-smp-4.4.172_smp-i686-1.txz\n1b8b2ef0053fb4b7b4c97cd6eaa9f881 kernel-modules-4.4.172-i586-1.txz\nc3ded7d7beb67862ccf41ee2252890e7 kernel-modules-smp-4.4.172_smp-i686-1.txz\n696786a3ec1da6c3d168fcd9553e7113 kernel-source-4.4.172_smp-noarch-1.txz\n\nSlackware x86_64 14.2 packages:\n8d01bb64cfd41d9a7a899ff7d9a42e80 kernel-firmware-20190118_a8b75ca-noarch-1.txz\nc65cec1e083eebab8b67ebfb9328168f kernel-generic-4.4.172-x86_64-1.txz\nd5919a445c15513c2d50add261255ceb kernel-headers-4.4.172-x86-1.txz\n1f03ba34d711a94eab536af030088d55 kernel-huge-4.4.172-x86_64-1.txz\n05b3facb192419926bd138e192ef4909 kernel-modules-4.4.172-x86_64-1.txz\n35d34318519b753db932513e65ff34eb kernel-source-4.4.172-noarch-1.txz\n\n\nInstallation instructions:\n\nUpgrade the packages as root:\n > upgradepkg kernel-*.txz\n\nIf you are using an initrd, you'll need to rebuild it.\n\nFor a 32-bit SMP machine, use this command (substitute the appropriate\nkernel version if you are not running Slackware 14.2):\n > /usr/share/mkinitrd/mkinitrd_command_generator.sh -k 4.4.172-smp | bash\n\nFor a 64-bit machine, or a 32-bit uniprocessor machine, use this command\n(substitute the appropriate kernel version if you are not running\nSlackware 14.2):\n > /usr/share/mkinitrd/mkinitrd_command_generator.sh -k 4.4.172 | bash\n\nPlease note that \"uniprocessor\" has to do with the kernel you are running,\nnot with the CPU. Most systems should run the SMP kernel (if they can)\nregardless of the number of cores the CPU has. If you aren't sure which\nkernel you are running, run \"uname -a\". If you see SMP there, you are\nrunning the SMP kernel and should use the 4.4.172-smp version when running\nmkinitrd_command_generator. Note that this is only for 32-bit -- 64-bit\nsystems should always use 4.4.172 as the version.\n\nIf you are using lilo or elilo to boot the machine, you'll need to ensure\nthat the machine is properly prepared before rebooting.\n\nIf using LILO:\nBy default, lilo.conf contains an image= line that references a symlink\nthat always points to the correct kernel. No editing should be required\nunless your machine uses a custom lilo.conf. If that is the case, be sure\nthat the image= line references the correct kernel file. Either way,\nyou'll need to run \"lilo\" as root to reinstall the boot loader.\n\nIf using elilo:\nEnsure that the /boot/vmlinuz symlink is pointing to the kernel you wish\nto use, and then run eliloconfig to update the EFI System Partition.", "modified": "2019-01-31T00:22:22", "published": "2019-01-31T00:22:22", "id": "SSA-2019-030-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2019&m=slackware-security.842527", "type": "slackware", "title": "[slackware-security] Slackware 14.2 kernel", "cvss": {"score": 8.3, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:C"}}]}