kernel: Red Hat only CVE-2020-12351 regression

A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with A2MP CID. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or potentially executing arbitrary code on...

Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2020-2429)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Moderate: fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript ASCII and binary Type 1, some Type 3 and Type 0, TrueType, OpenType Type2 and CID-keyed fonts. Security Fixes: fontforge: SFDGetFontMetaData insufficient CVE-2020-5395 backport...

CVE-2020-25661

A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with A2MP CID. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or potentially executing arbitrary code on...

CVE-2020-27673

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service host OS hang via a high rate of events to dom0, aka CID-e99502f76271...

CVE-2020-27673

CVE-2020-27673 is described in connected advisories as a Linux kernel race-condition bug in Xen event handling, permitting a guest (domU) to cause a denial of service or host hang in dom0 when exposed to high event rates. Affected scope: Linux kernel up to 5.9.1, used with Xen through 4.14.x. The...

CVE-2020-27673

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service host OS hang via a high rate of events to dom0, aka CID-e99502f76271...

kernel: net: bluetooth: type confusion while processing AMP packets

A flaw was found in the way the Linux kernel’s Bluetooth implementation handled L2CAP Logical Link Control and Adaptation Protocol packets with A2MP Alternate MAC-PHY Manager Protocol CID Channel Identifier. This flaw allows a remote attacker in an adjacent range to crash the system, causing a...

CVE-2020-27194

An issue was discovered in the Linux kernel before 5.8.15. scalar32minmaxor in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values, aka CID-5b9fbeb75b6a...

CVE-2020-12351

A flaw was found in the way the Linux kernel’s Bluetooth implementation handled L2CAP Logical Link Control and Adaptation Protocol packets with A2MP Alternate MAC-PHY Manager Protocol CID Channel Identifier. This flaw allows a remote attacker in an adjacent range to crash the system, causing a...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2020-5884)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5884 advisory. - xfs: fix boundary test in xfsattrshortformverify Eric Sandeen Orabug: 31895365 CVE-2020-14385 - ext4: fix potential negative array index in dospl...

usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer occurs without a reference aka CID-056ad39ee925.

...

In the Linux kernel before 5.6.1 drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors aka CID-a246b4d54770.

...

fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free which allows local users to cause a denial of service (OOPS) or possibly obtain sensitive information from kernel memory aka CID-d0cb50185ae9. One attack vector may be an open system call for a UNIX domain socket if the socket is being moved to a new parent directory and its old parent directory is being removed.

...

go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path which causes a memory leak aka CID-9453264ef586.

...

CVE-2020-26088

A missing CAPNETRAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a...

CVE-2020-26088

A missing CAPNETRAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a...

Design/Logic Flaw

A missing CAPNETRAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a...

CVE-2020-26088

CVE-2020-26088 affects the Linux kernel up to version 5.8.2, where a missing CAP_NET_RAW check in NFC socket creation (net/nfc/rawsock.c) could let a local attacker create raw sockets and bypass security mechanisms. This is demonstrated in multiple Nessus advisories (Unity Linux/OpenSUSE/EulerOS ...

Wrong Access Permission

Linux kernel is using wrong access permission.It can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered...