Revision Date: | 2020-12-01 | Version: | 1 |
Title: | Security update for the Linux Kernel (Important) |
Description: |
The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bug fixes.
The following security bugs were fixed:
- CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782). - CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393). - CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123). - CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766). - CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485). - CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723). - CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086). - CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470). - CVE-2020-8694: Restricted energy meter to root access (bsc#1170415). - CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724). - CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725). - CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381). - CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511). - CVE-2020-2521: Fixed getxattr kernel panic and memory overflow (bsc#1176381). - CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011). - CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206). - CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121). - CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990). - CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235). - CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721). - CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725). - CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722). - CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423). - CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482). - CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411) - CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).
The following non-security bugs were fixed:
- btrfs: cleanup root usage by btrfs_get_alloc_profile (bsc#1131277). - btrfs: reloc: clear DEAD_RELOC_TREE bit for orphan roots to prevent runaway balance (bsc#1171417 bsc#1160947 bsc#1172366 bsc#1176922). - btrfs: reloc: fix reloc root leak and NULL pointer dereference (bsc#1171417 bsc#1160947 bsc#1172366 bsc#1176922). - btrfs: remove root usage from can_overcommit (bsc#1131277). - hyperv_fb: disable superfluous VERSION_WIN10_V5 case (bsc#1175306). - hyperv_fb: Update screen_info after removing old framebuffer (bsc#1175306). - livepatch: Add -fdump-ipa-clones to build (). Add support for -fdump-ipa-clones GCC option. Update config files accordingly. - livepatch: Test if -fdump-ipa-clones is really available As of now we add -fdump-ipa-clones unconditionally. It does not cause a trouble if the kernel is build with the supported toolchain. Otherwise it could fail easily. Do the correct thing and test for the availability. - powerpc/pseries/cpuidle: add polling idle for shared processor guests (bsc#1178765 ltc#188968). - scsi: qla2xxx: Do not consume srb greedily (bsc#1173233). - scsi: qla2xxx: Handle incorrect entry_type entries (bsc#1173233). - video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host (bsc#1175306). - video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver (bsc#1175306). - video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1 VMs (bsc#1175306). - x86/hyperv: Create and use Hyper-V page definitions (bsc#1176877). - x86/kexec: Use up-to-dated screen_info copy to fill boot params (bsc#1175306). - x86/unwind/orc: Fix inactive tasks with stack pointer in %sp on GCC 10 compiled kernels (bsc#1058115 bsc#1176907). - xen/blkback: use lateeoi irq binding (XSA-332 bsc#1177411). - xen: do not reschedule in preemption off sections (bsc#1175749). - xen/events: add a new 'late EOI' evtchn framework (XSA-332 bsc#1177411). - xen/events: add a proper barrier to 2-level uevent unmasking (XSA-332 bsc#1177411). - xen/events: avoid removing an event channel while handling it (XSA-331 bsc#1177410). - xen/events: block rogue events for some time (XSA-332 bsc#1177411). - xen/events: defer eoi in case of excessive number of events (XSA-332 bsc#1177411). - xen/events: do not use chip_data for legacy IRQs (XSA-332 bsc#1065600). - xen/events: fix race in evtchn_fifo_unmask() (XSA-332 bsc#1177411). - xen/events: switch user event channels to lateeoi model (XSA-332 bsc#1177411). - xen/events: use a common cpu hotplug hook for event channels (XSA-332 bsc#1177411). - xen/netback: use lateeoi irq binding (XSA-332 bsc#1177411). - xen/pciback: use lateeoi irq binding (XSA-332 bsc#1177411). - xen/scsiback: use lateeoi irq binding (XSA-332 bsc#1177411).
|
Family: | unix | Class: | patch |
Status: | | Reference(s): | 1015351 1020940 1024145 1027519 1035686 1039361 1051510 1055695 1056278 1056280 1056281 1056282 1057358 1057389 1058115 1065600 1131277 1160947 1161360 1163524 1166965 1170232 1170415 1171417 1172073 1172366 1173115 1173233 1173274 1175306 1175721 1175749 1175882 1176011 1176235 1176278 1176381 1176423 1176482 1176485 1176698 1176721 1176722 1176723 1176725 1176732 1176877 1176907 1176922 1176990 1177027 1177086 1177121 1177165 1177206 1177226 1177410 1177411 1177470 1177511 1177513 1177724 1177725 1177766 1178003 1178123 1178330 1178393 1178622 1178765 1178782 1178838 902737 905870 905871 905872 922220 922221 922222 922223 927637 928308 934506 934517 936537 937125 937572 938344 939216 943446 944017 945404 945778 945987 945989 960674 979907 981124 983273 997857 CVE-2006-0855 CVE-2007-1669 CVE-2011-2709 CVE-2013-0240 CVE-2013-1799 CVE-2013-4282 CVE-2014-3675 CVE-2014-3676 CVE-2014-3677 CVE-2014-7815 CVE-2014-8767 CVE-2014-8768 CVE-2014-8769 CVE-2015-0261 CVE-2015-2153 CVE-2015-2154 CVE-2015-2155 CVE-2015-3138 CVE-2015-3247 CVE-2015-5154 CVE-2015-5260 CVE-2015-5261 CVE-2015-5278 CVE-2015-5279 CVE-2015-6855 CVE-2015-8710 CVE-2015-8871 CVE-2015-8899 CVE-2016-0749 CVE-2016-2150 CVE-2016-7163 CVE-2016-7922 CVE-2016-7923 CVE-2016-7924 CVE-2016-7925 CVE-2016-7926 CVE-2016-7927 CVE-2016-7928 CVE-2016-7929 CVE-2016-7930 CVE-2016-7931 CVE-2016-7932 CVE-2016-7933 CVE-2016-7934 CVE-2016-7935 CVE-2016-7936 CVE-2016-7937 CVE-2016-7938 CVE-2016-7939 CVE-2016-7940 CVE-2016-7973 CVE-2016-7974 CVE-2016-7975 CVE-2016-7983 CVE-2016-7984 CVE-2016-7985 CVE-2016-7986 CVE-2016-7992 CVE-2016-7993 CVE-2016-8574 CVE-2016-8575 CVE-2016-9577 CVE-2016-9578 CVE-2017-1000251 CVE-2017-1000367 CVE-2017-14316 CVE-2017-14317 CVE-2017-14318 CVE-2017-14319 CVE-2017-5202 CVE-2017-5203 CVE-2017-5204 CVE-2017-5205 CVE-2017-5341 CVE-2017-5342 CVE-2017-5482 CVE-2017-5483 CVE-2017-5484 CVE-2017-5485 CVE-2017-5486 CVE-2017-7435 CVE-2017-7436 CVE-2017-9269 CVE-2018-7685 CVE-2020-0404 CVE-2020-0427 CVE-2020-0430 CVE-2020-0431 CVE-2020-0432 CVE-2020-12351 CVE-2020-12352 CVE-2020-14351 CVE-2020-14381 CVE-2020-14390 CVE-2020-14422 CVE-2020-16120 CVE-2020-25212 CVE-2020-25284 CVE-2020-25285 CVE-2020-25641 CVE-2020-25643 CVE-2020-25645 CVE-2020-25656 CVE-2020-25668 CVE-2020-25704 CVE-2020-25705 CVE-2020-26088 CVE-2020-27673 CVE-2020-27675 CVE-2020-8694 SUSE-SU-2015:1782-1 SUSE-SU-2016:0178-1 SUSE-SU-2016:3269-1 SUSE-SU-2017:1110-1 SUSE-SU-2017:1446-1 SUSE-SU-2017:2144-1 SUSE-SU-2017:2420-1 SUSE-SU-2017:2523-1 SUSE-SU-2020:1920-1 SUSE-SU-2020:3532-1
|
Platform(s): | openSUSE Leap 15.0 openSUSE Leap 15.1 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP4 SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP2-ESPOS SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP3-ESPOS SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server 12 SP3-TERADATA SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SUSE OpenStack Cloud 6 SUSE OpenStack Cloud 7 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9
| Product(s): | |
Definition Synopsis |
openSUSE Leap 15.0 is installed AND Package Information
cracklib-2.9.6-lp150.2 is installed
OR libcrack2-2.9.6-lp150.2 is installed
OR libcrack2-32bit-2.9.6-lp150.2 is installed
|
Definition Synopsis |
openSUSE Leap 15.1 is installed
AND Package Information
gnome-shell-3.26.2+20180130.0d9c74212-lp151.7.3 is installed
OR gnome-shell-browser-plugin-3.26.2+20180130.0d9c74212-lp151.7.3 is installed
OR gnome-shell-calendar-3.26.2+20180130.0d9c74212-lp151.7.3 is installed
OR gnome-shell-devel-3.26.2+20180130.0d9c74212-lp151.7.3 is installed
OR gnome-shell-lang-3.26.2+20180130.0d9c74212-lp151.7.3 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Desktop 11 SP2 is installed
AND Package Information
bytefx-data-mysql-2.6.7-0.9 is installed
OR ibm-data-db2-2.6.7-0.9 is installed
OR mono-core-2.6.7-0.9 is installed
OR mono-data-2.6.7-0.9 is installed
OR mono-data-firebird-2.6.7-0.9 is installed
OR mono-data-oracle-2.6.7-0.9 is installed
OR mono-data-postgresql-2.6.7-0.9 is installed
OR mono-data-sqlite-2.6.7-0.9 is installed
OR mono-data-sybase-2.6.7-0.9 is installed
OR mono-devel-2.6.7-0.9 is installed
OR mono-extras-2.6.7-0.9 is installed
OR mono-jscript-2.6.7-0.9 is installed
OR mono-locale-extras-2.6.7-0.9 is installed
OR mono-nunit-2.6.7-0.9 is installed
OR mono-wcf-2.6.7-0.9 is installed
OR mono-web-2.6.7-0.9 is installed
OR mono-winforms-2.6.7-0.9 is installed
OR monodoc-core-2.6.7-0.9 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Desktop 11 SP3 is installed
AND Package Information
bind-9.9.6P1-0.15 is installed
OR bind-libs-9.9.6P1-0.15 is installed
OR bind-libs-32bit-9.9.6P1-0.15 is installed
OR bind-utils-9.9.6P1-0.15 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Desktop 11 SP4 is installed
AND Package Information
MozillaFirefox-31.8.0esr-0.10 is installed
OR MozillaFirefox-translations-31.8.0esr-0.10 is installed
OR libfreebl3-3.19.2_CKBI_1.98-0.10 is installed
OR libfreebl3-32bit-3.19.2_CKBI_1.98-0.10 is installed
OR libsoftokn3-3.19.2_CKBI_1.98-0.10 is installed
OR libsoftokn3-32bit-3.19.2_CKBI_1.98-0.10 is installed
OR mozilla-nspr-4.10.8-0.5 is installed
OR mozilla-nspr-32bit-4.10.8-0.5 is installed
OR mozilla-nss-3.19.2_CKBI_1.98-0.10 is installed
OR mozilla-nss-32bit-3.19.2_CKBI_1.98-0.10 is installed
OR mozilla-nss-tools-3.19.2_CKBI_1.98-0.10 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Desktop 12 is installed
AND Package Information
qemu-2.0.2-48.9 is installed
OR qemu-block-curl-2.0.2-48.9 is installed
OR qemu-ipxe-1.0.0-48.9 is installed
OR qemu-kvm-2.0.2-48.9 is installed
OR qemu-seabios-1.7.4-48.9 is installed
OR qemu-sgabios-8-48.9 is installed
OR qemu-tools-2.0.2-48.9 is installed
OR qemu-vgabios-1.7.4-48.9 is installed
OR qemu-x86-2.0.2-48.9 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Desktop 12 SP1 is installed
AND Package Information
libxml2-2.9.1-17 is installed
OR libxml2-2-2.9.1-17 is installed
OR libxml2-2-32bit-2.9.1-17 is installed
OR libxml2-tools-2.9.1-17 is installed
OR python-libxml2-2.9.1-17 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Desktop 12 SP2 is installed
AND Package Information
libpcap-1.8.1-9 is installed
OR libpcap1-1.8.1-9 is installed
OR libpcap1-32bit-1.8.1-9 is installed
OR tcpdump-4.9.0-13 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Desktop 12 SP3 is installed
AND libspice-server1-0.12.8-1 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Desktop 12 SP4 is installed
AND Package Information
gnome-online-accounts-3.20.5-9 is installed
OR gnome-online-accounts-lang-3.20.5-9 is installed
OR libgoa-1_0-0-3.20.5-9 is installed
OR libgoa-1_0-0-32bit-3.20.5-9 is installed
OR libgoa-backend-1_0-1-3.20.5-9 is installed
OR typelib-1_0-Goa-1_0-3.20.5-9 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server 12 SP1 is installed
AND Package Information
MozillaFirefox-38.4.0esr-51 is installed
OR MozillaFirefox-translations-38.4.0esr-51 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server 12 SP1-LTSS is installed
AND Package Information
java-1_7_1-ibm-1.7.1_sr4.10-38.5 is installed
OR java-1_7_1-ibm-alsa-1.7.1_sr4.10-38.5 is installed
OR java-1_7_1-ibm-devel-1.7.1_sr4.10-38.5 is installed
OR java-1_7_1-ibm-jdbc-1.7.1_sr4.10-38.5 is installed
OR java-1_7_1-ibm-plugin-1.7.1_sr4.10-38.5 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server 12 SP2 is installed
AND Package Information
libgcrypt20-1.6.1-16.33 is installed
OR libgcrypt20-32bit-1.6.1-16.33 is installed
OR libgcrypt20-hmac-1.6.1-16.33 is installed
OR libgcrypt20-hmac-32bit-1.6.1-16.33 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server 12 SP2-BCL is installed
AND Package Information
xen-4.7.6_04-43.39 is installed
OR xen-doc-html-4.7.6_04-43.39 is installed
OR xen-libs-4.7.6_04-43.39 is installed
OR xen-libs-32bit-4.7.6_04-43.39 is installed
OR xen-tools-4.7.6_04-43.39 is installed
OR xen-tools-domU-4.7.6_04-43.39 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server 12 SP2-ESPOS is installed
AND Package Information
bzip2-1.0.6-30.5 is installed
OR bzip2-doc-1.0.6-30.5 is installed
OR libbz2-1-1.0.6-30.5 is installed
OR libbz2-1-32bit-1.0.6-30.5 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server 12 SP2-LTSS is installed
AND Package Information
gnutls-3.2.15-18.6 is installed
OR libgnutls-openssl27-3.2.15-18.6 is installed
OR libgnutls28-3.2.15-18.6 is installed
OR libgnutls28-32bit-3.2.15-18.6 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server 12 SP3 is installed
AND kdump-0.8.16-5 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server 12 SP3-BCL is installed
AND Package Information
MozillaFirefox-60.9.0-109.86 is installed
OR MozillaFirefox-translations-common-60.9.0-109.86 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server 12 SP3-ESPOS is installed
AND Package Information
kgraft-patch-4_4_162-94_69-default-7-2 is installed
OR kgraft-patch-SLE12-SP3_Update_21-7-2 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server 12 SP3-LTSS is installed
AND Package Information
kgraft-patch-4_4_156-94_57-default-8-2 is installed
OR kgraft-patch-SLE12-SP3_Update_18-8-2 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server 12 SP3-TERADATA is installed
AND Package Information
cups-1.7.5-20.17 is installed
OR cups-client-1.7.5-20.17 is installed
OR cups-libs-1.7.5-20.17 is installed
OR cups-libs-32bit-1.7.5-20.17 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server 12 SP4 is installed
AND libmms0-0.6.2-15 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server 15-LTSS is installed
AND Package Information
kernel-default-4.12.14-150.63 is installed
OR kernel-default-base-4.12.14-150.63 is installed
OR kernel-default-devel-4.12.14-150.63 is installed
OR kernel-default-man-4.12.14-150.63 is installed
OR kernel-devel-4.12.14-150.63 is installed
OR kernel-docs-4.12.14-150.63 is installed
OR kernel-macros-4.12.14-150.63 is installed
OR kernel-obs-build-4.12.14-150.63 is installed
OR kernel-source-4.12.14-150.63 is installed
OR kernel-syms-4.12.14-150.63 is installed
OR kernel-vanilla-4.12.14-150.63 is installed
OR kernel-vanilla-base-4.12.14-150.63 is installed
OR kernel-zfcpdump-4.12.14-150.63 is installed
OR reiserfs-kmp-default-4.12.14-150.63 is installed
|
Definition Synopsis |
SUSE Linux Enterprise Server for SAP Applications 15 is installed
AND python-ipaddress-1.0.18-3.3 is installed
|
Definition Synopsis |
SUSE OpenStack Cloud 6 is installed
AND Package Information
openstack-dashboard-8.0.2~a0~dev7-2 is installed
OR python-horizon-8.0.2~a0~dev7-2 is installed
|
Definition Synopsis |
SUSE OpenStack Cloud 7 is installed
AND Package Information
ghostscript-9.26a-23.19 is installed
OR ghostscript-x11-9.26a-23.19 is installed
OR libspectre-0.2.7-12.6 is installed
OR libspectre1-0.2.7-12.6 is installed
|
Definition Synopsis |
SUSE OpenStack Cloud 8 is installed
AND Package Information
MozillaFirefox-60.8.0-109.83 is installed
OR MozillaFirefox-translations-common-60.8.0-109.83 is installed
OR libfreebl3-3.44.1-58.28 is installed
OR libfreebl3-32bit-3.44.1-58.28 is installed
OR libfreebl3-hmac-3.44.1-58.28 is installed
OR libfreebl3-hmac-32bit-3.44.1-58.28 is installed
OR libsoftokn3-3.44.1-58.28 is installed
OR libsoftokn3-32bit-3.44.1-58.28 is installed
OR libsoftokn3-hmac-3.44.1-58.28 is installed
OR libsoftokn3-hmac-32bit-3.44.1-58.28 is installed
OR mozilla-nss-3.44.1-58.28 is installed
OR mozilla-nss-32bit-3.44.1-58.28 is installed
OR mozilla-nss-certs-3.44.1-58.28 is installed
OR mozilla-nss-certs-32bit-3.44.1-58.28 is installed
OR mozilla-nss-sysinit-3.44.1-58.28 is installed
OR mozilla-nss-sysinit-32bit-3.44.1-58.28 is installed
OR mozilla-nss-tools-3.44.1-58.28 is installed
|
Definition Synopsis |
SUSE OpenStack Cloud Crowbar 8 is installed
AND Package Information
MozillaFirefox-68.6.0-109.110 is installed
OR MozillaFirefox-translations-common-68.6.0-109.110 is installed
|
Definition Synopsis |
SUSE OpenStack Cloud Crowbar 9 is installed
AND python-Django1-1.11.20-3.6 is installed
|