The SUSE Linux Enterprise 15 Azure kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
CVE-2019-11477: A sequence of SACKs may have been crafted such that one can trigger an integer overflow, leading to a kernel panic.
CVE-2019-11478: It was possible to send a crafted sequence of SACKs which will
fragment the TCP retransmission queue. An attacker may have been able to further exploit the fragmented queue to cause an
expensive linked-list walk for subsequent SACKs received for that same TCP connection.
CVE-2019-11479: An attacker could force the Linux kernel to segment its responses into multiple TCP segments. This would drastically increased the bandwidth required to deliver the same amount of data. Further, it would consume additional resources such as CPU and NIC processing power.
CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network. (bnc#1136424)
CVE-2019-12382: An issue was discovered in drmloadedidfirmware in drivers/gpu/drm/drmedid_load.c in the Linux kernel, there was an unchecked kstrdup of fwstr, which might have allowed an attacker to cause a denial of service (NULL pointer dereference and system crash). (bnc#1136586)
CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux kernel allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may have been possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. (bnc#1120843)
CVE-2019-11487: The Linux kernel allowed page reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM existed. It could have occured with FUSE requests. (bnc#1133190)
CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the unused memory region in the extent tree block, which might have allowed local users to obtain sensitive information by reading uninitialized data in the filesystem. (bnc#1135281)
CVE-2018-7191: In the tun subsystem in the Linux kernel, devgetvalidname was not called before registernetdevice. This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. (bnc#1135603)
CVE-2019-11085: Insufficient input validation in Kernel Mode Driver in i915 Graphics for Linux may have allowed an authenticated user to potentially enable escalation of privilege via local access. (bnc#1135278)
CVE-2019-11815: An issue was discovered in rdstcpkill_sock in net/rds/tcp.c in the Linux kernel There was a race condition leading to a use-after-free, related to net namespace cleanup. (bnc#1134537)
CVE-2019-11884: The dohidpsock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel allowed a local user to obtain potentially sensitive information from kernel stack memory via a hidPCONNADD command, because a name field may not end with a '\0' character. (bnc#1134848)
CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel had multiple race conditions. (bnc#1133188)
CVE-2019-10124: An attacker could exploit an issue in the hwpoison implementation to cause a denial of service (BUG). (bsc#1130699)
The following non-security bugs were fixed:
9p locks: add mount option for lock retry interval (bsc#1051510).
acpi / property: fix handling of datanodes in acpigetnextsubnode() (bsc#1051510).
acpi / utils: Drop reference in test for device presence (bsc#1051510).
acpi: button: reinitialize button state upon resume (bsc#1051510).
acpi: fix menuconfig presentation of acpi submenu (bsc#1117158).
acpica: AML interpreter: add region addresses in global list during initialization (bsc#1051510).
acpica: Namespace: remove address node from global list after method termination (bsc#1051510).
alsa: core: Do not refer to snd_cards array directly (bsc#1051510).
alsa: emu10k1: Drop superfluous id-uniquification behavior (bsc#1051510).
alsa: hda - Register irq handler after the chip initialization (bsc#1051510).
alsa: hda - Use a macro for snd_array iteration loops (bsc#1051510).
alsa: hda/hdmi - Consider eld_valid when reporting jack event (bsc#1051510).
alsa: hda/hdmi - Read the pin sense from register when repolling (bsc#1051510).
alsa: hda/realtek - Add new Dell platform for headset mode (bsc#1051510).
alsa: hda/realtek - Apply the fixup for ASUS Q325UAR (bsc#1051510).