The SUSE Linux Enterprise 15 SP1 Azure kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
CVE-2019-15213: An issue was discovered in the Linux kernel, there was a use-after-free caused by a malicious USB device in the drivers/media/usb/dvb-usb/dvb-usb-init.c driver (bnc#1146544).
CVE-2019-19531: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/yurex.c driver (bnc#1158445).
CVE-2019-19543: There was a use-after-free in serialirinitmodule() in drivers/media/rc/serialir.c (bnc#1158427).
CVE-2019-19525: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver (bnc#1158417).
CVE-2019-19530: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver (bnc#1158410).
CVE-2019-19536: There was an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peakusb/pcanusb_pro.c driver (bnc#1158394).
CVE-2019-19524: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver (bnc#1158413).
CVE-2019-19528: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver (bnc#1158407).
CVE-2019-19534: There was an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peakusb/pcanusb_core.c driver (bnc#1158398).
CVE-2019-19529: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c driver (bnc#1158381).
CVE-2019-14901: A heap overflow flaw was found in the Linux kernel in Marvell WiFi chip driver. The vulnerability allowed a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system (bnc#1157042).
CVE-2019-14895: A heap-based buffer overflow was discovered in the Linux kernel in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could have allowed the remote device to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1157158).
CVE-2019-18660: The Linux kernel on powerpc allowed Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c (bnc#1157038).
CVE-2019-18683: An issue was discovered in drivers/media/platform/vivid in the Linux kernel. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vividstopgeneratingvidcap(), vividstopgeneratingvidout(), sdrcapstop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free (bnc#1155897).
CVE-2019-18809: A memory leak in the af9005identifystate() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1156258).
CVE-2019-19046: A memory leak in the _ipmibmcregister() function in drivers/char/ipmi/ipmimsghandler.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering idasimpleget() failure (bnc#1157304).
CVE-2019-19078: A memory leak in the ath10kusbhiftxsg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering usbsubmiturb() failures (bnc#1157032).
CVE-2019-19062: A memory leak in the cryptoreport() function in crypto/cryptouserbase.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering cryptoreport_alg() failures (bnc#1157333).
CVE-2019-19057: Two memory leaks in the mwifiexpcieinitevtring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering mwifiexmappci_memory() failures (bnc#1157197).
CVE-2019-19056: A memory leak in the mwifiexpciealloccmdrspbuf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering mwifiexmappci_memory() failures (bnc#1157197).
CVE-2019-19068: A memory leak in the rtl8xxxusubmitinturb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxucore.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering usbsubmiturb() failures (bnc#1157307).
CVE-2019-19063: Two memory leaks in the rtlusbprobe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157298).
CVE-2019-19227: In the AppleTalk subsystem in the Linux kernel there was a potential NULL pointer dereference because registersnapclient may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregistersnapclient (bnc#1157678).
CVE-2019-19081: A memory leak in the nfpflowerspawnvnicreprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157045).
CVE-2019-19080: Four memory leaks in the nfpflowerspawnphyreprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157044).
CVE-2019-19065: A memory leak in the sdmainit() function in drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering rhashtableinit() failures (bnc#1157191).
CVE-2019-19077: A memory leak in the bnxtrecreatesrq() function in drivers/infiniband/hw/bnxtre/ib_verbs.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering copy to udata failures (bnc#1157171).
CVE-2019-19052: A memory leak in the gscanopen() function in drivers/net/can/usb/gsusb.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering usbsubmit_urb() failures (bnc#1157324).
CVE-2019-19067: Four memory leaks in the acphwinit() function in drivers/gpu/drm/amd/amdgpu/amdgpuacp.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering mfdaddhotplugdevices() or pmgenpdadd_device() failures (bsc#1157180).
CVE-2019-19060: A memory leak in the adisupdatescanmode() function in drivers/iio/imu/adisbuffer.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157178).
CVE-2019-19049: A memory leak in the unittestdataadd() function in drivers/of/unittest.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering offdtunflatten_tree() failures (bsc#1157173).
CVE-2019-19075: A memory leak in the ca8210probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering ca8210getplatformdata() failures (bnc#1157162).
CVE-2019-19058: A memory leak in the allocsgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering allocpage() failures (bnc#1157145).
CVE-2019-19074: A memory leak in the ath9kwmicmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157143).
CVE-2019-19073: Memory leaks in drivers/net/wireless/ath/ath9k/htchst.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering waitforcompletiontimeout() failures. This affects the htcconfigpipecredits() function, the htcsetupcomplete() function, and the htcconnect_service() function (bnc#1157070).
CVE-2019-19083: Memory leaks in *clocksourcecreate() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel allowed attackers to cause a denial of service (memory consumption). This affects the dce112clocksourcecreate() function in drivers/gpu/drm/amd/display/dc/dce112/dce112resource.c, the dce100clocksourcecreate() function in drivers/gpu/drm/amd/display/dc/dce100/dce100resource.c, the dcn10clocksourcecreate() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10resource.c, the dcn20clocksourcecreate() function in drivers/gpu/drm/amd/display/dc/dcn20/dcn20resource.c, the dce120clocksourcecreate() function in drivers/gpu/drm/amd/display/dc/dce120/dce120resource.c, the dce110clocksourcecreate() function in drivers/gpu/drm/amd/display/dc/dce110/dce110resource.c, and the dce80clocksourcecreate() function in drivers/gpu/drm/amd/display/dc/dce80/dce80resource.c (bnc#1157049).
CVE-2019-19082: Memory leaks in *createresourcepool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel allowed attackers to cause a denial of service (memory consumption). This affects the dce120createresourcepool() function in drivers/gpu/drm/amd/display/dc/dce120/dce120resource.c, the dce110createresourcepool() function in drivers/gpu/drm/amd/display/dc/dce110/dce110resource.c, the dce100createresourcepool() function in drivers/gpu/drm/amd/display/dc/dce100/dce100resource.c, the dcn10createresourcepool() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10resource.c, and the dce112createresourcepool() function in drivers/gpu/drm/amd/display/dc/dce112/dce112resource.c (bnc#1157046).
CVE-2019-15916: An issue was discovered in the Linux kernel There was a memory leak in registerqueuekobjects() in net/core/net-sysfs.c, which will cause denial of service (bnc#1149448).
CVE-2019-0154: Insufficient access control in subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 and E-2100 Processor Families may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1135966).
CVE-2019-16231: drivers/net/fjes/fjesmain.c in the Linux kernel 5.2.14 did not check the allocworkqueue return value, leading to a NULL pointer dereference (bnc#1150466).
CVE-2019-18805: An issue was discovered in net/ipv4/sysctlnetipv4.c in the Linux kernel There was a net/ipv4/tcpinput.c signed integer overflow in tcpackupdatertt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcpminrtt_wlen, leading to a denial of service or possibly unspecified other impact (bnc#1156187).
CVE-2019-17055: basesockcreate in drivers/isdn/mISDN/socket.c in the AFISDN network module in the Linux kernel did not enforce CAPNET_RAW, which means that unprivileged users can create a raw socket (bnc#1152782).
The following non-security bugs were fixed:
bnxt_en: Update firmware interface spec. to 1.10.0.47 (bsc#1157115)
ACPI / LPSS: Exclude I2C busses shared with PUNIT from pmcatomd3_mask (bsc#1051510).
ACPI / SBS: Fix rare oops when removing modules (bsc#1051510).
ACPI / hotplug / PCI: Allocate resources directly under the non-hotplug bridge (bsc#1111666).
ACPICA: Never run REG on systemmemory and system_IO (bsc#1051510).
ACPICA: Use %d for signed int print formatting instead of %u (bsc#1051510).
ALSA: 6fire: Drop the dead code (git-fixes).
ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series (git-fixes).
ALSA: cs4236: fix error return comparison of an unsigned integer (git-fixes).
ALSA: firewire-motu: Correct a typo in the clock proc string (git-fixes).
ALSA: hda - Add mute led support for HP ProBook 645 G4 (git-fixes).
ALSA: hda - Fix pending unsol events at shutdown (git-fixes).
ALSA: hda/ca0132 - Fix possible workqueue stall (bsc#1155836).
ALSA: hda/hdmi - Clear codec->relaxed_resume flag at unbinding (git-fixes).
PM / hibernate: Check the success of generating md5 digest before hibernation (bsc#1051510).
RDMA/bnxt_re: Fix stat push into dma buffer on gen p5 devices (bsc#1157115)
RDMA/efa: Add Amazon EFA driver (jsc#SLE-4805)
RDMA/efa: Clear the admin command buffer prior to its submission (git-fixes) Patch was already picked through Amazon driver repo but was not marked with a Git-commit tag
RDMA/hns: Fix comparison of unsigned long variable 'end' with less than zero (bsc#1104427 bsc#1137236).
RDMA/hns: Fix wrong assignment of qpaccessflags (bsc#1104427 ).
RDMA/restrack: Track driver QP types in resource tracker (jsc#SLE-4805)
README.BRANCH: Removing myself from the maintainer list
UAS: Revert commit 3ae62a42090f ('UAS: fix alignment of scatter/gather segments').
USB: chaoskey: fix error case of a timeout (git-fixes).
USB: gadget: Reject endpoints with 0 maxpacket value (bsc#1051510).
rpm/kernel-binary.spec.in: add COMPRESSVMLINUX (bnc#1155921) Let COMPRESSVMLINUX determine the compression used for vmlinux. By default (historically), it is gz.
rpm/kernel-source.spec.in: Fix dependency of kernel-devel (bsc#1154043)