ID

VAR-202002-1243

CVE

CVE-2020-8648

TITLE

Linux Kernel Vulnerability in using free memory in

DESCRIPTION

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c. Linux Kernel Is vulnerable to the use of freed memory.Information is obtained and service operation is interrupted (DoS) It may be put into a state. 7.6) - noarch, x86_64 3. Description: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2021:2314-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:2314 Issue date: 2021-06-08 CVE Names: CVE-2020-8648 CVE-2020-12362 CVE-2020-12363 CVE-2020-12364 CVE-2020-27170 CVE-2021-3347 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Security Fix(es): * kernel: Integer overflow in Intel(R) Graphics Drivers (CVE-2020-12362) * kernel: Use after free via PI futex state (CVE-2021-3347) * kernel: use-after-free in n_tty_receive_buf_common function in drivers/tty/n_tty.c (CVE-2020-8648) * kernel: Improper input validation in some Intel(R) Graphics Drivers (CVE-2020-12363) * kernel: Null pointer dereference in some Intel(R) Graphics Drivers (CVE-2020-12364) * kernel: Speculation on pointer arithmetic against bpf_context pointer (CVE-2020-27170) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * kernel crash when call the timer function (sctp_generate_proto_unreach_event) of sctp module (BZ#1707184) * SCSI error handling process on HP P440ar controller gets stuck indefinitely in device reset operation (BZ#1830268) * netfilter: reproducible deadlock on nft_log module autoload (BZ#1858329) * netfilter: NULL pointer dereference in nf_tables_set_lookup() (BZ#1873171) * [DELL EMC 7.9 Bug]: No acpi_pad threads on top command for "power cap policy equal to 0 watts" (BZ#1883174) * A race between i40e_ndo_set_vf_mac() and i40e_vsi_clear() in the i40e driver causes a use after free condition of the kmalloc-4096 slab cache. (BZ#1886003) * netxen driver performs poorly with RT kernel (BZ#1894274) * gendisk->disk_part_tbl->last_lookup retains pointer after partition deletion (BZ#1898596) * Kernel experiences panic in update_group_power() due to division error even with Bug 1701115 fix (BZ#1910763) * RHEL7.9 - zfcp: fix handling of FCP_RESID_OVER bit in fcp ingress path (BZ#1917839) * RHEL7.9 - mm/THP: do not access vma->vm_mm after calling handle_userfault (BZ#1917840) * raid: wrong raid io account (BZ#1927106) * qla2x00_status_cont_entry() missing upstream patch that prevents unnecessary ABRT/warnings (BZ#1933784) * RHEL 7.9.z - System hang caused by workqueue stall in qla2xxx driver (BZ#1937945) * selinux: setsebool can trigger a deadlock (BZ#1939091) * [Hyper-V][RHEL-7] Cannot boot kernel 3.10.0-1160.21.1.el7.x86_64 on Hyper-V (BZ#1941841) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1802559 - CVE-2020-8648 kernel: use-after-free in n_tty_receive_buf_common function in drivers/tty/n_tty.c 1922249 - CVE-2021-3347 kernel: Use after free via PI futex state 1930246 - CVE-2020-12362 kernel: Integer overflow in Intel(R) Graphics Drivers 1930249 - CVE-2020-12363 kernel: Improper input validation in some Intel(R) Graphics Drivers 1930251 - CVE-2020-12364 kernel: Null pointer dereference in some Intel(R) Graphics Drivers 1940627 - CVE-2020-27170 kernel: Speculation on pointer arithmetic against bpf_context pointer 1941841 - [Hyper-V][RHEL-7] Cannot boot kernel 3.10.0-1160.21.1.el7.x86_64 on Hyper-V 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: kernel-3.10.0-1160.31.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-1160.31.1.el7.noarch.rpm kernel-doc-3.10.0-1160.31.1.el7.noarch.rpm x86_64: bpftool-3.10.0-1160.31.1.el7.x86_64.rpm bpftool-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.31.1.el7.x86_64.rpm kernel-devel-3.10.0-1160.31.1.el7.x86_64.rpm kernel-headers-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-1160.31.1.el7.x86_64.rpm perf-3.10.0-1160.31.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm python-perf-3.10.0-1160.31.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: bpftool-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-1160.31.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: kernel-3.10.0-1160.31.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-1160.31.1.el7.noarch.rpm kernel-doc-3.10.0-1160.31.1.el7.noarch.rpm x86_64: bpftool-3.10.0-1160.31.1.el7.x86_64.rpm bpftool-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.31.1.el7.x86_64.rpm kernel-devel-3.10.0-1160.31.1.el7.x86_64.rpm kernel-headers-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-1160.31.1.el7.x86_64.rpm perf-3.10.0-1160.31.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm python-perf-3.10.0-1160.31.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: bpftool-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-1160.31.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: kernel-3.10.0-1160.31.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-1160.31.1.el7.noarch.rpm kernel-doc-3.10.0-1160.31.1.el7.noarch.rpm ppc64: bpftool-3.10.0-1160.31.1.el7.ppc64.rpm bpftool-debuginfo-3.10.0-1160.31.1.el7.ppc64.rpm kernel-3.10.0-1160.31.1.el7.ppc64.rpm kernel-bootwrapper-3.10.0-1160.31.1.el7.ppc64.rpm kernel-debug-3.10.0-1160.31.1.el7.ppc64.rpm kernel-debug-debuginfo-3.10.0-1160.31.1.el7.ppc64.rpm kernel-debug-devel-3.10.0-1160.31.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-1160.31.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-1160.31.1.el7.ppc64.rpm kernel-devel-3.10.0-1160.31.1.el7.ppc64.rpm kernel-headers-3.10.0-1160.31.1.el7.ppc64.rpm kernel-tools-3.10.0-1160.31.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-1160.31.1.el7.ppc64.rpm kernel-tools-libs-3.10.0-1160.31.1.el7.ppc64.rpm perf-3.10.0-1160.31.1.el7.ppc64.rpm perf-debuginfo-3.10.0-1160.31.1.el7.ppc64.rpm python-perf-3.10.0-1160.31.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-1160.31.1.el7.ppc64.rpm ppc64le: bpftool-3.10.0-1160.31.1.el7.ppc64le.rpm bpftool-debuginfo-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-bootwrapper-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-debug-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-debug-debuginfo-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-devel-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-headers-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-tools-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-tools-libs-3.10.0-1160.31.1.el7.ppc64le.rpm perf-3.10.0-1160.31.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-1160.31.1.el7.ppc64le.rpm python-perf-3.10.0-1160.31.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-1160.31.1.el7.ppc64le.rpm s390x: bpftool-3.10.0-1160.31.1.el7.s390x.rpm bpftool-debuginfo-3.10.0-1160.31.1.el7.s390x.rpm kernel-3.10.0-1160.31.1.el7.s390x.rpm kernel-debug-3.10.0-1160.31.1.el7.s390x.rpm kernel-debug-debuginfo-3.10.0-1160.31.1.el7.s390x.rpm kernel-debug-devel-3.10.0-1160.31.1.el7.s390x.rpm kernel-debuginfo-3.10.0-1160.31.1.el7.s390x.rpm kernel-debuginfo-common-s390x-3.10.0-1160.31.1.el7.s390x.rpm kernel-devel-3.10.0-1160.31.1.el7.s390x.rpm kernel-headers-3.10.0-1160.31.1.el7.s390x.rpm kernel-kdump-3.10.0-1160.31.1.el7.s390x.rpm kernel-kdump-debuginfo-3.10.0-1160.31.1.el7.s390x.rpm kernel-kdump-devel-3.10.0-1160.31.1.el7.s390x.rpm perf-3.10.0-1160.31.1.el7.s390x.rpm perf-debuginfo-3.10.0-1160.31.1.el7.s390x.rpm python-perf-3.10.0-1160.31.1.el7.s390x.rpm python-perf-debuginfo-3.10.0-1160.31.1.el7.s390x.rpm x86_64: bpftool-3.10.0-1160.31.1.el7.x86_64.rpm bpftool-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.31.1.el7.x86_64.rpm kernel-devel-3.10.0-1160.31.1.el7.x86_64.rpm kernel-headers-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-1160.31.1.el7.x86_64.rpm perf-3.10.0-1160.31.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm python-perf-3.10.0-1160.31.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: bpftool-debuginfo-3.10.0-1160.31.1.el7.ppc64.rpm kernel-debug-debuginfo-3.10.0-1160.31.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-1160.31.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-1160.31.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-1160.31.1.el7.ppc64.rpm kernel-tools-libs-devel-3.10.0-1160.31.1.el7.ppc64.rpm perf-debuginfo-3.10.0-1160.31.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-1160.31.1.el7.ppc64.rpm ppc64le: bpftool-debuginfo-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-debug-debuginfo-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-debug-devel-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-1160.31.1.el7.ppc64le.rpm kernel-tools-libs-devel-3.10.0-1160.31.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-1160.31.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-1160.31.1.el7.ppc64le.rpm x86_64: bpftool-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-1160.31.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: kernel-3.10.0-1160.31.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-1160.31.1.el7.noarch.rpm kernel-doc-3.10.0-1160.31.1.el7.noarch.rpm x86_64: bpftool-3.10.0-1160.31.1.el7.x86_64.rpm bpftool-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.31.1.el7.x86_64.rpm kernel-devel-3.10.0-1160.31.1.el7.x86_64.rpm kernel-headers-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-1160.31.1.el7.x86_64.rpm perf-3.10.0-1160.31.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm python-perf-3.10.0-1160.31.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: bpftool-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-1160.31.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.31.1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-8648 https://access.redhat.com/security/cve/CVE-2020-12362 https://access.redhat.com/security/cve/CVE-2020-12363 https://access.redhat.com/security/cve/CVE-2020-12364 https://access.redhat.com/security/cve/CVE-2020-27170 https://access.redhat.com/security/cve/CVE-2021-3347 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYL/x1NzjgjWX9erEAQijGA//bxt7JJkdkIO3eT3vTQ6mYtMErGKBVx8A sI+zjh/mYmaocA6UrE88bV1ixfJ2xknb9HfFBjQywPAiqTiRXHUyiL24IyGe5Lit WkPjLRDHCb/q56rl1EGkyr3noikZCNuNF9HOf8PHukJmLqD6iLWWws8J0knY9QyR /8scePwyCR4wqr2ru5etg5TKx+pkOY+Dfnwhgy6U2thQI58/Flvn7GyOBvSG69M8 6gewtkav1Fnw7WlLT386OjrAajBw6Pd9xee+S7T9qFv/BfC5k0HA26qbnMaAfzle YKXmjoIV7ExiszvspqZgdlsg0835BUALUIikbpnTvh7Kl2MY2BhBIqJvKOWeT3Mp VIpkMs4HVALkHoDqzYDZx8WKEy0hrDAjczT+aWtvXJmHEBmsHEx5Ny8tvYk1w3t/ cNVvfj+EqFaSY1GSNY1MG2ZDzIDYWrx+rGKA7tgqtwSlCdYEbORlXCDu+W8+c7Xg g1vE8kfpkbxyLpvlJ0iOWoLiOCCrZ04fiXXhgSn9O1/zmOwkijFHk5x/aFDEoyBE O/s2rawA1cADPiLTxGWU9/MITpQuS+FuAc235HT8VRSXvsV3ZHB36N1z4JZcPB5P FN8hH+ibnEOlpKC7YOE9K4eQ/jG1etWhVWctf7HcP2nbQSpiiZQoQGPznvt+6OKQ XAOam1B//x4= =HTlr -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . ========================================================================== Ubuntu Security Notice USN-4342-1 April 28, 2020 linux, linux-aws, linux-azure, linux-gcp, linux-gke-5.3, linux-hwe, linux-kvm, linux-raspi2, linux-raspi2-5.3 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 19.10 - Ubuntu 18.04 LTS Summary: Several security issues were fixed in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2020-11884) It was discovered that the Intel Wi-Fi driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-16234) Tristan Madani discovered that the block I/O tracing implementation in the Linux kernel contained a race condition. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2019-19768) It was discovered that the vhost net driver in the Linux kernel contained a stack buffer overflow. A local attacker with the ability to perform ioctl() calls on /dev/vhost-net could use this to cause a denial of service (system crash). A local attacker could possibly use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2020-8648) Shijie Luo discovered that the ext4 file system implementation in the Linux kernel did not properly check for a too-large journal size. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (soft lockup). (CVE-2020-8992) Jordy Zomer discovered that the floppy driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2020-9383) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 19.10: linux-image-5.3.0-1016-kvm 5.3.0-1016.17 linux-image-5.3.0-1017-aws 5.3.0-1017.18 linux-image-5.3.0-1018-gcp 5.3.0-1018.19 linux-image-5.3.0-1020-azure 5.3.0-1020.21 linux-image-5.3.0-1023-raspi2 5.3.0-1023.25 linux-image-5.3.0-51-generic 5.3.0-51.44 linux-image-5.3.0-51-generic-lpae 5.3.0-51.44 linux-image-5.3.0-51-lowlatency 5.3.0-51.44 linux-image-5.3.0-51-snapdragon 5.3.0-51.44 linux-image-aws 5.3.0.1017.19 linux-image-azure 5.3.0.1020.39 linux-image-gcp 5.3.0.1018.19 linux-image-generic 5.3.0.51.42 linux-image-generic-lpae 5.3.0.51.42 linux-image-gke 5.3.0.1018.19 linux-image-kvm 5.3.0.1016.18 linux-image-lowlatency 5.3.0.51.42 linux-image-raspi2 5.3.0.1023.20 linux-image-snapdragon 5.3.0.51.42 linux-image-virtual 5.3.0.51.42 Ubuntu 18.04 LTS: linux-image-5.3.0-1018-gke 5.3.0-1018.19~18.04.1 linux-image-5.3.0-1023-raspi2 5.3.0-1023.25~18.04.1 linux-image-5.3.0-51-generic 5.3.0-51.44~18.04.2 linux-image-5.3.0-51-generic-lpae 5.3.0-51.44~18.04.2 linux-image-5.3.0-51-lowlatency 5.3.0-51.44~18.04.2 linux-image-generic-hwe-18.04 5.3.0.51.104 linux-image-generic-lpae-hwe-18.04 5.3.0.51.104 linux-image-gke-5.3 5.3.0.1018.8 linux-image-lowlatency-hwe-18.04 5.3.0.51.104 linux-image-raspi2-hwe-18.04 5.3.0.1023.12 linux-image-snapdragon-hwe-18.04 5.3.0.51.104 linux-image-virtual-hwe-18.04 5.3.0.51.104 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Bugs fixed (https://bugzilla.redhat.com/): 1660798 - NFSv4.2: security label of mount point shows as "unlabeled_t" for ~30 seconds after mounting 1718176 - CVE-2019-12614 kernel: null pointer dereference in dlpar_parse_cc_property in arch/powerrc/platforms/pseries/dlpar.c causing denial of service 1759052 - CVE-2019-15925 kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg 1760100 - CVE-2019-15917 kernel: use-after-free in drivers/bluetooth/hci_ldisc.c 1760310 - CVE-2019-16231 kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c 1760420 - CVE-2019-16233 kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c 1774946 - CVE-2019-19072 kernel: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c allows for a DoS 1774963 - CVE-2019-19068 kernel: A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c allows for a DoS 1774988 - CVE-2019-19046 kernel: Denial Of Service in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c 1775015 - CVE-2019-19063 kernel: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c allow for a DoS 1775021 - CVE-2019-19062 kernel: memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for DoS 1775097 - CVE-2019-19056 kernel: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c allows to cause DoS 1777418 - CVE-2019-18808 kernel: memory leak in ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c 1777449 - CVE-2019-18809 kernel: memory leak in af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c 1778762 - Please backport Jitter Entropy patches 1779594 - CVE-2019-19332 Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid 1781679 - CVE-2019-19447 kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c 1781810 - CVE-2019-19543 kernel: use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c 1783459 - CVE-2019-19524 kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free 1783534 - CVE-2019-19533 kernel: information leak bug caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c 1783561 - CVE-2019-19537 kernel: race condition caused by a malicious USB device in the USB character device driver layer 1784130 - CVE-2019-19319 kernel: out-of-bounds write in ext4_xattr_set_entry in fs/ext4/xattr.c 1786160 - CVE-2019-19767 kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry related to fs/ext4/inode.c and fs/ext4/super.c 1786179 - CVE-2019-19770 kernel: use-after-free in debugfs_remove in fs/debugfs/inode.c 1790063 - CVE-2019-20054 kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c 1802555 - CVE-2020-8649 kernel: invalid read location in vgacon_invert_region function in drivers/video/console/vgacon.c 1802559 - CVE-2020-8648 kernel: use-after-free in n_tty_receive_buf_common function in drivers/tty/n_tty.c 1802563 - CVE-2020-8647 kernel: out-of-bounds read in in vc_do_resize function in drivers/tty/vt/vt.c 1817718 - CVE-2020-10942 kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field 1819377 - CVE-2019-9458 kernel: use after free due to race condition in the video driver leads to local privilege escalation 1819399 - CVE-2019-9455 kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information disclosure 1820402 - Sometimes hit "error: kvm run failed Bad address" when launching a guest on Power8 1822077 - CVE-2020-12826 kernel: possible to send arbitrary signals to a privileged (suidroot) parent process 1823764 - RFE: Enable genfs+xattr labeling for CephFS 1824059 - CVE-2019-20636 kernel: out-of-bounds write via crafted keycode table 1824792 - CVE-2020-11668 kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c 1824918 - CVE-2020-11565 kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c 1830280 - Please enable CONFIG_RANDOM_TRUST_CPU 1831399 - CVE-2020-10732 kernel: uninitialized kernel data leak in userspace coredumps 1831699 - CVE-2020-12465 kernel: buffer overflow in mt76_add_fragment function in drivers/net/wireless/mediatek/mt76/dma.c 1832543 - CVE-2020-12655 kernel: sync of excessive duration via an XFS v5 image with crafted metadata 1832876 - CVE-2020-12659 kernel: xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write which could result in crash and data coruption 1834845 - CVE-2020-12770 kernel: sg_write function lacks an sg_remove_request call in a certain failure case 1839634 - CVE-2020-10751 kernel: SELinux netlink permission check bypass 1844520 - Incorrect pinning of IRQ threads on isolated CPUs by drivers that use cpumask_local_spread() 1846380 - CVE-2020-10773 kernel: kernel stack information leak on s390/s390x 1846964 - CVE-2020-10774 kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features 1853447 - Guest IA32_SPEC_CTRL wrmsr failure on AMD processors that support STIBP but don't support for IBRS 1856588 - Guest crashed and hung when hot unplug vcpus 1860065 - CVE-2020-0305 kernel: possible use-after-free due to a race condition in cdev_get of char_dev.c 1874311 - CVE-2020-14381 kernel: referencing inode of removed superblock in get_futex_key() causes UAF 1881424 - CVE-2020-25641 kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS 6

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

resource management error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Ubuntu

SOURCES

LAST UPDATE DATE

2026-02-06T21:57:31.062000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE