ALT-BU-2020-4020-1
Branch sisyphus update bulletin.
Package kernel-image-rt updated to version 4.19.142-alt1.rt63 for branch sisyphus in task 257521.
Closed vulnerabilities
BDU:2019-04812
Уязвимость функции adis_update_scan_mode_burst() (drivers/iio/imu/adis_buffer.c) ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04876
Уязвимость драйвера i40e контроллеров Intel Ethernet серии 700, позволяющая нарушителю повысить свои привилегии
BDU:2019-04892
Уязвимость драйвера drivers/net/wireless/ath/ath9k/htc_hst.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-00352
Уязвимость функции __btrfs_map_block ядра операционных систем Linux, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-04348
Уязвимость функции cgroups ядра операционной системы Linux, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2019-0145
Buffer overflow in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable an escalation of privilege via local access.
Modified: 2024-11-21
CVE-2019-19061
A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-9c0530e898f3.
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.9
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.9
- https://github.com/torvalds/linux/commit/9c0530e898f384c5d279bfcebd8bb17af1105873
- https://github.com/torvalds/linux/commit/9c0530e898f384c5d279bfcebd8bb17af1105873
- https://security.netapp.com/advisory/ntap-20191205-0001/
- https://security.netapp.com/advisory/ntap-20191205-0001/
- USN-4208-1
- USN-4208-1
- USN-4526-1
- USN-4526-1
Modified: 2024-11-21
CVE-2019-19074
A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.
- openSUSE-SU-2019:2675
- openSUSE-SU-2019:2675
- https://github.com/torvalds/linux/commit/728c1e2a05e4b5fc52fab3421dce772a806612a2
- https://github.com/torvalds/linux/commit/728c1e2a05e4b5fc52fab3421dce772a806612a2
- [debian-lts-announce] 20201030 [SECURITY] [DLA 2420-1] linux security update
- [debian-lts-announce] 20201030 [SECURITY] [DLA 2420-1] linux security update
- [debian-lts-announce] 20201031 [SECURITY] [DLA 2420-2] linux regression update
- [debian-lts-announce] 20201031 [SECURITY] [DLA 2420-2] linux regression update
- FEDORA-2019-021c968423
- FEDORA-2019-021c968423
- FEDORA-2019-34a75d7e61
- FEDORA-2019-34a75d7e61
- https://security.netapp.com/advisory/ntap-20191205-0001/
- https://security.netapp.com/advisory/ntap-20191205-0001/
- USN-4526-1
- USN-4526-1
- USN-4527-1
- USN-4527-1
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
Modified: 2024-11-21
CVE-2019-19816
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled.
- https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19816
- https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19816
- [debian-lts-announce] 20200928 [SECURITY] [DLA 2385-1] linux-4.19 security update
- [debian-lts-announce] 20200928 [SECURITY] [DLA 2385-1] linux-4.19 security update
- [debian-lts-announce] 20201210 [SECURITY] [DLA 2483-1] linux-4.19 security update
- [debian-lts-announce] 20201210 [SECURITY] [DLA 2483-1] linux-4.19 security update
- [debian-lts-announce] 20210309 [SECURITY] [DLA 2586-1] linux security update
- [debian-lts-announce] 20210309 [SECURITY] [DLA 2586-1] linux security update
- https://security.netapp.com/advisory/ntap-20200103-0001/
- https://security.netapp.com/advisory/ntap-20200103-0001/
- USN-4414-1
- USN-4414-1
Modified: 2024-11-21
CVE-2020-25220
The Linux kernel 4.9.x before 4.9.233, 4.14.x before 4.14.194, and 4.19.x before 4.19.140 has a use-after-free because skcd->no_refcnt was not considered during a backport of a CVE-2020-14356 patch. This is related to the cgroups feature.
- https://bugzilla.redhat.com/show_bug.cgi?id=1868453
- https://bugzilla.redhat.com/show_bug.cgi?id=1868453
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.194
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.194
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.140
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.140
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.233
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.233
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.14.y&id=82fd2138a5ffd7e0d4320cdb669e115ee976a26e
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.14.y&id=82fd2138a5ffd7e0d4320cdb669e115ee976a26e
- [debian-lts-announce] 20201030 [SECURITY] [DLA 2420-1] linux security update
- [debian-lts-announce] 20201030 [SECURITY] [DLA 2420-1] linux security update
- [debian-lts-announce] 20201031 [SECURITY] [DLA 2420-2] linux regression update
- [debian-lts-announce] 20201031 [SECURITY] [DLA 2420-2] linux regression update
- https://security.netapp.com/advisory/ntap-20201001-0004/
- https://security.netapp.com/advisory/ntap-20201001-0004/
- https://www.spinics.net/lists/stable/msg405099.html
- https://www.spinics.net/lists/stable/msg405099.html