ALT-PU-2020-1673-1
Package kernel-image-rpi-un updated to version 5.6.2-alt2 for branch p9 in task 249505.
Closed vulnerabilities
BDU:2020-02134
Уязвимость функций ov511_mode_init_regs и ov518_mode_init_regs ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-02136
Уязвимость USB-драйвера камеры Xirlink (drivers/media/usb/gspca/xirlink_cit.c) ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на целостность защищаемой информации и вызвать отказ в обслуживании
BDU:2020-02416
Уязвимость подсистемы stv06xx ядра операционных систем Linux, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-05727
Уязвимость компонента kernel/bpf/verifier.c ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2022-04677
Уязвимость реализации вызова VT_DISALLOCATE ядра операционных систем Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-11608
An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d.
- openSUSE-SU-2020:0801
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=998912346c0da53a6dbb71fab3a138586b596b30
- https://github.com/torvalds/linux/commit/998912346c0da53a6dbb71fab3a138586b596b30
- [debian-lts-announce] 20200609 [SECURITY] [DLA 2241-1] linux security update
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2242-1] linux-4.9 security update
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2241-2] linux security update
- https://security.netapp.com/advisory/ntap-20200430-0004/
- USN-4345-1
- USN-4364-1
- USN-4368-1
- USN-4369-1
- DSA-4698
- openSUSE-SU-2020:0801
- DSA-4698
- USN-4369-1
- USN-4368-1
- USN-4364-1
- USN-4345-1
- https://security.netapp.com/advisory/ntap-20200430-0004/
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2241-2] linux security update
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2242-1] linux-4.9 security update
- [debian-lts-announce] 20200609 [SECURITY] [DLA 2241-1] linux security update
- https://github.com/torvalds/linux/commit/998912346c0da53a6dbb71fab3a138586b596b30
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=998912346c0da53a6dbb71fab3a138586b596b30
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1
Modified: 2024-11-21
CVE-2020-11609
An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93.
- openSUSE-SU-2020:0801
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=485b06aadb933190f4bc44e006076bc27a23f205
- https://github.com/torvalds/linux/commit/485b06aadb933190f4bc44e006076bc27a23f205
- [debian-lts-announce] 20200609 [SECURITY] [DLA 2241-1] linux security update
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2242-1] linux-4.9 security update
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2241-2] linux security update
- https://security.netapp.com/advisory/ntap-20200430-0004/
- USN-4345-1
- USN-4364-1
- USN-4368-1
- USN-4369-1
- DSA-4698
- openSUSE-SU-2020:0801
- DSA-4698
- USN-4369-1
- USN-4368-1
- USN-4364-1
- USN-4345-1
- https://security.netapp.com/advisory/ntap-20200430-0004/
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2241-2] linux security update
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2242-1] linux-4.9 security update
- [debian-lts-announce] 20200609 [SECURITY] [DLA 2241-1] linux security update
- https://github.com/torvalds/linux/commit/485b06aadb933190f4bc44e006076bc27a23f205
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=485b06aadb933190f4bc44e006076bc27a23f205
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1
Modified: 2024-11-21
CVE-2020-11668
In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a246b4d547708f33ff4d4b9a7a5dbac741dc89d8
- https://github.com/torvalds/linux/commit/a246b4d547708f33ff4d4b9a7a5dbac741dc89d8
- [debian-lts-announce] 20200609 [SECURITY] [DLA 2241-1] linux security update
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2242-1] linux-4.9 security update
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2241-2] linux security update
- https://security.netapp.com/advisory/ntap-20200430-0004/
- USN-4345-1
- USN-4364-1
- USN-4368-1
- USN-4369-1
- DSA-4698
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1
- DSA-4698
- USN-4369-1
- USN-4368-1
- USN-4364-1
- USN-4345-1
- https://security.netapp.com/advisory/ntap-20200430-0004/
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2241-2] linux security update
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2242-1] linux-4.9 security update
- [debian-lts-announce] 20200609 [SECURITY] [DLA 2241-1] linux security update
- https://github.com/torvalds/linux/commit/a246b4d547708f33ff4d4b9a7a5dbac741dc89d8
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a246b4d547708f33ff4d4b9a7a5dbac741dc89d8
Modified: 2024-11-21
CVE-2020-36557
A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free.
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.2
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.2
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ca4463bf8438b403596edd0ec961ca0d4fbe0220
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ca4463bf8438b403596edd0ec961ca0d4fbe0220
Modified: 2024-11-21
CVE-2020-8835
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
- [oss-security] 20210720 CVE-2021-33909: size_t-to-int vulnerability in Linux's filesystem layer
- [oss-security] 20210720 CVE-2021-33909: size_t-to-int vulnerability in Linux's filesystem layer
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fef
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fef
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fef
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fef
- FEDORA-2020-4ef0bcc89c
- FEDORA-2020-4ef0bcc89c
- FEDORA-2020-73c00eda1c
- FEDORA-2020-73c00eda1c
- FEDORA-2020-666f3b1ac3
- FEDORA-2020-666f3b1ac3
- https://lore.kernel.org/bpf/20200330160324.15259-1-daniel%40iogearbox.net/T/
- https://lore.kernel.org/bpf/20200330160324.15259-1-daniel%40iogearbox.net/T/
- https://security.netapp.com/advisory/ntap-20200430-0004/
- https://security.netapp.com/advisory/ntap-20200430-0004/
- USN-4313-1
- USN-4313-1
- https://usn.ubuntu.com/usn/usn-4313-1
- https://usn.ubuntu.com/usn/usn-4313-1
- https://www.openwall.com/lists/oss-security/2020/03/30/3
- https://www.openwall.com/lists/oss-security/2020/03/30/3
- https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-results
- https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-results