RHSA-2020:4431: Moderate: kernel security, bug fix, and enhancement update

First published: Tue Nov 03 2020(Updated: )

The kernel packages contain the Linux kernel, the core of any Linux operating system.<br>Security Fix(es):<br><li> kernel: use after free in the video driver leads to local privilege escalation (CVE-2019-9458)</li> <li> kernel: use-after-free in drivers/bluetooth/hci_ldisc.c (CVE-2019-15917)</li> <li> kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg (CVE-2019-15925)</li> <li> kernel: memory leak in ccp_run_sha_cmd() (CVE-2019-18808)</li> <li> kernel: Denial Of Service in the __ipmi_bmc_register() (CVE-2019-19046)</li> <li> kernel: out-of-bounds write in ext4_xattr_set_entry (CVE-2019-19319)</li> <li> Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid (CVE-2019-19332)</li> <li> kernel: use-after-free in ext4_put_super (CVE-2019-19447)</li> <li> kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free (CVE-2019-19524)</li> <li> kernel: race condition caused by a malicious USB device in the USB character device driver layer (CVE-2019-19537)</li> <li> kernel: use-after-free in serial_ir_init_module() (CVE-2019-19543)</li> <li> kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry (CVE-2019-19767)</li> <li> kernel: use-after-free in debugfs_remove (CVE-2019-19770)</li> <li> kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)</li> <li> kernel: possible use-after-free due to a race condition in cdev_get (CVE-2020-0305)</li> <li> kernel: out-of-bounds read in in vc_do_resize function (CVE-2020-8647)</li> <li> kernel: use-after-free in n_tty_receive_buf_common function (CVE-2020-8648)</li> <li> kernel: invalid read location in vgacon_invert_region function (CVE-2020-8649)</li> <li> kernel: uninitialized kernel data leak in userspace coredumps (CVE-2020-10732)</li> <li> kernel: SELinux netlink permission check bypass (CVE-2020-10751)</li> <li> kernel: out-of-bounds write in mpol_parse_str (CVE-2020-11565)</li> <li> kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c (CVE-2020-11668)</li> <li> kernel: buffer overflow in mt76_add_fragment function (CVE-2020-12465)</li> <li> kernel: xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write which could result in crash and data coruption (CVE-2020-12659)</li> <li> kernel: sg_write function lacks an sg_remove_request call in a certain failure case (CVE-2020-12770)</li> <li> kernel: possible to send arbitrary signals to a privileged (suidroot) parent process (CVE-2020-12826)</li> <li> kernel: referencing inode of removed superblock in get_futex_key() causes UAF (CVE-2020-14381)</li> <li> kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS (CVE-2020-25641)</li> <li> kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information disclosure (CVE-2019-9455)</li> <li> kernel: null pointer dereference in dlpar_parse_cc_property (CVE-2019-12614)</li> <li> kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c (CVE-2019-16231)</li> <li> kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c (CVE-2019-16233)</li> <li> kernel: memory leak in af9005_identify_state() function (CVE-2019-18809)</li> <li> kernel: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function (CVE-2019-19056)</li> <li> kernel: memory leak in the crypto_report() function (CVE-2019-19062)</li> <li> kernel: Two memory leaks in the rtl_usb_probe() function (CVE-2019-19063)</li> <li> kernel: A memory leak in the rtl8xxxu_submit_int_urb() function (CVE-2019-19068)</li> <li> kernel: A memory leak in the predicate_parse() function (CVE-2019-19072)</li> <li> kernel: information leak bug caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c (CVE-2019-19533)</li> <li> kernel: Null pointer dereference in drop_sysctl_table() (CVE-2019-20054)</li> <li> kernel: kernel stack information leak on s390/s390x (CVE-2020-10773)</li> <li> kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features (CVE-2020-10774)</li> <li> kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field (CVE-2020-10942)</li> <li> kernel: sync of excessive duration via an XFS v5 image with crafted metadata (CVE-2020-12655)</li>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/severity
• agent/type
• agent/softwarecombine
• agent/weakness
• agent/last-modified-date
• agent/first-publish-date
• agent/event
• agent/title
• agent/references
• agent/description
• agent/tags
• agent/remedy
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2020:4431
• agent/software-canonical-lookup
• package-manager/redhat