openSUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2020:2034-1
Rating:             important
References:         #1050549 #1067665 #1170630 #1172873 #1175306 
                    #1175721 #1176855 #1176983 #1177397 #1177703 
                    #1177819 #1177820 #1178182 #1178393 #1178589 
                    #1178686 #1178765 #1178782 #1178838 #1178853 
                    #1178854 #1178878 #1178886 #927455 
Cross-References:   CVE-2020-25669 CVE-2020-25704 CVE-2020-25705
                    CVE-2020-28915
Affected Products:
                    openSUSE Leap 15.1
______________________________________________________________________________

   An update that solves four vulnerabilities and has 20 fixes
   is now available.

Description:



   The openSUSE Leap 15.1 kernel was updated to receive various security and
   bugfixes.

   The following security bugs were fixed:

   - CVE-2020-28915: A buffer over-read (at the framebuffer layer) in the
     fbcon code could be used by local attackers to read kernel memory, aka
     CID-6735b4632def (bnc#1178886).
   - CVE-2020-25669: A use-after-free in teardown paths of sunkbd was fixed
     (bsc#1178182).
   - CVE-2020-25705: A flaw in the way reply ICMP packets are limited in the
     Linux kernel functionality was found that allowed to quickly scan open
     UDP ports. This flaw allowed an off-path remote user to effectively
     bypassing source port UDP randomization. The highest threat from this
     vulnerability is to confidentiality and possibly integrity, because
     software that relies on UDP source port randomization are indirectly
     affected as well. Kernel versions may be vulnerable to this issue
     (bnc#1175721 bnc#1178782).
   - CVE-2020-25704: A a memory leak in perf_event_parse_addr_filter() was
     foxed (bsc#1178393, CVE-2020-25704).

   The following non-security bugs were fixed:

   - ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
   - bpf: Zero-fill re-used per-cpu map element (git-fixes).
   - can: af_can: prevent potential access of uninitialized member in
     canfd_rcv() (git-fixes).
   - can: af_can: prevent potential access of uninitialized member in
     can_rcv() (git-fixes).
   - can: dev: can_restart(): post buffer from the right context (git-fixes).
   - can: m_can: m_can_handle_state_change(): fix state change (git-fixes).
   - can: m_can: m_can_stop(): set device to software init mode before
     closing (git-fixes).
   - can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to
     can_put_echo_skb() (git-fixes).
   - can: peak_usb: fix potential integer overflow on shift of a int
     (git-fixes).
   - docs: ABI: sysfs-c2port: remove a duplicated entry (git-fixes).
   - drbd: code cleanup by using sendpage_ok() to check page for
     kernel_sendpage() (bsc#1172873).
   - drm/i915: Break up error capture compression loops with cond_resched()
     (git-fixes).
   - drm/vc4: drv: Add error handding for bind (git-fixes).
   - Drop sysctl files for dropped archs, add ppc64le and arm64
     (bsc#1178838). Also fix the ppc64 page size.
   - fs/proc/array.c: allow reporting eip/esp for all coredumping threads
     (bsc#1050549).
   - ftrace: Fix recursion check for NMI test (git-fixes).
   - ftrace: Handle tracing when switching between context (git-fixes).
   - futex: Do not enable IRQs unconditionally in put_pi_state()
     (bsc#1067665).
   - futex: Handle transient "ownerless" rtmutex state correctly
     (bsc#1067665).
   - hv_netvsc: Add XDP support (bsc#1177819, bsc#1177820).
   - hv_netvsc: deal with bpf API differences in 4.12 (bsc#1177819,
     bsc#1177820).
   - hv_netvsc: Fix XDP refcnt for synthetic and VF NICs (bsc#1177819,
     bsc#1177820).
   - hv_netvsc: make recording RSS hash depend on feature flag (bsc#1178853,
     bsc#1178854).
   - hv_netvsc: record hardware hash in skb (bsc#1178853, bsc#1178854).
   - hyperv_fb: Update screen_info after removing old framebuffer
     (bsc#1175306).
   - inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()
     (git-fixes).
   - Input: adxl34x - clean up a data type in adxl34x_probe() (git-fixes).
   - kthread_worker: prevent queuing delayed work from timer_fn when it is
     being canceled (git-fixes).
   - libceph: use sendpage_ok() in ceph_tcp_sendpage() (bsc#1172873).
   - locking/lockdep: Add debug_locks check in __lock_downgrade()
     (bsc#1050549).
   - locking/percpu-rwsem: Use this_cpu_{inc,dec}() for read_count
     (bsc#1050549).
   - locktorture: Print ratio of acquisitions, not failures (bsc#1050549).
   - mac80211: minstrel: fix tx status processing corner case (git-fixes).
   - mac80211: minstrel: remove deferred sampling code (git-fixes).
   - memcg: fix NULL pointer dereference in
     __mem_cgroup_usage_unregister_event (bsc#1177703).
   - mmc: sdhci-of-esdhc: Handle pulse width detection erratum for more SoCs
     (git-fixes).
   - mm/memcg: fix refcount error while moving and swapping (bsc#1178686).
   - net: add WARN_ONCE in kernel_sendpage() for improper zero-copy send
     (bsc#1172873).
   - net: ena: Capitalize all log strings and improve code readability
     (bsc#1177397).
   - net: ena: Change license into format to SPDX in all files (bsc#1177397).
   - net: ena: Change log message to netif/dev function (bsc#1177397).
   - net: ena: Change RSS related macros and variables names (bsc#1177397).
   - net: ena: ethtool: Add new device statistics (bsc#1177397).
   - net: ena: ethtool: add stats printing to XDP queues (bsc#1177397).
   - net: ena: ethtool: convert stat_offset to 64 bit resolution
     (bsc#1177397).
   - net: ena: Fix all static chekers' warnings (bsc#1177397).
   - net: ena: Remove redundant print of placement policy (bsc#1177397).
   - net: ena: xdp: add queue counters for xdp actions (bsc#1177397).
   - netfilter: nat: can't use dst_hold on noref dst (bsc#1178878).
   - net: introduce helper sendpage_ok() in include/linux/net.h
     (bsc#1172873). kABI workaround for including mm.h in include/linux/net.h
     (bsc#1172873).
   - net/mlx4_core: Fix init_hca fields offset (git-fixes).
   - net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition (git-fixes).
   - NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION
     (bsc#1170630).
   - nvme-tcp: check page by sendpage_ok() before calling kernel_sendpage()
     (bsc#1172873).
   - pinctrl: intel: Set default bias in case no particular value given
     (git-fixes).
   - powerpc/pseries/cpuidle: add polling idle for shared processor guests
     (bsc#1178765 ltc#188968).
   - powerpc/vnic: Extend "failover pending" window (bsc#1176855 ltc#187293).
   - powerpc/vnic: Extend "failover pending" window (bsc#1176855 ltc#187293).
   - regulator: avoid resolve_supply() infinite recursion (git-fixes).
   - regulator: fix memory leak with repeated set_machine_constraints()
     (git-fixes).
   - regulator: ti-abb: Fix array out of bound read access on the first
     transition (git-fixes).
   - regulator: workaround self-referent regulators (git-fixes).
   - Revert "cdc-acm: hardening against malicious devices" (git-fixes).
   - ring-buffer: Fix recursion protection transitions between interrupt
     context (git-fixes).
   - scsi: libiscsi: use sendpage_ok() in iscsi_tcp_segment_map()
     (bsc#1172873).
   - scsi: lpfc: Fix initial FLOGI failure due to BBSCN not supported
     (git-fixes).
   - thunderbolt: Add the missed ida_simple_remove() in ring_request_msix()
     (git-fixes).
   - time: Prevent undefined behaviour in timespec64_to_ns() (git-fixes).
   - USB: Add NO_LPM quirk for Kingston flash drive (git-fixes).
   - usb: core: driver: fix stray tabs in error messages (git-fixes).
   - usb: host: ehci-tegra: Fix error handling in tegra_ehci_probe()
     (git-fixes).
   - USB: serial: cyberjack: fix write-URB completion race (git-fixes).
   - USB: serial: ftdi_sio: add support for FreeCalypso JTAG+UART adapters
     (git-fixes).
   - USB: serial: option: add Cellient MPL200 card (git-fixes).
   - USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231
     (git-fixes).
   - USB: serial: option: add Quectel EC200T module support (git-fixes).
   - USB: serial: option: add Telit FN980 composition 0x1055 (git-fixes).
   - USB: serial: option: Add Telit FT980-KS composition (git-fixes).
   - USB: serial: pl2303: add device-id for HP GC device (git-fixes).
   - video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host
     (bsc#1175306).
   - video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer
     driver (bsc#1175306).
   - video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1 VMs
     (bsc#1175306).
   - vt: Disable KD_FONT_OP_COPY (bsc#1178589).
   - x86/kexec: Use up-to-dated screen_info copy to fill boot params
     (bsc#1175306).
   - xfs: fix a missing unlock on error in xfs_fs_map_blocks (git-fixes).
   - xfs: fix flags argument to rmap lookup when converting shared file rmaps
     (git-fixes).
   - xfs: fix rmap key and record comparison functions (git-fixes).


Special Instructions and Notes:

   Please reboot the system after installing this update.

Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.1:

      zypper in -t patch openSUSE-2020-2034=1



Package List:

   - openSUSE Leap 15.1 (noarch):

      kernel-devel-4.12.14-lp151.28.83.1
      kernel-docs-4.12.14-lp151.28.83.1
      kernel-docs-html-4.12.14-lp151.28.83.1
      kernel-macros-4.12.14-lp151.28.83.1
      kernel-source-4.12.14-lp151.28.83.1
      kernel-source-vanilla-4.12.14-lp151.28.83.1

   - openSUSE Leap 15.1 (x86_64):

      kernel-debug-4.12.14-lp151.28.83.1
      kernel-debug-base-4.12.14-lp151.28.83.1
      kernel-debug-base-debuginfo-4.12.14-lp151.28.83.1
      kernel-debug-debuginfo-4.12.14-lp151.28.83.1
      kernel-debug-debugsource-4.12.14-lp151.28.83.1
      kernel-debug-devel-4.12.14-lp151.28.83.1
      kernel-debug-devel-debuginfo-4.12.14-lp151.28.83.1
      kernel-default-4.12.14-lp151.28.83.1
      kernel-default-base-4.12.14-lp151.28.83.1
      kernel-default-base-debuginfo-4.12.14-lp151.28.83.1
      kernel-default-debuginfo-4.12.14-lp151.28.83.1
      kernel-default-debugsource-4.12.14-lp151.28.83.1
      kernel-default-devel-4.12.14-lp151.28.83.1
      kernel-default-devel-debuginfo-4.12.14-lp151.28.83.1
      kernel-kvmsmall-4.12.14-lp151.28.83.1
      kernel-kvmsmall-base-4.12.14-lp151.28.83.1
      kernel-kvmsmall-base-debuginfo-4.12.14-lp151.28.83.1
      kernel-kvmsmall-debuginfo-4.12.14-lp151.28.83.1
      kernel-kvmsmall-debugsource-4.12.14-lp151.28.83.1
      kernel-kvmsmall-devel-4.12.14-lp151.28.83.1
      kernel-kvmsmall-devel-debuginfo-4.12.14-lp151.28.83.1
      kernel-obs-build-4.12.14-lp151.28.83.1
      kernel-obs-build-debugsource-4.12.14-lp151.28.83.1
      kernel-obs-qa-4.12.14-lp151.28.83.1
      kernel-syms-4.12.14-lp151.28.83.1
      kernel-vanilla-4.12.14-lp151.28.83.1
      kernel-vanilla-base-4.12.14-lp151.28.83.1
      kernel-vanilla-base-debuginfo-4.12.14-lp151.28.83.1
      kernel-vanilla-debuginfo-4.12.14-lp151.28.83.1
      kernel-vanilla-debugsource-4.12.14-lp151.28.83.1
      kernel-vanilla-devel-4.12.14-lp151.28.83.1
      kernel-vanilla-devel-debuginfo-4.12.14-lp151.28.83.1


References:

   https://www.suse.com/security/cve/CVE-2020-25669.html
   https://www.suse.com/security/cve/CVE-2020-25704.html
   https://www.suse.com/security/cve/CVE-2020-25705.html
   https://www.suse.com/security/cve/CVE-2020-28915.html
   https://bugzilla.suse.com/1050549
   https://bugzilla.suse.com/1067665
   https://bugzilla.suse.com/1170630
   https://bugzilla.suse.com/1172873
   https://bugzilla.suse.com/1175306
   https://bugzilla.suse.com/1175721
   https://bugzilla.suse.com/1176855
   https://bugzilla.suse.com/1176983
   https://bugzilla.suse.com/1177397
   https://bugzilla.suse.com/1177703
   https://bugzilla.suse.com/1177819
   https://bugzilla.suse.com/1177820
   https://bugzilla.suse.com/1178182
   https://bugzilla.suse.com/1178393
   https://bugzilla.suse.com/1178589
   https://bugzilla.suse.com/1178686
   https://bugzilla.suse.com/1178765
   https://bugzilla.suse.com/1178782
   https://bugzilla.suse.com/1178838
   https://bugzilla.suse.com/1178853
   https://bugzilla.suse.com/1178854
   https://bugzilla.suse.com/1178878
   https://bugzilla.suse.com/1178886
   https://bugzilla.suse.com/927455
_______________________________________________
openSUSE Security Announce mailing list -- [email protected]
To unsubscribe, email [email protected]
List Netiquette: https://en.opensuse.org/openSUSE:Mailing_list_netiquette
List Archives: https://lists.opensuse.org/archives/list/[email protected]