SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:3507-1
Rating:             important
References:         #1058115 #1163592 #1167030 #1172873 #1175306 
                    #1175721 #1176855 #1176907 #1176983 #1177703 
                    #1177819 #1177820 #1178123 #1178393 #1178589 
                    #1178622 #1178686 #1178765 #1178782 #927455 
                    
Cross-References:   CVE-2020-25668 CVE-2020-25704 CVE-2020-25705
                   
Affected Products:
                    SUSE Linux Enterprise Workstation Extension 15-SP1
                    SUSE Linux Enterprise Module for Live Patching 15-SP1
                    SUSE Linux Enterprise Module for Legacy Software 15-SP1
                    SUSE Linux Enterprise Module for Development Tools 15-SP1
                    SUSE Linux Enterprise Module for Basesystem 15-SP1
                    SUSE Linux Enterprise High Availability 15-SP1
______________________________________________________________________________

   An update that solves three vulnerabilities and has 17
   fixes is now available.

Description:

   The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various
   security and bugfixes.


   The following security bugs were fixed:

   - CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was
     found that allowed to quickly scan open UDP ports. This flaw allowed an
     off-path remote user to effectively bypassing source port UDP
     randomization. The highest threat from this vulnerability is to
     confidentiality and possibly integrity, because software and services
     that rely on UDP source port randomization (like DNS) are indirectly
     affected as well. Kernel versions may be vulnerable to this issue
     (bsc#1175721, bsc#1178782).
   - CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter()
     (bsc#1178393).
   - CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).

   The following non-security bugs were fixed:

   - 9P: Cast to loff_t before multiplying (git-fixes).
   - acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
   - ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
   - ACPI: dock: fix enum-conversion warning (git-fixes).
   - ACPI / extlog: Check for RDMSR failure (git-fixes).
   - ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
   - ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
   - ALSA: hda - Fix the return value if cb func is already registered
     (git-fixes).
   - ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
     (git-fixes).
   - ata: sata_rcar: Fix DMA boundary mask (git-fixes).
   - ath10k: fix VHT NSS calculation when STBC is enabled (git-fixes).
   - ath10k: start recovery process when payload length exceeds max htc
     length for sdio (git-fixes).
   - bus/fsl_mc: Do not rely on caller to provide non NULL mc_io (git-fixes).
   - can: can_create_echo_skb(): fix echo skb generation: always use
     skb_clone() (git-fixes).
   - can: dev: __can_get_echo_skb(): fix real payload length return value for
     RTR frames (git-fixes).
   - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ
     context (git-fixes).
   - can: peak_canfd: pucan_handle_can_rx(): fix echo management when
     loopback is on (git-fixes).
   - can: peak_usb: add range checking in decode operations (git-fixes).
   - can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
     (git-fixes).
   - can: rx-offload: do not call kfree_skb() from IRQ context (git-fixes).
   - clk: ti: clockdomain: fix static checker warning (git-fixes).
   - crypto: bcm - Verify GCM/CCM key length in setkey (git-fixes).
   - device property: Do not clear secondary pointer for shared primary
     firmware node (git-fixes).
   - device property: Keep secondary firmware node secondary by type
     (git-fixes).
   - drbd: code cleanup by using sendpage_ok() to check page for
     kernel_sendpage() (bsc#1172873).
   - drm/amd/display: Do not invoke kgdb_breakpoint() unconditionally
     (git-fixes).
   - drm/amd/display: HDMI remote sink need mode validation for Linux
     (git-fixes).
   - drm/amdgpu: do not map BO in reserved region (git-fixes).
   - drm/bridge/synopsys: dsi: add support for non-continuous HS clock
     (git-fixes).
   - drm/brige/megachips: Add checking if ge_b850v3_lvds_init() is working
     correctly (git-fixes).
   - drm/i915: Break up error capture compression loops with cond_resched()
     (git-fixes).
   - drm/i915: Force VT'd workarounds when running as a guest OS (git-fixes).
   - drm/imx: tve remove extraneous type qualifier (git-fixes).
   - drm/ttm: fix eviction valuable range check (git-fixes).
   - drm/vc4: drv: Add error handding for bind (git-fixes).
   - efivarfs: Replace invalid slashes with exclamation marks in dentries
     (git-fixes).
   - ftrace: Fix recursion check for NMI test (git-fixes).
   - ftrace: Handle tracing when switching between context (git-fixes).
   - hv_netvsc: Add XDP support (bsc#1177819, bsc#1177820).
   - hv_netvsc: Fix XDP refcnt for synthetic and VF NICs (bsc#1177819,
     bsc#1177820).
   - hyperv_fb: Update screen_info after removing old framebuffer
     (bsc#1175306).
   - icmp: randomize the global rate limiter (git-fixes).
   - kthread_worker: prevent queuing delayed work from timer_fn when it is
     being canceled (git-fixes).
   - leds: bcm6328, bcm6358: use devres LED registering function (git-fixes).
   - libceph: use sendpage_ok() in ceph_tcp_sendpage() (bsc#1172873).
   - media: platform: Improve queue set up flow for bug fixing (git-fixes).
   - media: tw5864: check status of tw5864_frameinterval_get (git-fixes).
   - memcg: fix NULL pointer dereference in
     __mem_cgroup_usage_unregister_event (bsc#1177703).
   - mmc: sdhci-of-esdhc: Handle pulse width detection erratum for more SoCs
     (git-fixes).
   - mmc: sdhci-of-esdhc: set timeout to max before tuning (git-fixes).
   - mm/memcg: fix refcount error while moving and swapping (bsc#1178686).
   - Move the upstreamed powercap fix into sorted sectio
   - mtd: lpddr: Fix bad logic in print_drs_error (git-fixes).
   - net: add WARN_ONCE in kernel_sendpage() for improper zero-copy send
     (bsc#1172873).
   - net: introduce helper sendpage_ok() in include/linux/net.h (bsc#1172873).
   - net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition (git-fixes).
   - nvme-tcp: check page by sendpage_ok() before calling kernel_sendpage()
     (bsc#1172873).
   - p54: avoid accessing the data mapped to streaming DMA (git-fixes).
   - pinctrl: intel: Set default bias in case no particular value given
     (git-fixes).
   - powerpc/pseries/cpuidle: add polling idle for shared processor guests
     (bsc#1178765 ltc#188968).
   - powerpc/vnic: Extend "failover pending" window (bsc#1176855 ltc#187293).
   - power: supply: test_power: add missing newlines when printing parameters
     by sysfs (git-fixes).
   - regulator: defer probe when trying to get voltage from unresolved supply
     (git-fixes).
   - regulator: resolve supply after creating regulator (git-fixes).
   - ring-buffer: Fix recursion protection transitions between interrupt
     context (git-fixes).
   - rpm/kernel-module-subpackage: make Group tag optional (bsc#1163592)
   - scsi: libiscsi: use sendpage_ok() in iscsi_tcp_segment_map()
     (bsc#1172873).
   - staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice
     (git-fixes).
   - staging: octeon: Drop on uncorrectable alignment or FCS error
     (git-fixes).
   - staging: octeon: repair "fixed-link" support (git-fixes).
   - thunderbolt: Add the missed ida_simple_remove() in ring_request_msix()
     (git-fixes).
   - USB: Add NO_LPM quirk for Kingston flash drive (git-fixes).
   - USB: adutux: fix debugging (git-fixes).
   - usb: cdc-acm: fix cooldown mechanism (git-fixes).
   - usb: host: fsl-mph-dr-of: check return of dma_set_mask() (git-fixes).
   - usb: mtu3: fix panic in mtu3_gadget_stop() (git-fixes).
   - USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231
     (git-fixes).
   - USB: serial: option: add Quectel EC200T module support (git-fixes).
   - USB: serial: option: add Telit FN980 composition 0x1055 (git-fixes).
   - usb: typec: tcpm: During PR_SWAP, source caps should be sent only after
     tSwapSourceStart (git-fixes).
   - usb: typec: tcpm: reset hard_reset_count for any disconnect (git-fixes).
   - video: fbdev: pvr2fb: initialize variables (git-fixes).
   - video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host
     (bsc#1175306).
   - video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer
     driver (bsc#1175306).
   - video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1 VMs
     (bsc#1175306).
   - vt: Disable KD_FONT_OP_COPY (bsc#1178589).
   - x86/kexec: Use up-to-dated screen_info copy to fill boot params
     (bsc#1175306).
   - x86/unwind/orc: Fix inactive tasks with stack pointer in %sp on GCC 10
     compiled kernels (bsc#1058115 bsc#1176907).
   - xfs: do not update mtime on COW faults (bsc#1167030).
   - xfs: fix a missing unlock on error in xfs_fs_map_blocks (git-fixes).
   - xfs: fix flags argument to rmap lookup when converting shared file rmaps
     (git-fixes).
   - xfs: fix rmap key and record comparison functions (git-fixes).
   - xfs: flush new eof page on truncate to avoid post-eof corruption
     (git-fixes).


Special Instructions and Notes:

   Please reboot the system after installing this update.

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Workstation Extension 15-SP1:

      zypper in -t patch SUSE-SLE-Product-WE-15-SP1-2020-3507=1

   - SUSE Linux Enterprise Module for Live Patching 15-SP1:

      zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP1-2020-3507=1

   - SUSE Linux Enterprise Module for Legacy Software 15-SP1:

      zypper in -t patch SUSE-SLE-Module-Legacy-15-SP1-2020-3507=1

   - SUSE Linux Enterprise Module for Development Tools 15-SP1:

      zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP1-2020-3507=1

   - SUSE Linux Enterprise Module for Basesystem 15-SP1:

      zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2020-3507=1

   - SUSE Linux Enterprise High Availability 15-SP1:

      zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2020-3507=1



Package List:

   - SUSE Linux Enterprise Workstation Extension 15-SP1 (x86_64):

      kernel-default-debuginfo-4.12.14-197.72.1
      kernel-default-debugsource-4.12.14-197.72.1
      kernel-default-extra-4.12.14-197.72.1
      kernel-default-extra-debuginfo-4.12.14-197.72.1

   - SUSE Linux Enterprise Module for Live Patching 15-SP1 (ppc64le x86_64):

      kernel-default-debuginfo-4.12.14-197.72.1
      kernel-default-debugsource-4.12.14-197.72.1
      kernel-default-livepatch-4.12.14-197.72.1
      kernel-default-livepatch-devel-4.12.14-197.72.1
      kernel-livepatch-4_12_14-197_72-default-1-3.3.1

   - SUSE Linux Enterprise Module for Legacy Software 15-SP1 (aarch64 ppc64le s390x x86_64):

      kernel-default-debuginfo-4.12.14-197.72.1
      kernel-default-debugsource-4.12.14-197.72.1
      reiserfs-kmp-default-4.12.14-197.72.1
      reiserfs-kmp-default-debuginfo-4.12.14-197.72.1

   - SUSE Linux Enterprise Module for Development Tools 15-SP1 (aarch64 ppc64le s390x x86_64):

      kernel-obs-build-4.12.14-197.72.1
      kernel-obs-build-debugsource-4.12.14-197.72.1
      kernel-syms-4.12.14-197.72.1

   - SUSE Linux Enterprise Module for Development Tools 15-SP1 (noarch):

      kernel-docs-4.12.14-197.72.2
      kernel-source-4.12.14-197.72.1

   - SUSE Linux Enterprise Module for Basesystem 15-SP1 (aarch64 ppc64le s390x x86_64):

      kernel-default-4.12.14-197.72.1
      kernel-default-base-4.12.14-197.72.1
      kernel-default-base-debuginfo-4.12.14-197.72.1
      kernel-default-debuginfo-4.12.14-197.72.1
      kernel-default-debugsource-4.12.14-197.72.1
      kernel-default-devel-4.12.14-197.72.1
      kernel-default-devel-debuginfo-4.12.14-197.72.1

   - SUSE Linux Enterprise Module for Basesystem 15-SP1 (noarch):

      kernel-devel-4.12.14-197.72.1
      kernel-macros-4.12.14-197.72.1

   - SUSE Linux Enterprise Module for Basesystem 15-SP1 (s390x):

      kernel-default-man-4.12.14-197.72.1
      kernel-zfcpdump-debuginfo-4.12.14-197.72.1
      kernel-zfcpdump-debugsource-4.12.14-197.72.1

   - SUSE Linux Enterprise High Availability 15-SP1 (aarch64 ppc64le s390x x86_64):

      cluster-md-kmp-default-4.12.14-197.72.1
      cluster-md-kmp-default-debuginfo-4.12.14-197.72.1
      dlm-kmp-default-4.12.14-197.72.1
      dlm-kmp-default-debuginfo-4.12.14-197.72.1
      gfs2-kmp-default-4.12.14-197.72.1
      gfs2-kmp-default-debuginfo-4.12.14-197.72.1
      kernel-default-debuginfo-4.12.14-197.72.1
      kernel-default-debugsource-4.12.14-197.72.1
      ocfs2-kmp-default-4.12.14-197.72.1
      ocfs2-kmp-default-debuginfo-4.12.14-197.72.1


References:

   https://www.suse.com/security/cve/CVE-2020-25668.html
   https://www.suse.com/security/cve/CVE-2020-25704.html
   https://www.suse.com/security/cve/CVE-2020-25705.html
   https://bugzilla.suse.com/1058115
   https://bugzilla.suse.com/1163592
   https://bugzilla.suse.com/1167030
   https://bugzilla.suse.com/1172873
   https://bugzilla.suse.com/1175306
   https://bugzilla.suse.com/1175721
   https://bugzilla.suse.com/1176855
   https://bugzilla.suse.com/1176907
   https://bugzilla.suse.com/1176983
   https://bugzilla.suse.com/1177703
   https://bugzilla.suse.com/1177819
   https://bugzilla.suse.com/1177820
   https://bugzilla.suse.com/1178123
   https://bugzilla.suse.com/1178393
   https://bugzilla.suse.com/1178589
   https://bugzilla.suse.com/1178622
   https://bugzilla.suse.com/1178686
   https://bugzilla.suse.com/1178765
   https://bugzilla.suse.com/1178782
   https://bugzilla.suse.com/927455