Errata ALT-PU-2019-2086-1: Information
Package name: kernel-image-std-def
Version: 4.9.181-alt0.M80P.1
Bulletin updated: June 18, 2019
Task: #232429
Fixes
Published: June 17, 2019
BDU:2019-02194
Уязвимость механизма TCP Selective Acknowledgement ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5) Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Links:
Published: June 15, 2019
BDU:2019-02195
Уязвимость механизма TCP Selective Acknowledgement ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5) Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Links:
Published: June 15, 2019
BDU:2019-02196
Уязвимость ядра операционной системы Linux, вызванная ошибками при обработке сегментов минимального размера, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5) Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Links:
Published: April 11, 2019
BDU:2019-02763
Уязвимость в файлах fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, mm/hugetlb.c ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Severity: HIGH (7.8) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
Published: Feb. 19, 2019
BDU:2020-02044
Уязвимость функции brcmf_wowl_nd_results драйвер Broadcom brcmfmac WiFi ядра операционной системы Linux, позволяющая нарушителю получить несанкционированный доступ к информации и нарушить ее целостность и доступность
Severity: HIGH (8.3) Vector: AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Links:
Published: June 19, 2019
Modified: Feb. 28, 2024
Modified: Feb. 28, 2024
CVE-2019-11477
Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.
Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Links:
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md
- https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic
- https://access.redhat.com/security/vulnerabilities/tcpsack
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=3b4929f65b0d8249f19a50245cd88ed1a2f78cff
- https://support.f5.com/csp/article/K78234183
- http://packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.html
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193
- VU#905115
- [oss-security] 20190620 Re: Linux and FreeBSD Kernel: Multiple TCP-based remote denial of service issues
- https://www.synology.com/security/advisory/Synology_SA_19_28
- https://security.netapp.com/advisory/ntap-20190625-0001/
- RHSA-2019:1594
- RHSA-2019:1602
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0006
- https://kc.mcafee.com/corporate/index?page=content&id=SB10287
- [oss-security] 20190628 Re: linux-distros membership application - Microsoft
- http://www.vmware.com/security/advisories/VMSA-2019-0010.html
- [oss-security] 20190706 Re: linux-distros membership application - Microsoft
- [oss-security] 20190706 Re: linux-distros membership application - Microsoft
- RHSA-2019:1699
- https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf
- https://www.us-cert.gov/ics/advisories/icsa-19-253-03
- http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
- [oss-security] 20191023 Membership application for linux-distros - VMware
- [oss-security] 20191029 Re: Membership application for linux-distros - VMware
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191225-01-kernel-en
- https://www.oracle.com/security-alerts/cpujan2020.html
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-010.txt
- https://www.oracle.com/security-alerts/cpuoct2020.html
Published: June 19, 2019
Modified: Feb. 28, 2024
Modified: Feb. 28, 2024
CVE-2019-11478
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.
Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Links:
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=f070ef2ac66716357066b683fb0baf55f8191a2e
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md
- https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic
- https://access.redhat.com/security/vulnerabilities/tcpsack
- https://support.f5.com/csp/article/K26618426
- http://packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.html
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193
- VU#905115
- https://www.synology.com/security/advisory/Synology_SA_19_28
- https://security.netapp.com/advisory/ntap-20190625-0001/
- RHSA-2019:1594
- RHSA-2019:1602
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0007
- https://kc.mcafee.com/corporate/index?page=content&id=SB10287
- [oss-security] 20190628 Re: linux-distros membership application - Microsoft
- http://www.vmware.com/security/advisories/VMSA-2019-0010.html
- [oss-security] 20190706 Re: linux-distros membership application - Microsoft
- [oss-security] 20190706 Re: linux-distros membership application - Microsoft
- RHSA-2019:1699
- 20190722 [SECURITY] [DSA 4484-1] linux security update
- http://packetstormsecurity.com/files/154408/Kernel-Live-Patch-Security-Notice-LSN-0055-1.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf
- https://www.us-cert.gov/ics/advisories/icsa-19-253-03
- http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
- [oss-security] 20191023 Membership application for linux-distros - VMware
- [oss-security] 20191029 Re: Membership application for linux-distros - VMware
- https://www.oracle.com/security-alerts/cpujan2020.html
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-010.txt
- https://www.oracle.com/security-alerts/cpuoct2020.html
Published: June 19, 2019
Modified: Nov. 7, 2023
Modified: Nov. 7, 2023
CVE-2019-11479
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.
Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Links:
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5f3e2bf008c2221478101ee72f5cb4654b9fc363
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md
- https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=967c05aee439e6e5d7d805e195b3a20ef5c433d6
- https://access.redhat.com/security/vulnerabilities/tcpsack
- https://support.f5.com/csp/article/K35421172
- 108818
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193
- VU#905115
- https://www.synology.com/security/advisory/Synology_SA_19_28
- https://security.netapp.com/advisory/ntap-20190625-0001/
- RHSA-2019:1594
- RHSA-2019:1602
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0008
- https://kc.mcafee.com/corporate/index?page=content&id=SB10287
- [oss-security] 20190628 Re: linux-distros membership application - Microsoft
- USN-4041-2
- [oss-security] 20190706 Re: linux-distros membership application - Microsoft
- [oss-security] 20190706 Re: linux-distros membership application - Microsoft
- RHSA-2019:1699
- USN-4041-1
- https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf
- https://www.us-cert.gov/ics/advisories/icsa-19-253-03
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.us-cert.gov/ics/advisories/icsma-20-170-06
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-010.txt
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://support.f5.com/csp/article/K35421172?utm_source=f5support&amp%3Butm_medium=RSS
Published: April 24, 2019
Modified: Feb. 24, 2023
Modified: Feb. 24, 2023
CVE-2019-11487
The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests.
Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links:
- https://lwn.net/Articles/786044/
- https://github.com/torvalds/linux/commit/f958d7b528b1b40c44cfda5eabe2d82760d868c3
- https://github.com/torvalds/linux/commit/8fde12ca79aff9b5ba951fce1a2641901b8d8e64
- https://github.com/torvalds/linux/commit/88b1a17dfc3ed7728316478fae0f5ad508f50397
- https://github.com/torvalds/linux/commit/6b3a707736301c2128ca85ce85fb13f60b5e350a
- https://github.com/torvalds/linux/commit/15fab63e1e57be9fdb5eec1bbc5916e9825e9acb
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f958d7b528b1b40c44cfda5eabe2d82760d868c3
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8fde12ca79aff9b5ba951fce1a2641901b8d8e64
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=88b1a17dfc3ed7728316478fae0f5ad508f50397
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6b3a707736301c2128ca85ce85fb13f60b5e350a
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=15fab63e1e57be9fdb5eec1bbc5916e9825e9acb
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1752
- 108054
- [oss-security] 20190429 Linux kernel: multiple issues
- https://security.netapp.com/advisory/ntap-20190517-0005/
- openSUSE-SU-2019:1570
- openSUSE-SU-2019:1571
- openSUSE-SU-2019:1579
- https://support.f5.com/csp/article/K14255532
- USN-4069-1
- USN-4069-2
- USN-4115-1
- USN-4118-1
- RHSA-2019:2703
- RHSA-2019:2741
- [debian-lts-announce] 20190914 [SECURITY] [DLA 1919-1] linux-4.9 security update
- [debian-lts-announce] 20190915 [SECURITY] [DLA 1919-2] linux-4.9 security update
- USN-4145-1
- RHSA-2020:0174
- https://www.oracle.com/security-alerts/cpuApr2021.html
Published: Jan. 17, 2020
Modified: Jan. 19, 2023
Modified: Jan. 19, 2023
CVE-2019-9500
The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.
Severity: HIGH (8.3) Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Links: