QID 174729

The SUSE Linux Enterprise 15 GA LTSS kernel was updated to receive various
security and bugfixes.

The following security bugs were fixed:

- CVE-2020-0305: In cdev_get of char_dev.c, there is a possible
use-after-free due to a race condition. This could lead to local
escalation of privilege with System execution privileges needed. User
interaction is not needed for exploitation (bnc#1174462).
- CVE-2019-20908: An issue was discovered in drivers/firmware/efi/efi.c
where incorrect access permissions for the efivar_ssdt ACPI variable
could be used by attackers to bypass lockdown or secure boot
restrictions, aka CID-1957a85b0032 (bnc#1173567).
- CVE-2020-15780: An issue was discovered in drivers/acpi/acpi_configfs.c
where injection of malicious ACPI tables via configfs could be used by
attackers to bypass lockdown and secure boot restrictions, aka
CID-75b0cea7bf30 (bnc#1173573).
- CVE-2020-15393: usbtest_disconnect in drivers/usb/misc/usbtest.c had a
memory leak, aka CID-28ebeb8db770 (bnc#1173514).
- CVE-2020-12771: btree_gc_coalesce in drivers/md/bcache/btree.c has a
deadlock if a coalescing operation fails (bnc#1171732).
- CVE-2019-16746: An issue was discovered in net/wireless/nl80211.c which
did not check the length of variable elements in a beacon head, leading
to a buffer overflow (bnc#1152107 1173659).
- CVE-2020-12888: The VFIO PCI driver mishandled attempts to access
disabled memory space (bnc#1171868).
- CVE-2020-10769: A buffer over-read flaw was found in
crypto_authenc_extractkeys in crypto/authenc.c in the IPsec
Cryptographic algorithm's module, authenc. When a payload longer than 4
bytes, and is not following 4-byte alignment boundary guidelines, it
causes a buffer over-read threat, leading to a system crash. This flaw
allowed a local attacker with user privileges to cause a denial of
service (bnc#1173265).
- CVE-2020-10773: A kernel stack information leak on s390/s390x was fixed
(bnc#1172999).
- CVE-2020-14416: A race condition in tty->disc_data handling in the slip
and slcan line discipline could lead to a use-after-free, aka
CID-0ace17d56824. This affects drivers/net/slip/slip.c and
drivers/net/can/slcan.c (bnc#1162002).
- CVE-2020-10768: Indirect branch speculation could have been enabled
after it was force-disabled by the PR_SPEC_FORCE_DISABLE prctl command.
(bnc#1172783).
- CVE-2020-10766: Fixed Rogue cross-process SSBD shutdown, where a Linux
scheduler logical bug allows an attacker to turn off the SSBD
protection. (bnc#1172781).
- CVE-2020-10767: Indirect Branch Prediction Barrier was force-disabled
when STIBP is unavailable or enhanced IBRS is available. (bnc#1172782).
- CVE-2020-13974: drivers/tty/vt/keyboard.c had an integer overflow if
k_ascii is called several times in a row, aka CID-b86dab054059
(bnc#1172775).

The following non-security bugs were fixed:

- Merge ibmvnic reset fixes (bsc#1158755 ltc#182094).
- block, bfq: add requeue-request hook (bsc#1104967 bsc#1171673).
- block, bfq: postpone rq preparation to insert or merge (bsc#1104967
bsc#1171673).
- ibmvnic: Do not process device remove during device reset (bsc#1065729).
- ibmvnic: Flush existing work items before device removal (bsc#1065729).
- ibmvnic: Harden device login requests (bsc#1170011 ltc#183538).
- ibmvnic: Skip fatal error reset after passive init (bsc#1171078
ltc#184239).
- ibmvnic: continue to init in CRQ reset returns H_CLOSED (bsc#1173280
ltc#185369).
- intel_idle: Graceful probe failure when MWAIT is disabled (bsc#1174115).
- livepatch: Apply vmlinux-specific KLP rel

Successful exploitation allows attacker to compromise the system.