-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2020.3907
                   Security update for the Linux Kernel
                              6 November 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           linux kernel
Publisher:         SUSE
Operating System:  SUSE
Impact/Access:     Root Compromise                 -- Existing Account
                   Execute Arbitrary Code/Commands -- Existing Account
                   Increased Privileges            -- Existing Account
                   Denial of Service               -- Existing Account
                   Access Confidential Data        -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2020-25285 CVE-2020-25212 CVE-2020-24394
                   CVE-2020-16120 CVE-2020-14386 CVE-2020-14381
                   CVE-2020-14351 CVE-2020-11668 CVE-2020-0431

Reference:         ESB-2020.3888
                   ESB-2020.3775
                   ESB-2020.3669

Original Bulletin: 
   https://www.suse.com/support/update/announcement/2020/suse-su-20203122-1
   https://www.suse.com/support/update/announcement/2020/suse-su-20203188-1
   https://www.suse.com/support/update/announcement/2020/suse-su-20203181-1
   https://www.suse.com/support/update/announcement/2020/suse-su-20203180-1
   https://www.suse.com/support/update/announcement/2020/suse-su-20203190-1
   https://www.suse.com/support/update/announcement/2020/suse-su-20203187-1
   https://www.suse.com/support/update/announcement/2020/suse-su-20203186-1
   https://www.suse.com/support/update/announcement/2020/suse-su-20203178-1

Comment: This bulletin contains eight (8) SUSE security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

SUSE Security Update: Security update for the Linux Kernel

______________________________________________________________________________

Announcement ID:   SUSE-SU-2020:3122-1
Rating:            important
References:        #1055014 #1055186 #1061843 #1065729 #1077428 #1129923
                   #1134760 #1152489 #1174748 #1174969 #1175052 #1175898
                   #1176485 #1176713 #1177086 #1177353 #1177410 #1177411
                   #1177470 #1177739 #1177749 #1177750 #1177754 #1177755
                   #1177765 #1177814 #1177817 #1177854 #1177855 #1177856
                   #1177861 #1178002 #1178079 #1178246
Cross-References:  CVE-2020-14351 CVE-2020-16120 CVE-2020-25285
Affected Products:
                   SUSE Linux Enterprise Workstation Extension 15-SP2
                   SUSE Linux Enterprise Module for Live Patching 15-SP2
                   SUSE Linux Enterprise Module for Legacy Software 15-SP2
                   SUSE Linux Enterprise Module for Development Tools 15-SP2
                   SUSE Linux Enterprise Module for Basesystem 15-SP2
                   SUSE Linux Enterprise High Availability 15-SP2
______________________________________________________________________________

An update that solves three vulnerabilities and has 31 fixes is now available.

Description:

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security
and bugfixes.

The following security bugs were fixed:

  o CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/
    hugetlb.c could be used by local attackers to corrupt memory, cause a NULL
    pointer dereference, or possibly have unspecified other impact (bnc#
    1176485).
  o CVE-2020-16120: Fixed permission check to open real file when using
    overlayfs. It was possible to have a file not readable by an unprivileged
    user be copied to a mountpoint controlled by that user and then be able to
    access the file. (bsc#1177470)
  o CVE-2020-14351: Fixed a race condition in the perf_mmap_close() function
    (bsc#1177086).


The following non-security bugs were fixed:

  o ACPI: Always build evged in (git-fixes).
  o ACPI: button: fix handling lid state changes when input device closed
    (git-fixes).
  o ACPI: configfs: Add missing config_item_put() to fix refcount leak
    (git-fixes).
  o acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
  o ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
  o Add CONFIG_CHECK_CODESIGN_EKU
  o ALSA: ac97: (cosmetic) align argument names (git-fixes).
  o ALSA: aoa: i2sbus: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
  o ALSA: asihpi: fix spellint typo in comments (git-fixes).
  o ALSA: atmel: ac97: clarify operator precedence (git-fixes).
  o ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
  o ALSA: compress_offload: remove redundant initialization (git-fixes).
  o ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
  o ALSA: core: pcm: simplify locking for timers (git-fixes).
  o ALSA: core: timer: clarify operator precedence (git-fixes).
  o ALSA: core: timer: remove redundant assignment (git-fixes).
  o ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock
    (git-fixes).
  o ALSA: fireworks: use semicolons rather than commas to separate statements
    (git-fixes).
  o ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
  o ALSA: hda: (cosmetic) align function parameters (git-fixes).
  o ALSA: hda - Do not register a cb func if it is registered already
    (git-fixes).
  o ALSA: hda - Fix the return value if cb func is already registered
    (git-fixes).
  o ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close (git-fixes).
  o ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7
    (git-fixes).
  o ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887
    (git-fixes).
  o ALSA: hda/realtek - set mic to auto detect on a HP AIO machine (git-fixes).
  o ALSA: hda/realtek - The front Mic on a HP machine does not work
    (git-fixes).
  o ALSA: hda: use semicolons rather than commas to separate statements
    (git-fixes).
  o ALSA: hdspm: Fix typo arbitary (git-fixes).
  o ALSA: mixart: Correct comment wrt obsoleted tasklet usage (git-fixes).
  o ALSA: portman2x4: fix repeated word 'if' (git-fixes).
  o ALSA: rawmidi: (cosmetic) align function parameters (git-fixes).
  o ALSA: seq: oss: Avoid mutex lock for a long-time ioctl (git-fixes).
  o ALSA: sparc: dbri: fix repeated word 'the' (git-fixes).
  o ALSA: usb-audio: Add mixer support for Pioneer DJ DJM-250MK2 (git-fixes).
  o ALSA: usb-audio: endpoint.c: fix repeated word 'there' (git-fixes).
  o ALSA: usb-audio: fix spelling mistake "Frequence" -> "Frequency"
    (git-fixes).
  o ALSA: usb-audio: Line6 Pod Go interface requires static clock rate quirk
    (git-fixes).
  o ALSA: usb: scarless_gen2: fix endianness issue (git-fixes).
  o ALSA: vx: vx_core: clarify operator precedence (git-fixes).
  o ALSA: vx: vx_pcm: remove redundant assignment (git-fixes).
  o ASoC: fsl: imx-es8328: add missing put_device() call in imx_es8328_probe()
    (git-fixes).
  o ASoC: fsl_sai: Instantiate snd_soc_dai_driver (git-fixes).
  o ASoC: qcom: lpass-cpu: fix concurrency issue (git-fixes).
  o ASoC: qcom: lpass-platform: fix memory leak (git-fixes).
  o ASoC: sun50i-codec-analog: Fix duplicate use of ADC enable bits
    (git-fixes).
  o ASoC: tlv320aic32x4: Fix bdiv clock rate derivation (git-fixes).
  o ata: sata_rcar: Fix DMA boundary mask (git-fixes).
  o ath10k: Fix the size used in a 'dma_free_coherent()' call in an error
    handling path (git-fixes).
  o ath10k: provide survey info as accumulated data (git-fixes).
  o ath6kl: prevent potential array overflow in ath6kl_add_new_sta()
    (git-fixes).
  o ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd
    () (git-fixes).
  o ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb()
    (git-fixes).
  o ath9k_htc: Use appropriate rs_datalen type (git-fixes).
  o backlight: sky81452-backlight: Fix refcount imbalance on error (git-fixes).
  o blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART
    (bsc#1177750).
  o block: ensure bdi->io_pages is always initialized (bsc#1177749).
  o block: Fix page_is_mergeable() for compound pages (bsc#1177814).
  o Bluetooth: hci_uart: Cancel init work before unregistering (git-fixes).
  o Bluetooth: MGMT: Fix not checking if BT_HS is enabled (git-fixes).
  o brcmfmac: check ndev pointer (git-fixes).
  o btrfs: add owner and fs_info to alloc_state io_tree (bsc#1177854).
  o btrfs: qgroup: fix qgroup meta rsv leak for subvolume operations (bsc#
    1177856).
  o btrfs: qgroup: fix wrong qgroup metadata reserve for delayed inode (bsc#
    1177855).
  o btrfs: tree-checker: fix false alert caused by legacy btrfs root item (bsc#
    1177861).
  o can: c_can: reg_map_{c,d}_can: mark as __maybe_unused (git-fixes).
  o can: flexcan: remove ack_grp and ack_bit handling from driver (git-fixes).
  o can: softing: softing_card_shutdown(): add braces around empty body in an
    'if' statement (git-fixes).
  o clk: at91: clk-main: update key before writing AT91_CKGR_MOR (git-fixes).
  o clk: at91: remove the checking of parent_name (git-fixes).
  o clk: bcm2835: add missing release if devm_clk_hw_register fails
    (git-fixes).
  o clk: imx8mq: Fix usdhc parents order (git-fixes).
  o clk: keystone: sci-clk: fix parsing assigned-clock data during probe
    (git-fixes).
  o clk: meson: g12a: mark fclk_div2 as critical (git-fixes).
  o clk: qcom: gcc-sdm660: Fix wrong parent_map (git-fixes).
  o cxl: Rework error message for incompatible slots (bsc#1055014 git-fixes).
  o dax: Fix compilation for CONFIG_DAX && !CONFIG_FS_DAX (bsc#1177817).
  o dma-direct: add missing set_memory_decrypted() for coherent mapping (bsc#
    1175898, ECO-2743).
  o dma-direct: always align allocation size in dma_direct_alloc_pages() (bsc#
    1175898, ECO-2743).
  o dma-direct: atomic allocations must come from atomic coherent pools (bsc#
    1175898, ECO-2743).
  o dma-direct: check return value when encrypting or decrypting memory (bsc#
    1175898, ECO-2743).
  o dma-direct: consolidate the error handling in dma_direct_alloc_pages (bsc#
    1175898, ECO-2743).
  o dma-direct: make uncached_kernel_address more general (bsc#1175898,
    ECO-2743).
  o dma-direct: provide function to check physical memory area validity (bsc#
    1175898, ECO-2743).
  o dma-direct: provide mmap and get_sgtable method overrides (bsc#1175898,
    ECO-2743).
  o dma-direct: re-encrypt memory if dma_direct_alloc_pages() fails (bsc#
    1175898, ECO-2743).
  o dma-direct: remove __dma_direct_free_pages (bsc#1175898, ECO-2743).
  o dma-direct: remove the dma_handle argument to __dma_direct_alloc_pages (bsc
    #1175898, ECO-2743).
  o dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status (git-fixes).
  o dmaengine: dmatest: Check list for emptiness before access its last entry
    (git-fixes).
  o dma-mapping: add a dma_can_mmap helper (bsc#1175898, ECO-2743).
  o dma-mapping: always use VM_DMA_COHERENT for generic DMA remap (bsc#1175898,
    ECO-2743).
  o dma-mapping: DMA_COHERENT_POOL should select GENERIC_ALLOCATOR (bsc#
    1175898, ECO-2743).
  o dma-mapping: make dma_atomic_pool_init self-contained (bsc#1175898,
    ECO-2743).
  o dma-mapping: merge the generic remapping helpers into dma-direct (bsc#
    1175898, ECO-2743).
  o dma-mapping: remove arch_dma_mmap_pgprot (bsc#1175898, ECO-2743).
  o dma-mapping: warn when coherent pool is depleted (bsc#1175898, ECO-2743).
  o dma-pool: add additional coherent pools to map to gfp mask (bsc#1175898,
    ECO-2743).
  o dma-pool: add pool sizes to debugfs (bsc#1175898, ECO-2743).
  o dma-pool: decouple DMA_REMAP from DMA_COHERENT_POOL (bsc#1175898,
    ECO-2743).
  o dma-pool: do not allocate pool memory from CMA (bsc#1175898, ECO-2743).
  o dma-pool: dynamically expanding atomic pools (bsc#1175898, ECO-2743).
  o dma-pool: Fix an uninitialized variable bug in atomic_pool_expand() (bsc#
    1175898, ECO-2743).
  o dma-pool: fix coherent pool allocations for IOMMU mappings (bsc#1175898,
    ECO-2743).
  o dma-pool: fix too large DMA pools on medium memory size systems (bsc#
    1175898, ECO-2743).
  o dma-pool: get rid of dma_in_atomic_pool() (bsc#1175898, ECO-2743).
  o dma-pool: introduce dma_guess_pool() (bsc#1175898, ECO-2743).
  o dma-pool: make sure atomic pool suits device (bsc#1175898, ECO-2743).
  o dma-pool: Only allocate from CMA when in same memory zone (bsc#1175898,
    ECO-2743).
  o dma-pool: scale the default DMA coherent pool size with memory capacity
    (bsc#1175898, ECO-2743).
  o dma-remap: separate DMA atomic pools from direct remap code (bsc#1175898,
    ECO-2743).
  o dm: Call proper helper to determine dax support (bsc#1177817).
  o dm/dax: Fix table reference counts (bsc#1178246).
  o docs: driver-api: remove a duplicated index entry (git-fixes).
  o EDAC/i5100: Fix error handling order in i5100_init_one() (bsc#1152489).
  o extcon: ptn5150: Fix usage of atomic GPIO with sleeping GPIO chips
    (git-fixes).
  o HID: hid-input: fix stylus battery reporting (git-fixes).
  o HID: roccat: add bounds checking in kone_sysfs_write_settings()
    (git-fixes).
  o HID: wacom: Avoid entering wacom_wac_pen_report for pad / battery
    (git-fixes).
  o i2c: core: Restore acpi_walk_dep_device_list() getting called after
    registering the ACPI i2c devs (git-fixes).
  o i2c: imx: Fix external abort on interrupt in exit paths (git-fixes).
  o i2c: rcar: Auto select RESET_CONTROLLER (git-fixes).
  o i3c: master add i3c_master_attach_boardinfo to preserve boardinfo
    (git-fixes).
  o i3c: master: Fix error return in cdns_i3c_master_probe() (git-fixes).
  o ibmveth: Switch order of ibmveth_helper calls (bsc#1061843 git-fixes).
  o ibmvnic: save changed mac address to adapter->mac_addr (bsc#1134760 ltc#
    177449 git-fixes).
  o ibmvnic: set up 200GBPS speed (bsc#1129923 git-fixes).
  o ida: Free allocated bitmap in error path (git-fixes).
  o iio:accel:bma180: Fix use of true when should be iio_shared_by enum
    (git-fixes).
  o iio: adc: gyroadc: fix leak of device node iterator (git-fixes).
  o iio: adc: stm32-adc: fix runtime autosuspend delay when slow polling
    (git-fixes).
  o iio:adc:ti-adc0832 Fix alignment issue with timestamp (git-fixes).
  o iio:adc:ti-adc12138 Fix alignment issue with timestamp (git-fixes).
  o iio:dac:ad5592r: Fix use of true for IIO_SHARED_BY_TYPE (git-fixes).
  o iio:gyro:itg3200: Fix timestamp alignment and prevent data leak
    (git-fixes).
  o iio:light:si1145: Fix timestamp alignment and prevent data leak
    (git-fixes).
  o iio:magn:hmc5843: Fix passing true where iio_shared_by enum required
    (git-fixes).
  o ima: Do not ignore errors from crypto_shash_update() (git-fixes).
  o ima: Remove semicolon at the end of ima_get_binary_runtime_size()
    (git-fixes).
  o Input: ati_remote2 - add missing newlines when printing module parameters
    (git-fixes).
  o Input: ep93xx_keypad - fix handling of platform_get_irq() error
    (git-fixes).
  o Input: imx6ul_tsc - clean up some errors in imx6ul_tsc_resume()
    (git-fixes).
  o Input: omap4-keypad - fix handling of platform_get_irq() error (git-fixes).
  o Input: stmfts - fix a & vs && typo (git-fixes).
  o Input: sun4i-ps2 - fix handling of platform_get_irq() error (git-fixes).
  o Input: twl4030_keypad - fix handling of platform_get_irq() error
    (git-fixes).
  o iomap: Make sure iomap_end is called after iomap_begin (bsc#1177754).
  o iommu/vt-d: Gracefully handle DMAR units with no supported address widths
    (bsc#1177739).
  o ipmi_si: Fix wrong return value in try_smi_init() (git-fixes).
  o iwlwifi: mvm: split a print to avoid a WARNING in ROC (git-fixes).
  o kABI: Fix kABI after add CodeSigning extended key usage (bsc#1177353).
  o leds: mt6323: move period calculation (git-fixes).
  o lib/crc32.c: fix trivial typo in preprocessor condition (git-fixes).
  o memory: fsl-corenet-cf: Fix handling of platform_get_irq() error
    (git-fixes).
  o memory: omap-gpmc: Fix a couple off by ones (git-fixes).
  o memory: omap-gpmc: Fix build error without CONFIG_OF (git-fixes).
  o mfd: sm501: Fix leaks in probe() (git-fixes).
  o misc: mic: scif: Fix error handling path (git-fixes).
  o mm: do not panic when links can't be created in sysfs (bsc#1178002).
  o mm: do not rely on system state to detect hot-plug operations (bsc#
    1178002).
  o mm/huge_memory.c: use head to check huge zero page (git-fixes (mm/thp)).
  o mm/mempolicy.c: fix out of bounds write in mpol_parse_str() (git-fixes (mm/
    mempolicy)).
  o mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio()
    (git-fixes (mm/writeback)).
  o mm/page-writeback.c: improve arithmetic divisions (git-fixes (mm/
    writeback)).
  o mm: replace memmap_context by meminit_context (bsc#1178002).
  o mm/rmap: fixup copying of soft dirty and uffd ptes (git-fixes (mm/rmap)).
  o mm/zsmalloc.c: fix the migrated zspage statistics (git-fixes (mm/
    zsmalloc)).
  o mtd: lpddr: Fix bad logic in print_drs_error (git-fixes).
  o mtd: lpddr: fix excessive stack usage with clang (git-fixes).
  o mtd: mtdoops: Do not write panic data twice (git-fixes).
  o mtd: rawnand: stm32_fmc2: fix a buffer overflow (git-fixes).
  o mtd: rawnand: vf610: disable clk on error handling path in probe
    (git-fixes).
  o mtd: spinand: gigadevice: Add QE Bit (git-fixes).
  o mtd: spinand: gigadevice: Only one dummy byte in QUADIO (git-fixes).
  o mwifiex: Do not use GFP_KERNEL in atomic context (git-fixes).
  o mwifiex: fix double free (git-fixes).
  o mwifiex: remove function pointer check (git-fixes).
  o mwifiex: Remove unnecessary braces from HostCmd_SET_SEQ_NO_BSS_INFO
    (git-fixes).
  o net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()
    (git-fixes).
  o nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in
    nfc_genl_fw_download() (git-fixes).
  o nl80211: fix non-split wiphy information (git-fixes).
  o NTB: hw: amd: fix an issue about leak system resources (git-fixes).
  o ntb: intel: Fix memleak in intel_ntb_pci_probe (git-fixes).
  o nvme-rdma: fix crash due to incorrect cqe (bsc#1174748).
  o nvme-rdma: fix crash when connect rejected (bsc#1174748).
  o overflow: Include header file with SIZE_MAX declaration (git-fixes).
  o PCI: aardvark: Check for errors from pci_bridge_emul_init() call
    (git-fixes).
  o percpu: fix first chunk size calculation for populated bitmap (git-fixes
    (mm/percpu)).
  o perf/x86/amd: Fix sampling Large Increment per Cycle events (bsc#1152489).
  o perf/x86: Fix n_pair for cancelled txn (bsc#1152489).
  o pinctrl: mcp23s08: Fix mcp23x17 precious range (git-fixes).
  o pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser (git-fixes).
  o PKCS#7: Check codeSigning EKU for kernel module and kexec pe verification
    (bsc#1177353).
  o platform/x86: mlx-platform: Remove PSU EEPROM configuration (git-fixes).
  o PM: hibernate: Batch hibernate and resume IO requests (bsc#1178079).
  o powerpc/book3s64/radix: Make radix_mem_block_size 64bit (bsc#1055186 ltc#
    153436 git-fixes).
  o powerpc: Fix undetected data corruption with P9N DD2.1 VSX CI load
    emulation (bsc#1065729).
  o powerpc/hwirq: Remove stale forward irq_chip declaration (bsc#1065729).
  o powerpc/icp-hv: Fix missing of_node_put() in success path (bsc#1065729).
  o powerpc/irq: Drop forward declaration of struct irqaction (bsc#1065729).
  o powerpc/papr_scm: Fix warning triggered by perf_stats_show() (bsc#1175052
    jsc#SLE-13823 bsc#1174969 jsc#SLE-12769 git-fixes).
  o powerpc/perf/hv-gpci: Fix starting index value (bsc#1065729).
  o powerpc/powernv/dump: Fix race while processing OPAL dump (bsc#1065729).
  o powerpc/powernv/elog: Fix race while processing OPAL error log event (bsc#
    1065729).
  o powerpc/pseries: Avoid using addr_to_pfn in real mode (jsc#SLE-9246
    git-fixes).
  o powerpc/pseries: explicitly reschedule during drmem_lmb list traversal (bsc
    #1077428 ltc#163882 git-fixes).
  o powerpc/pseries: Fix missing of_node_put() in rng_init() (bsc#1065729).
  o pwm: img: Fix null pointer access in probe (git-fixes).
  o pwm: lpss: Add range limit check for the base_unit register value
    (git-fixes).
  o pwm: lpss: Fix off by one error in base_unit math in pwm_lpss_prepare()
    (git-fixes).
  o qtnfmac: fix resource leaks on unsupported iftype error return path
    (git-fixes).
  o r8169: fix operation under forced interrupt threading (git-fixes).
  o rapidio: fix the missed put_device() for rio_mport_add_riodev (git-fixes).
  o reset: sti: reset-syscfg: fix struct description warnings (git-fixes).
  o ring-buffer: Return 0 on success from ring_buffer_resize() (git-fixes).
  o rtc: rx8010: do not modify the global rtc ops (git-fixes).
  o scsi: ibmvfc: Fix error return in ibmvfc_probe() (bsc#1065729).
  o scsi: mptfusion: Do not use GFP_ATOMIC for larger DMA allocations (bsc#
    1175898, ECO-2743).
  o slimbus: core: check get_addr before removing laddr ida (git-fixes).
  o slimbus: core: do not enter to clock pause mode in core (git-fixes).
  o slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback
    (git-fixes).
  o soc: fsl: qbman: Fix return value on success (git-fixes).
  o staging: comedi: check validity of wMaxPacketSize of usb endpoints found
    (git-fixes).
  o staging: rtl8192u: Do not use GFP_KERNEL in atomic context (git-fixes).
  o tracing: Check return value of __create_val_fields() before using its
    result (git-fixes).
  o tracing: Save normal string variables (git-fixes).
  o USB: dwc2: Fix INTR OUT transfers in DDMA mode (git-fixes).
  o USB: dwc2: Fix parameter type in function pointer prototype (git-fixes).
  o USB: dwc3: core: add phy cleanup for probe error handling (git-fixes).
  o USB: dwc3: core: do not trigger runtime pm when remove driver (git-fixes).
  o USB: dwc3: ep0: Fix ZLP for OUT ep0 requests (git-fixes).
  o USB: dwc3: gadget: Resume pending requests after CLEAR_STALL (git-fixes).
  o USB: dwc3: pci: Allow Elkhart Lake to utilize DSM method for PM
    functionality (git-fixes).
  o USB: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above (git-fixes).
  o USB: gadget: u_ether: enable qmult on SuperSpeed Plus as well (git-fixes).
  o usblp: fix race between disconnect() and read() (git-fixes).
  o USB: serial: ftdi_sio: add support for FreeCalypso JTAG+UART adapters
    (git-fixes).
  o USB: serial: option: add Cellient MPL200 card (git-fixes).
  o USB: serial: option: Add Telit FT980-KS composition (git-fixes).
  o USB: serial: pl2303: add device-id for HP GC device (git-fixes).
  o USB: serial: qcserial: fix altsetting probing (git-fixes).
  o usb: xhci-mtk: Fix typo (git-fixes).
  o VMCI: check return value of get_user_pages_fast() for errors (git-fixes).
  o w1: mxc_w1: Fix timeout resolution problem leading to bus error
    (git-fixes).
  o watchdog: Fix memleak in watchdog_cdev_register (git-fixes).
  o watchdog: sp5100: Fix definition of EFCH_PM_DECODEEN3 (git-fixes).
  o watchdog: Use put_device on error (git-fixes).
  o wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 (git-fixes).
  o writeback: Avoid skipping inode writeback (bsc#1177755).
  o writeback: Fix sync livelock due to b_dirty_time processing (bsc#1177755).
  o writeback: Protect inode->i_io_list with inode->i_lock (bsc#1177755).
  o X.509: Add CodeSigning extended key usage parsing (bsc#1177353).
  o x86/fpu: Allow multiple bits in clearcpuid= parameter (bsc#1152489).
  o x86/ioapic: Unbreak check_timer() (bsc#1152489).
  o x86/{mce,mm}: Unmap the entire page if the whole page is affected and
    poisoned (bsc#1177765).
  o x86/mm: unencrypted non-blocking DMA allocations use coherent pools (bsc#
    1175898, ECO-2743).
  o x86/xen: disable Firmware First mode for correctable memory errors (bsc#
    1176713).
  o xen/blkback: use lateeoi irq binding (XSA-332 bsc#1177411).
  o xen/events: add a new "late EOI" evtchn framework (XSA-332 bsc#1177411).
  o xen/events: add a proper barrier to 2-level uevent unmasking (XSA-332 bsc#
    1177411).
  o xen/events: avoid removing an event channel while handling it (XSA-331 bsc#
    1177410).
  o xen/events: block rogue events for some time (XSA-332 bsc#1177411).
  o xen/events: defer eoi in case of excessive number of events (XSA-332 bsc#
    1177411).
  o xen/events: fix race in evtchn_fifo_unmask() (XSA-332 bsc#1177411).
  o xen/events: switch user event channels to lateeoi model (XSA-332 bsc#
    1177411).
  o xen/events: use a common cpu hotplug hook for event channels (XSA-332 bsc#
    1177411).
  o xen/netback: use lateeoi irq binding (XSA-332 bsc#1177411).
  o xen/pciback: use lateeoi irq binding (XSA-332 bsc#1177411).
  o xen/pvcallsback: use lateeoi irq binding (XSA-332 bsc#1177411).
  o xen/scsiback: use lateeoi irq binding (XSA-332 bsc#1177411).
  o xfs: force the log after remapping a synchronous-writes file (git-fixes).
  o xhci: do not create endpoint debugfs entry before ring buffer is set
    (git-fixes).

Special Instructions and Notes:

Please reboot the system after installing this update.

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Workstation Extension 15-SP2:
    zypper in -t patch SUSE-SLE-Product-WE-15-SP2-2020-3122=1
  o SUSE Linux Enterprise Module for Live Patching 15-SP2:
    zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP2-2020-3122=1
  o SUSE Linux Enterprise Module for Legacy Software 15-SP2:
    zypper in -t patch SUSE-SLE-Module-Legacy-15-SP2-2020-3122=1
  o SUSE Linux Enterprise Module for Development Tools 15-SP2:
    zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP2-2020-3122=1
  o SUSE Linux Enterprise Module for Basesystem 15-SP2:
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP2-2020-3122=1
  o SUSE Linux Enterprise High Availability 15-SP2:
    zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2020-3122=1

Package List:

  o SUSE Linux Enterprise Workstation Extension 15-SP2 (x86_64):
       kernel-default-debuginfo-5.3.18-24.34.1
       kernel-default-debugsource-5.3.18-24.34.1
       kernel-default-extra-5.3.18-24.34.1
       kernel-default-extra-debuginfo-5.3.18-24.34.1
  o SUSE Linux Enterprise Module for Live Patching 15-SP2 (ppc64le s390x
    x86_64):
       kernel-default-debuginfo-5.3.18-24.34.1
       kernel-default-debugsource-5.3.18-24.34.1
       kernel-default-livepatch-5.3.18-24.34.1
       kernel-default-livepatch-devel-5.3.18-24.34.1
       kernel-livepatch-5_3_18-24_34-default-1-5.3.2
       kernel-livepatch-5_3_18-24_34-default-debuginfo-1-5.3.2
       kernel-livepatch-SLE15-SP2_Update_6-debugsource-1-5.3.2
  o SUSE Linux Enterprise Module for Legacy Software 15-SP2 (aarch64 ppc64le
    s390x x86_64):
       kernel-default-debuginfo-5.3.18-24.34.1
       kernel-default-debugsource-5.3.18-24.34.1
       reiserfs-kmp-default-5.3.18-24.34.1
       reiserfs-kmp-default-debuginfo-5.3.18-24.34.1
  o SUSE Linux Enterprise Module for Development Tools 15-SP2 (aarch64 ppc64le
    s390x x86_64):
       kernel-obs-build-5.3.18-24.34.1
       kernel-obs-build-debugsource-5.3.18-24.34.1
       kernel-syms-5.3.18-24.34.1
  o SUSE Linux Enterprise Module for Development Tools 15-SP2 (aarch64 x86_64):
       kernel-preempt-debuginfo-5.3.18-24.34.1
       kernel-preempt-debugsource-5.3.18-24.34.1
       kernel-preempt-devel-5.3.18-24.34.1
       kernel-preempt-devel-debuginfo-5.3.18-24.34.1
  o SUSE Linux Enterprise Module for Development Tools 15-SP2 (noarch):
       kernel-docs-5.3.18-24.34.1
       kernel-source-5.3.18-24.34.1
  o SUSE Linux Enterprise Module for Basesystem 15-SP2 (aarch64 ppc64le s390x
    x86_64):
       kernel-default-5.3.18-24.34.1
       kernel-default-base-5.3.18-24.34.1.9.11.2
       kernel-default-debuginfo-5.3.18-24.34.1
       kernel-default-debugsource-5.3.18-24.34.1
       kernel-default-devel-5.3.18-24.34.1
       kernel-default-devel-debuginfo-5.3.18-24.34.1
  o SUSE Linux Enterprise Module for Basesystem 15-SP2 (aarch64 x86_64):
       kernel-preempt-5.3.18-24.34.1
       kernel-preempt-debuginfo-5.3.18-24.34.1
       kernel-preempt-debugsource-5.3.18-24.34.1
  o SUSE Linux Enterprise Module for Basesystem 15-SP2 (noarch):
       kernel-devel-5.3.18-24.34.1
       kernel-macros-5.3.18-24.34.1
  o SUSE Linux Enterprise High Availability 15-SP2 (aarch64 ppc64le s390x
    x86_64):
       cluster-md-kmp-default-5.3.18-24.34.1
       cluster-md-kmp-default-debuginfo-5.3.18-24.34.1
       dlm-kmp-default-5.3.18-24.34.1
       dlm-kmp-default-debuginfo-5.3.18-24.34.1
       gfs2-kmp-default-5.3.18-24.34.1
       gfs2-kmp-default-debuginfo-5.3.18-24.34.1
       kernel-default-debuginfo-5.3.18-24.34.1
       kernel-default-debugsource-5.3.18-24.34.1
       ocfs2-kmp-default-5.3.18-24.34.1
       ocfs2-kmp-default-debuginfo-5.3.18-24.34.1


References:

  o https://www.suse.com/security/cve/CVE-2020-14351.html
  o https://www.suse.com/security/cve/CVE-2020-16120.html
  o https://www.suse.com/security/cve/CVE-2020-25285.html
  o https://bugzilla.suse.com/1055014
  o https://bugzilla.suse.com/1055186
  o https://bugzilla.suse.com/1061843
  o https://bugzilla.suse.com/1065729
  o https://bugzilla.suse.com/1077428
  o https://bugzilla.suse.com/1129923
  o https://bugzilla.suse.com/1134760
  o https://bugzilla.suse.com/1152489
  o https://bugzilla.suse.com/1174748
  o https://bugzilla.suse.com/1174969
  o https://bugzilla.suse.com/1175052
  o https://bugzilla.suse.com/1175898
  o https://bugzilla.suse.com/1176485
  o https://bugzilla.suse.com/1176713
  o https://bugzilla.suse.com/1177086
  o https://bugzilla.suse.com/1177353
  o https://bugzilla.suse.com/1177410
  o https://bugzilla.suse.com/1177411
  o https://bugzilla.suse.com/1177470
  o https://bugzilla.suse.com/1177739
  o https://bugzilla.suse.com/1177749
  o https://bugzilla.suse.com/1177750
  o https://bugzilla.suse.com/1177754
  o https://bugzilla.suse.com/1177755
  o https://bugzilla.suse.com/1177765
  o https://bugzilla.suse.com/1177814
  o https://bugzilla.suse.com/1177817
  o https://bugzilla.suse.com/1177854
  o https://bugzilla.suse.com/1177855
  o https://bugzilla.suse.com/1177856
  o https://bugzilla.suse.com/1177861
  o https://bugzilla.suse.com/1178002
  o https://bugzilla.suse.com/1178079
  o https://bugzilla.suse.com/1178246

- ------------------------------------------------------------------------------

SUSE Security Update: Security update for the Linux Kernel (Live Patch 15 for
SLE 15 SP1)

______________________________________________________________________________

Announcement ID:   SUSE-SU-2020:3188-1
Rating:            important
References:        #1176012 #1176382
Cross-References:  CVE-2020-14381 CVE-2020-25212
Affected Products:
                   SUSE Linux Enterprise Module for Live Patching 15-SP1
______________________________________________________________________________

An update that fixes two vulnerabilities is now available.

Description:

This update for the Linux Kernel 4.12.14-197_56 fixes several issues.
The following security issues were fixed:

  o CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait
    operation, which could have lead to memory corruption and possibly
    privilege escalation (bsc#1176011).
  o CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by
    local attackers to corrupt memory or possibly have unspecified other impact
    because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c
    (bsc#1176381).

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Module for Live Patching 15-SP1:
    zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP1-2020-3188=1

Package List:

  o SUSE Linux Enterprise Module for Live Patching 15-SP1 (ppc64le x86_64):
       kernel-livepatch-4_12_14-197_56-default-2-2.1


References:

  o https://www.suse.com/security/cve/CVE-2020-14381.html
  o https://www.suse.com/security/cve/CVE-2020-25212.html
  o https://bugzilla.suse.com/1176012
  o https://bugzilla.suse.com/1176382

- ------------------------------------------------------------------------------

SUSE Security Update: Security update for the Linux Kernel (Live 

______________________________________________________________________________

Announcement ID:   SUSE-SU-2020:3181-1
Rating:            important
References:        #1176382
Cross-References:  CVE-2020-25212
Affected Products:
                   SUSE Linux Enterprise Module for Live Patching 15-SP2
______________________________________________________________________________

Patch 4 for
SLE 15 SP2)

An update that fixes one vulnerability is now available.

Description:

This update for the Linux Kernel 5.3.18-24_24 fixes one issue.
The following security issue was fixed:

  o CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by
    local attackers to corrupt memory or possibly have unspecified other impact
    because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c
    (bsc#1176381).

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Module for Live Patching 15-SP2:
    zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP2-2020-3181=1
    SUSE-SLE-Module-Live-Patching-15-SP2-2020-3182=1

Package List:

  o SUSE Linux Enterprise Module for Live Patching 15-SP2 (ppc64le s390x
    x86_64):
       kernel-livepatch-5_3_18-24_15-default-2-2.1
       kernel-livepatch-5_3_18-24_15-default-debuginfo-2-2.1
       kernel-livepatch-5_3_18-24_24-default-2-2.1
       kernel-livepatch-5_3_18-24_24-default-debuginfo-2-2.1
       kernel-livepatch-SLE15-SP2_Update_3-debugsource-2-2.1
       kernel-livepatch-SLE15-SP2_Update_4-debugsource-2-2.1


References:

  o https://www.suse.com/security/cve/CVE-2020-25212.html
  o https://bugzilla.suse.com/1176382

- ------------------------------------------------------------------------------

SUSE Security Update: Security update for the Linux Kernel (Live Patch 18 for
SLE 15)

______________________________________________________________________________

Announcement ID:   SUSE-SU-2020:3180-1
Rating:            important
References:        #1175992 #1176012 #1176072 #1176382 #1176896
Cross-References:  CVE-2020-0431 CVE-2020-14381 CVE-2020-14386 CVE-2020-24394
                   CVE-2020-25212
Affected Products:
                   SUSE Linux Enterprise Module for Live Patching 15-SP1
                   SUSE Linux Enterprise Module for Live Patching 15
______________________________________________________________________________

An update that fixes 5 vulnerabilities is now available.

Description:

This update for the Linux Kernel 4.12.14-150_52 fixes several issues.
The following security issues were fixed:

  o CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait
    operation, which could have lead to memory corruption and possibly
    privilege escalation (bsc#1176011).
  o CVE-2020-0431: In kbd_keycode of keyboard.c, there is a possible out of
    bounds write due to a missing bounds check. This could lead to local
    escalation of privilege with no additional execution privileges needed.
    User interaction is not needed for exploitation. (bsc#1176722)
  o CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by
    local attackers to corrupt memory or possibly have unspecified other impact
    because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c
    (bsc#1176381).
  o CVE-2020-14386: Fixed a memory corruption which could have lead to an
    attacker gaining root privileges from unprivileged processes. The highest
    threat from this vulnerability is to data confidentiality and integrity
    (bsc#1176069).
  o CVE-2020-24394: The NFS server code can set incorrect permissions on new
    filesystem objects when the filesystem lacks ACL support. This occurs
    because the current umask is not considered (bsc#1175518).

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Module for Live Patching 15-SP1:
    zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP1-2020-3173=1
    SUSE-SLE-Module-Live-Patching-15-SP1-2020-3174=1
    SUSE-SLE-Module-Live-Patching-15-SP1-2020-3175=1
    SUSE-SLE-Module-Live-Patching-15-SP1-2020-3176=1
    SUSE-SLE-Module-Live-Patching-15-SP1-2020-3177=1
  o SUSE Linux Enterprise Module for Live Patching 15:
    zypper in -t patch SUSE-SLE-Module-Live-Patching-15-2020-3179=1
    SUSE-SLE-Module-Live-Patching-15-2020-3180=1
    SUSE-SLE-Module-Live-Patching-15-2020-3183=1
    SUSE-SLE-Module-Live-Patching-15-2020-3185=1

Package List:

  o SUSE Linux Enterprise Module for Live Patching 15-SP1 (ppc64le x86_64):
       kernel-livepatch-4_12_14-197_26-default-7-2.2
       kernel-livepatch-4_12_14-197_29-default-7-2.2
       kernel-livepatch-4_12_14-197_34-default-6-2.2
       kernel-livepatch-4_12_14-197_37-default-6-2.2
       kernel-livepatch-4_12_14-197_40-default-5-2.2
  o SUSE Linux Enterprise Module for Live Patching 15 (ppc64le x86_64):
       kernel-livepatch-4_12_14-150_41-default-7-2.2
       kernel-livepatch-4_12_14-150_41-default-debuginfo-7-2.2
       kernel-livepatch-4_12_14-150_47-default-7-2.2
       kernel-livepatch-4_12_14-150_47-default-debuginfo-7-2.2
       kernel-livepatch-4_12_14-150_52-default-3-2.2
       kernel-livepatch-4_12_14-150_52-default-debuginfo-3-2.2
       kernel-livepatch-4_12_14-150_55-default-3-2.1
       kernel-livepatch-4_12_14-150_55-default-debuginfo-3-2.1


References:

  o https://www.suse.com/security/cve/CVE-2020-0431.html
  o https://www.suse.com/security/cve/CVE-2020-14381.html
  o https://www.suse.com/security/cve/CVE-2020-14386.html
  o https://www.suse.com/security/cve/CVE-2020-24394.html
  o https://www.suse.com/security/cve/CVE-2020-25212.html
  o https://bugzilla.suse.com/1175992
  o https://bugzilla.suse.com/1176012
  o https://bugzilla.suse.com/1176072
  o https://bugzilla.suse.com/1176382
  o https://bugzilla.suse.com/1176896

- ------------------------------------------------------------------------------

SUSE Security Update: Security update for the Linux Kernel (Live Patch 13 for
SLE 15 SP1)

______________________________________________________________________________

Announcement ID:   SUSE-SU-2020:3190-1
Rating:            important
References:        #1175992 #1176012 #1176072 #1176382
Cross-References:  CVE-2020-14381 CVE-2020-14386 CVE-2020-24394 CVE-2020-25212
Affected Products:
                   SUSE Linux Enterprise Module for Live Patching 15-SP1
______________________________________________________________________________

An update that fixes four vulnerabilities is now available.

Description:

This update for the Linux Kernel 4.12.14-197_48 fixes several issues.
The following security issues were fixed:

  o CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait
    operation, which could have lead to memory corruption and possibly
    privilege escalation (bsc#1176011).
  o CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by
    local attackers to corrupt memory or possibly have unspecified other impact
    because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c
    (bsc#1176381).
  o CVE-2020-14386: Fixed a memory corruption which could have lead to an
    attacker gaining root privileges from unprivileged processes. The highest
    threat from this vulnerability is to data confidentiality and integrity
    (bsc#1176069).
  o CVE-2020-24394: The NFS server code can set incorrect permissions on new
    filesystem objects when the filesystem lacks ACL support. This occurs
    because the current umask is not considered (bsc#1175518).

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Module for Live Patching 15-SP1:
    zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP1-2020-3172=1
    SUSE-SLE-Module-Live-Patching-15-SP1-2020-3189=1
    SUSE-SLE-Module-Live-Patching-15-SP1-2020-3190=1

Package List:

  o SUSE Linux Enterprise Module for Live Patching 15-SP1 (ppc64le x86_64):
       kernel-livepatch-4_12_14-197_45-default-3-2.2
       kernel-livepatch-4_12_14-197_48-default-3-2.1
       kernel-livepatch-4_12_14-197_51-default-3-2.1


References:

  o https://www.suse.com/security/cve/CVE-2020-14381.html
  o https://www.suse.com/security/cve/CVE-2020-14386.html
  o https://www.suse.com/security/cve/CVE-2020-24394.html
  o https://www.suse.com/security/cve/CVE-2020-25212.html
  o https://bugzilla.suse.com/1175992
  o https://bugzilla.suse.com/1176012
  o https://bugzilla.suse.com/1176072
  o https://bugzilla.suse.com/1176382

- ------------------------------------------------------------------------------

SUSE Security Update: Security update for the Linux Kernel (Live 

______________________________________________________________________________

Announcement ID:   SUSE-SU-2020:3187-1
Rating:            important
References:        #1175992 #1176072 #1176382
Cross-References:  CVE-2020-14386 CVE-2020-24394 CVE-2020-25212
Affected Products:
                   SUSE Linux Enterprise Module for Live Patching 15-SP2
______________________________________________________________________________

Patch 0 for
SLE 15 SP2)

An update that fixes three vulnerabilities is now available.

Description:

This update for the Linux Kernel 5.3.18-22 fixes several issues.
The following security issues were fixed:

  o CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by
    local attackers to corrupt memory or possibly have unspecified other impact
    because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c
    (bsc#1176381).
  o CVE-2020-14386: Fixed a memory corruption which could have lead to an
    attacker gaining root privileges from unprivileged processes. The highest
    threat from this vulnerability is to data confidentiality and integrity
    (bsc#1176069).
  o CVE-2020-24394: The NFS server code can set incorrect permissions on new
    filesystem objects when the filesystem lacks ACL support. This occurs
    because the current umask is not considered (bsc#1175518).

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Module for Live Patching 15-SP2:
    zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP2-2020-3187=1

Package List:

  o SUSE Linux Enterprise Module for Live Patching 15-SP2 (ppc64le s390x
    x86_64):
       kernel-livepatch-5_3_18-22-default-3-8.2
       kernel-livepatch-5_3_18-22-default-debuginfo-3-8.2
       kernel-livepatch-SLE15-SP2_Update_0-debugsource-3-8.2


References:

  o https://www.suse.com/security/cve/CVE-2020-14386.html
  o https://www.suse.com/security/cve/CVE-2020-24394.html
  o https://www.suse.com/security/cve/CVE-2020-25212.html
  o https://bugzilla.suse.com/1175992
  o https://bugzilla.suse.com/1176072
  o https://bugzilla.suse.com/1176382

- ------------------------------------------------------------------------------

SUSE Security Update: Security update for the Linux Kernel (Live 

______________________________________________________________________________

Announcement ID:   SUSE-SU-2020:3186-1
Rating:            important
References:        #1176072 #1176382
Cross-References:  CVE-2020-14386 CVE-2020-25212
Affected Products:
                   SUSE Linux Enterprise Module for Live Patching 15-SP2
______________________________________________________________________________

Patch 2 for
SLE 15 SP2)

An update that fixes two vulnerabilities is now available.

Description:

This update for the Linux Kernel 5.3.18-24_12 fixes several issues.
The following security issues were fixed:

  o CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by
    local attackers to corrupt memory or possibly have unspecified other impact
    because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c
    (bsc#1176381).
  o CVE-2020-14386: Fixed a memory corruption which could have lead to an
    attacker gaining root privileges from unprivileged processes. The highest
    threat from this vulnerability is to data confidentiality and integrity
    (bsc#1176069).

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Module for Live Patching 15-SP2:
    zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP2-2020-3184=1
    SUSE-SLE-Module-Live-Patching-15-SP2-2020-3186=1

Package List:

  o SUSE Linux Enterprise Module for Live Patching 15-SP2 (ppc64le s390x
    x86_64):
       kernel-livepatch-5_3_18-24_12-default-2-2.1
       kernel-livepatch-5_3_18-24_12-default-debuginfo-2-2.1
       kernel-livepatch-5_3_18-24_9-default-3-2.1
       kernel-livepatch-5_3_18-24_9-default-debuginfo-3-2.1
       kernel-livepatch-SLE15-SP2_Update_1-debugsource-3-2.1
       kernel-livepatch-SLE15-SP2_Update_2-debugsource-2-2.1


References:

  o https://www.suse.com/security/cve/CVE-2020-14386.html
  o https://www.suse.com/security/cve/CVE-2020-25212.html
  o https://bugzilla.suse.com/1176072
  o https://bugzilla.suse.com/1176382

- ------------------------------------------------------------------------------

SUSE Security Update: Security update for the Linux Kernel (Live Patch 20 for
SLE 15)

______________________________________________________________________________

Announcement ID:   SUSE-SU-2020:3178-1
Rating:            important
References:        #1173942 #1176012 #1176382 #1176896
Cross-References:  CVE-2020-0431 CVE-2020-11668 CVE-2020-14381 CVE-2020-25212
Affected Products:
                   SUSE Linux Enterprise Module for Live Patching 15
______________________________________________________________________________

An update that fixes four vulnerabilities is now available.

Description:

This update for the Linux Kernel 4.12.14-150_58 fixes several issues.
The following security issues were fixed:

  o CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait
    operation, which could have lead to memory corruption and possibly
    privilege escalation (bsc#1176011).
  o CVE-2020-0431: In kbd_keycode of keyboard.c, there is a possible out of
    bounds write due to a missing bounds check. This could lead to local
    escalation of privilege with no additional execution privileges needed.
    User interaction is not needed for exploitation. (bsc#1176722)
  o CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by
    local attackers to corrupt memory or possibly have unspecified other impact
    because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c
    (bsc#1176381).
  o CVE-2020-11668: Fixed an out of bounds write to the heap in drivers/media/
    usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) caused by
    mishandling invalid descriptors (bsc#1168952).

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Module for Live Patching 15:
    zypper in -t patch SUSE-SLE-Module-Live-Patching-15-2020-3178=1

Package List:

  o SUSE Linux Enterprise Module for Live Patching 15 (ppc64le x86_64):
       kernel-livepatch-4_12_14-150_58-default-2-2.1
       kernel-livepatch-4_12_14-150_58-default-debuginfo-2-2.1


References:

  o https://www.suse.com/security/cve/CVE-2020-0431.html
  o https://www.suse.com/security/cve/CVE-2020-11668.html
  o https://www.suse.com/security/cve/CVE-2020-14381.html
  o https://www.suse.com/security/cve/CVE-2020-25212.html
  o https://bugzilla.suse.com/1173942
  o https://bugzilla.suse.com/1176012
  o https://bugzilla.suse.com/1176382
  o https://bugzilla.suse.com/1176896

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBX6TciONLKJtyKPYoAQj2gBAAldMVg0i+Ihhgn8LcNWWeP/XY0/csr6cn
zBvrdCKkSJfBIqmGMz7oag4Ox+woPPcetyOvUeQ4GST7y202GCL0VFYQlWQid//3
tr/vTMbDiltcwj9wzAIq+UqaFsimlRQvtJGISiI/7eoEEjxTEvDXpyOubl2x/gHp
KQcud/ouDOj9gVspXFJ81+s3d7b8/GKjRiwJ12JLd+/nakrWemm1cY1GaXB5v/lB
bx2JVIAMfW8p/Q8t8KaLzNS1GqxjLs6QqP64l0bEMsIn43VlAnL0+za+rU47r9Hx
IhmdaF7/P9+lhfuOChWNCVKa8IfXnkTORnmcRG14bejQUe4Y8pe9244VuRNRHg+C
71eB+HVwnQlfVf6eTY4g+CN2hjuS4laK0ob8kbEedVFfuyAsmdin3y/HuegCy3Xx
R1Ffv132Ac+KRjMs8AluL//gPk+ytqBNG1CHIYTG2ZA+tyCplbQ173jyKg+Lhbxk
fCq3fGy1ZDlPAG5eMDWXoh75V1KWR9NxnKwqRVOYl/1jyBh/nYn00+tjArlM+h5L
0IfQjJG8LYA7oEHMveKsHMrtQuzz192lDs0kACF7QZAhw9uvP/FTCmkDUA1ywBwu
u6rUG6Xra6iQ2llDjXXPfE4kWMr3LM7gaFQluncoIR/1Fu7trZe0JnUTUwUgCaxN
oc8I6yOlU3w=
=EZUm
-----END PGP SIGNATURE-----