OpenSUSE Linux update for the Linux Kernel



Risk Medium
Patch available YES
Number of vulnerabilities 8
CVE-ID CVE-2018-20855
CVE-2019-10207
CVE-2019-1125
CVE-2019-11810
CVE-2019-13631
CVE-2019-13648
CVE-2019-14283
CVE-2019-14284
CWE-ID CWE-119
CWE-476
CWE-200
CWE-787
CWE-399
CWE-190
CWE-400
Exploitation vector Local
Public exploit Public exploit code for vulnerability #3 is available.
Vulnerable software
 Opensuse
Operating systems & Components / Operating system

Vendor SUSE

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU19567

Risk: Medium

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-20855

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local attacker to access sensitive information on a targeted system.

The vulnerability exists due to insufficient initialization of the "mlx5_ib_create_qp_resp" function in the "create_qp_common" function in the "drivers/infiniband/hw/mlx5/qp.c" file. A local authenticated attacker can access the system, execute an application that submits malicious input, leak stack memory and access sensitive information on a targeted system.


Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 15.1

CPE2.3 External links

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) NULL pointer dereference

EUVDB-ID: #VU28401

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-10207

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash.

Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 15.1

CPE2.3 External links

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information disclosure

EUVDB-ID: #VU19946

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2019-1125

CWE-ID: CWE-200 - Information exposure

Exploit availability: Yes

Description

The vulnerability allows a local user to gain access to potentially sensitive information and elevate privileges on the system.

The vulnerability exists when certain central processing units (CPU) speculatively access memory. A local user can gain unauthorized access to sensitive information and elevate privileges on the system.

This issue is a variant of the Spectre Variant 1 speculative execution side channel vulnerability that leverages SWAPGS instructions to bypass KPTI/KVA mitigations.

Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 15.1

CPE2.3 External links

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) NULL pointer dereference

EUVDB-ID: #VU19995

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-11810

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 15.1

CPE2.3 External links

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds write

EUVDB-ID: #VU19576

Risk: Medium

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-13631

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local attacker to cause an out-of-bounds write condition on a targeted virtual host system.

The vulnerability exists due to the out-of-bounds write error in the "parse_hid_report_descriptor" function in the "drivers/input/tablet/gtco.c" file. A local authenticated attacker can insert a malicious USB device that sends a crafted response to the targeted system and cause an out-of-bounds write condition.

Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 15.1

CPE2.3 External links

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource management error

EUVDB-ID: #VU19387

Risk: Medium

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-13648

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists in the "arch/powerpc/kernel/signal_32.c" and "arch/powerpc/kernel/signal_64.c" files on the PowerPC platform, when hardware transactional memory is disabled. A local authenticated attacker can make a "sigreturn()" system call that sends a signal frame that sends a signal frame that submits malicious input to the targeted system and cause a denial of service condition.

Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 15.1

CPE2.3 External links

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Integer overflow

EUVDB-ID: #VU19594

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-14283

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to execute arbitrary code or cause a denial of service (DoS) condition on a targeted system.

The vulnerability exists due to the "set_geometry" function in the "drivers/block/floppy.c" file does not properly validate the sect and head fields. A local authenticated attacker can insert a floppy disk that submits malicious input to the targeted system, trigger integer overflow, which could cause an out-of-bounds write condition and execute arbitrary code on the target system or cause a DoS condition.


Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 15.1

CPE2.3 External links

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Resource exhaustion

EUVDB-ID: #VU19593

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-14284

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a divide-by-zero condition in the "drivers/block/floppy.c" file. A local authenticated attacker can insert a floppy disk that submits malicious input to the targeted system, trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 15.1

CPE2.3 External links

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###