blob: 1d483f277c0ec716830d911d61455a9d617430ce (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
To: debian-security-announce@lists.debian.org
Subject: [SECURITY] [DSA EMBRGD-1] linux security update
-------------------------------------------------------------------------
Debian Security Advisory DSA-EMBRGD-1 security@debian.org
https://www.debian.org/security/
June 09, 2020 https://www.debian.org/security/faq
-------------------------------------------------------------------------
Package : linux
CVE ID : CVE-2019-3016 CVE-2019-19462 CVE-2020-0543 CVE-2020-10711
CVE-2020-10732 CVE-2020-10751 CVE-2020-10757 CVE-2020-12114
CVE-2020-12464 CVE-2020-12768 CVE-2020-12770 CVE-2020-13143
Debian Bug : 960271
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.
CVE-2019-3016
It was discovered that the KVM implementation for x86 did not
always perform TLB flushes when needed, if the paravirtualised
TLB flush feature was enabled. This could lead to disclosure of
sensitive information within a guest VM.
CVE-2019-19462
The syzkaller tool found a missing error check in the 'relay'
library used to implement various files under debugfs. A local
user permitted to access debugfs could use this to cause a denial
of service (crash) or possibly for privilege escalation.
CVE-2020-0543
Researchers at VU Amsterdam discovered that on some Intel x86
systems supporting the RDRAND and RDSEED instructions, speculative
execution may use part of a random value that was previously
generated for use on another core. Depending on how these
instructions are used by applications, a local user or VM guest
could use this to obtain sensitive information including
cryptographic keys from other users or VMs.
This vulnerability can be mitigated by a microcode update, either
as part of system firmware (BIOS) or through the intel-microcode
package in Debian's non-free archive section. This kernel update
only provides reporting of the vulnerability and the option to
disable the mitigation if it is not needed.
CVE-2020-10711
Matthew Sheets reported NULL pointer dereference issues in the
SELinux subsystem while receiving CIPSO packet with null category. A
remote attacker can take advantage of this flaw to cause a denial of
service (crash). Note that this issue does not affect the binary
packages distributed in Debian as CONFIG_NETLABEL is not enabled.
CVE-2020-10732
An information leak of kernel private memory to userspace was found
in the kernel's implementation of core dumping userspace processes.
CVE-2020-10751
Dmitry Vyukov reported that the SELinux subsystem did not properly
handle validating multiple messages, which could allow a privileged
attacker to bypass SELinux netlink restrictions.
CVE-2020-10757
Description
CVE-2020-12114
Description
CVE-2020-12464
Description
CVE-2020-12768
Description
CVE-2020-12770
It was discovered that the sg (SCSI generic) driver did not
correctly release internal resources in a particular error case.
A local user permitted to access an sg device could possibly use
this to cause a denial of service (resource exhaustion).
CVE-2020-13143
Kyungtae Kim reported a potential heap out-of-bounds write in
the USB gadget subsystem. A local user permitted to write to
the gadget configuration filesystem could use this to cause a
denial of service (crash or memory corruption) or potentially
for privilege escalation.
For the stable distribution (buster), these problems have been fixed
in version 4.19.118-2+deb10u1. This version also fixes some related
bugs that do not have their own CVE IDs, and a regression in the
<linux/swab.h> UAPI header introduced in the previous point release
(bug #960271).
We recommend that you upgrade your linux packages.
For the detailed security status of linux please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/linux
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
|
