The 5.3.12 update contains a number of important fixes across the tree

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4258-1 advisory.

  - drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via     an incomplete address in an endpoint descriptor. (CVE-2019-15099)

  - An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a     malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c driver.
    (CVE-2019-15291)

  - An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is     exploitable for privilege escalation on some Linux distributions where local users have /dev/video0     access, but only if the driver happens to be loaded. There are multiple race conditions during streaming     stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in     vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the     corresponding kthreads. At least one of these race conditions leads to a use-after-free. (CVE-2019-18683)

  - fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer     dereference via a crafted btrfs image because fs_devices->devices is mishandled within find_device, aka     CID-09ba3bc9dd15. (CVE-2019-18885)

  - A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     crypto_reportstat_alg() failures, aka CID-c03b04dcdba1. (CVE-2019-19050)

  - A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     crypto_report_alg() failures, aka CID-ffdde5932042. (CVE-2019-19062)

  - A memory leak in the rsi_send_beacon() function in drivers/net/wireless/rsi/rsi_91x_mgmt.c in the Linux     kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     rsi_prepare_beacon() failures, aka CID-d563131ef23c. (CVE-2019-19071)

  - A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the     Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by     triggering copy to udata failures, aka CID-4a9d46a9fe14. (CVE-2019-19077)

  - A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux     kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     usb_submit_urb() failures, aka CID-b8d17e7d93d2. (CVE-2019-19078)

  - A memory leak in the qrtr_tun_write_iter() function in net/qrtr/tun.c in the Linux kernel before 5.3     allows attackers to cause a denial of service (memory consumption), aka CID-a21b7f0cff19. (CVE-2019-19079)

  - Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel     through 5.3.11 allow attackers to cause a denial of service (memory consumption). This affects the     dce120_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the     dce110_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, the     dce100_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the     dcn10_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, and the     dce112_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, aka     CID-104c307147ad. (CVE-2019-19082)

  - In the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer dereference     because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c     and net/appletalk/ddp.c, as demonstrated by unregister_snap_client, aka CID-9804501fa122. (CVE-2019-19227)

  - vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access     to vcsu devices, aka CID-0c9acb1af77a. (CVE-2019-19252)

  - An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way     the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID     features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use     this flaw to crash the system, resulting in a denial of service. (CVE-2019-19332)

  - The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors     in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka     CID-4ea99936a163. (CVE-2019-19767)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4284-1 advisory.

  - Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor     Graphics may allow an unauthenticated user to potentially enable information disclosure via local access.
    (CVE-2019-14615)

  - drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via     an incomplete address in an endpoint descriptor. (CVE-2019-15099)

  - An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a     malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c driver.
    (CVE-2019-15291)

  - drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux kernel 5.2.14 does not check the alloc_workqueue     return value, leading to a NULL pointer dereference. NOTE: The security community disputes this issues as     not being serious enough to be deserving a CVE id (CVE-2019-16229)

  - drivers/net/wireless/marvell/libertas/if_sdio.c in the Linux kernel 5.2.14 does not check the     alloc_workqueue return value, leading to a NULL pointer dereference. (CVE-2019-16232)

  - An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is     exploitable for privilege escalation on some Linux distributions where local users have /dev/video0     access, but only if the driver happens to be loaded. There are multiple race conditions during streaming     stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in     vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the     corresponding kthreads. At least one of these race conditions leads to a use-after-free. (CVE-2019-18683)

  - In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in     drivers/media/platform/rcar_drif.c, which could cause a memory disclosure problem. (CVE-2019-18786)

  - A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel     through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering     sof_get_ctrl_copy_params() failures, aka CID-45c1380358b1. (CVE-2019-18811)

  - A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     crypto_reportstat_alg() failures, aka CID-c03b04dcdba1. (CVE-2019-19050)

  - Two memory leaks in the mwifiex_pcie_init_evt_ring() function in     drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allow attackers to cause a     denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka     CID-d10dcb615c8e. (CVE-2019-19057)

  - A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     crypto_report_alg() failures, aka CID-ffdde5932042. (CVE-2019-19062)

  - Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the     Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka     CID-3f9361695113. (CVE-2019-19063)

  - A memory leak in the rsi_send_beacon() function in drivers/net/wireless/rsi/rsi_91x_mgmt.c in the Linux     kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     rsi_prepare_beacon() failures, aka CID-d563131ef23c. (CVE-2019-19071)

  - A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the     Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by     triggering copy to udata failures, aka CID-4a9d46a9fe14. (CVE-2019-19077)

  - A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux     kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     usb_submit_urb() failures, aka CID-b8d17e7d93d2. (CVE-2019-19078)

  - Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel     through 5.3.11 allow attackers to cause a denial of service (memory consumption). This affects the     dce120_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the     dce110_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, the     dce100_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the     dcn10_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, and the     dce112_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, aka     CID-104c307147ad. (CVE-2019-19082)

  - In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and     full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/io_uring.c, and net/socket.c.
    For example, an attacker can bypass intended restrictions on adding an IPv4 address to the loopback     interface. This occurs because IORING_OP_SENDMSG operations, although requested in the context of an     unprivileged user, are sometimes performed by a kernel worker thread without considering that context.
    (CVE-2019-19241)

  - vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access     to vcsu devices, aka CID-0c9acb1af77a. (CVE-2019-19252)

  - An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way     the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID     features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use     this flaw to crash the system, resulting in a denial of service. (CVE-2019-19332)

  - fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is     used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have     unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstrated by mishandling     of signal-based non-cooperative preemption in Go 1.14 prereleases on amd64, aka CID-59c4bd853abc.
    (CVE-2019-19602)

  - The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors     in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka     CID-4ea99936a163. (CVE-2019-19767)

  - In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in     the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c. (CVE-2019-19947)

  - In the Linux kernel through 5.4.6, there is a NULL pointer dereference in     drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related     to a PHY down race condition, aka CID-f70267f379b5. (CVE-2019-19965)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
131334	Fedora 31 : kernel (2019-34a75d7e61)	Nessus	Fedora Local Security Checks	11/27/2019	4/9/2024	high
133354	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4258-1)	Nessus	Ubuntu Local Security Checks	1/30/2020	1/9/2024	high
131332	Fedora 30 : kernel (2019-021c968423)	Nessus	Fedora Local Security Checks	11/27/2019	4/9/2024	high
133797	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4284-1)	Nessus	Ubuntu Local Security Checks	2/19/2020	1/9/2024	high

Detections

Analytics

Plugins Search

high

high

high

high