rpm package
opensuse/kernel-source&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Tumbleweed
Vulnerabilities (1,862)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-15504 | Cri | 9.8 | < 5.14.6-1.4 | 5.14.6-1.4 | Aug 23, 2019 | drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir). | |
| CVE-2019-15099 | Hig | 7.5 | < 5.14.6-1.4 | 5.14.6-1.4 | Aug 16, 2019 | drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor. | |
| CVE-2019-15098 | Med | 4.6 | < 5.14.6-1.4 | 5.14.6-1.4 | Aug 16, 2019 | drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor. | |
| CVE-2019-11479 | Hig | 7.5 | < 5.14.6-1.4 | 5.14.6-1.4 | Jun 19, 2019 | Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixe | |
| CVE-2019-11478 | Med | 5.3 | < 5.14.6-1.4 | 5.14.6-1.4 | Jun 19, 2019 | Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fi | |
| CVE-2019-11477 | Hig | 7.5 | < 5.14.6-1.4 | 5.14.6-1.4 | Jun 19, 2019 | Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel | |
| CVE-2019-3846 | Hig | 8.8 | < 5.14.6-1.4 | 5.14.6-1.4 | Jun 3, 2019 | A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network. | |
| CVE-2019-3882 | Med | 5.5 | < 5.14.6-1.4 | 5.14.6-1.4 | Apr 24, 2019 | A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a syste | |
| CVE-2019-3887 | Med | 5.6 | < 5.14.6-1.4 | 5.14.6-1.4 | Apr 9, 2019 | A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw t | |
| CVE-2019-7222 | Med | 5.5 | < 5.14.6-1.4 | 5.14.6-1.4 | Mar 21, 2019 | The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak. | |
| CVE-2019-7221 | Hig | 7.8 | < 5.14.6-1.4 | 5.14.6-1.4 | Mar 21, 2019 | The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. | |
| CVE-2019-8912 | Hig | 7.8 | < 5.14.6-1.4 | 5.14.6-1.4 | Feb 18, 2019 | In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr. | |
| CVE-2019-6974 | Hig | 8.1 | < 5.14.6-1.4 | 5.14.6-1.4 | Feb 15, 2019 | In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free. | |
| CVE-2018-19824 | Hig | 7.8 | < 5.14.6-1.4 | 5.14.6-1.4 | Dec 3, 2018 | In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c. | |
| CVE-2018-18710 | Med | 5.5 | < 5.14.6-1.4 | 5.14.6-1.4 | Oct 29, 2018 | An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CV | |
| CVE-2018-13053 | Low | 3.3 | < 5.14.6-1.4 | 5.14.6-1.4 | Jul 2, 2018 | The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used. | |
| CVE-2018-12714 | Cri | 9.8 | < 5.14.6-1.4 | 5.14.6-1.4 | Jun 24, 2018 | An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no filter, which is an N=0 case when it expected at least one line to have been read, thus making the N-1 index invalid. This allows attackers | |
| CVE-2018-12232 | Med | 5.9 | < 5.14.6-1.4 | 5.14.6-1.4 | Jun 12, 2018 | In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference c | |
| CVE-2018-1118 | Low | 2.3 | < 5.14.6-1.4 | 5.14.6-1.4 | May 10, 2018 | Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading f | |
| CVE-2018-10323 | Med | 5.5 | < 5.14.6-1.4 | 5.14.6-1.4 | Apr 24, 2018 | The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted xfs image. |
- affected < 5.14.6-1.4fixed 5.14.6-1.4
drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir).
- affected < 5.14.6-1.4fixed 5.14.6-1.4
drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.
- affected < 5.14.6-1.4fixed 5.14.6-1.4
drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.
- affected < 5.14.6-1.4fixed 5.14.6-1.4
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixe
- affected < 5.14.6-1.4fixed 5.14.6-1.4
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fi
- affected < 5.14.6-1.4fixed 5.14.6-1.4
Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel
- affected < 5.14.6-1.4fixed 5.14.6-1.4
A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network.
- affected < 5.14.6-1.4fixed 5.14.6-1.4
A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a syste
- affected < 5.14.6-1.4fixed 5.14.6-1.4
A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw t
- affected < 5.14.6-1.4fixed 5.14.6-1.4
The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.
- affected < 5.14.6-1.4fixed 5.14.6-1.4
The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.
- affected < 5.14.6-1.4fixed 5.14.6-1.4
In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr.
- affected < 5.14.6-1.4fixed 5.14.6-1.4
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
- affected < 5.14.6-1.4fixed 5.14.6-1.4
In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c.
- affected < 5.14.6-1.4fixed 5.14.6-1.4
An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CV
- affected < 5.14.6-1.4fixed 5.14.6-1.4
The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used.
- affected < 5.14.6-1.4fixed 5.14.6-1.4
An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no filter, which is an N=0 case when it expected at least one line to have been read, thus making the N-1 index invalid. This allows attackers
- affected < 5.14.6-1.4fixed 5.14.6-1.4
In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference c
- affected < 5.14.6-1.4fixed 5.14.6-1.4
Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading f
- affected < 5.14.6-1.4fixed 5.14.6-1.4
The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted xfs image.
Page 87 of 94