suse/kernel-default&distro=SUSE Linux Enterprise High Availability Extension 12 SP4

Vulnerabilities (603)

• CVE-2019-11810May 7, 2019
  affected < 4.12.14-95.29.1fixed 4.12.14-95.29.1

  An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free.

• CVE-2019-11599Apr 29, 2019
  affected < 4.12.14-95.24.1fixed 4.12.14-95.24.1

  The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other

• CVE-2019-3900Apr 25, 2019
  affected < 4.12.14-95.83.2fixed 4.12.14-95.83.2

  An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could

• CVE-2019-3882Apr 24, 2019
  affected < 4.12.14-95.16.1fixed 4.12.14-95.16.1

  A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a syste

• CVE-2019-11487Apr 23, 2019
  affected < 4.12.14-95.19.1fixed 4.12.14-95.19.1

  The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm

• CVE-2019-11486Apr 23, 2019
  affected < 4.12.14-95.19.1fixed 4.12.14-95.19.1

  The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions.

• CVE-2019-3460Apr 11, 2019
  affected < 4.12.14-95.13.1fixed 4.12.14-95.13.1

  A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.

• CVE-2019-3459Apr 11, 2019
  affected < 4.12.14-95.13.1fixed 4.12.14-95.13.1

  A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1.

• CVE-2019-3874Mar 25, 2019
  affected < 4.12.14-95.83.2fixed 4.12.14-95.83.2

  The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are believed to be vulnerable.

• CVE-2018-20669Mar 18, 2019
  affected < 4.12.14-95.13.1fixed 4.12.14-95.13.1

  An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to overwrite arbitrary kern

• CVE-2018-19985Mar 17, 2019
  affected < 4.12.14-95.6.1fixed 4.12.14-95.6.1

  The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address

• CVE-2019-7222Mar 17, 2019
  affected < 4.12.14-95.13.1fixed 4.12.14-95.13.1

  The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.

• CVE-2019-7221Mar 17, 2019
  affected < 4.12.14-95.13.1fixed 4.12.14-95.13.1

  The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.

• CVE-2019-9213Mar 5, 2019
  affected < 4.12.14-95.13.1fixed 4.12.14-95.13.1

  In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.

• CVE-2019-9003Feb 22, 2019
  affected < 4.12.14-95.16.1fixed 4.12.14-95.16.1

  In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a "service ipmievd restart" loop.

• CVE-2019-8980Feb 21, 2019
  affected < 4.12.14-95.13.1fixed 4.12.14-95.13.1

  A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.

• CVE-2019-8912Feb 18, 2019
  affected < 4.12.14-95.13.1fixed 4.12.14-95.13.1

  In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr.

• CVE-2019-6974Feb 15, 2019
  affected < 4.12.14-95.13.1fixed 4.12.14-95.13.1

  In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.

• CVE-2019-7308Feb 1, 2019
  affected < 4.12.14-95.13.1fixed 4.12.14-95.13.1

  kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks.

• CVE-2018-16880Jan 29, 2019
  affected < 4.12.14-95.16.1fixed 4.12.14-95.16.1

  A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. D