RHSA-2020:4431MediumCVSS 7.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
November 4, 2020
Last Modified
October 16, 2026

🔗 CVE IDs covered (51)

CVE-2019-19332 →CVE-2019-19447 →CVE-2020-0444 →CVE-2020-12465 →CVE-2019-18808 →CVE-2019-19319 →CVE-2019-20636 →CVE-2020-8648 →CVE-2020-10773 →CVE-2020-12659 →CVE-2020-12826 →CVE-2022-50219 →CVE-2019-19543 →CVE-2019-19602 →CVE-2020-10751 →CVE-2019-19770 →CVE-2019-9458 →CVE-2019-15925 →CVE-2019-19046 →CVE-2020-11565 →CVE-2019-19524 →CVE-2019-19537 →CVE-2019-15917 →CVE-2019-16233 →CVE-2019-19056 →CVE-2019-19062 →CVE-2020-0305 →CVE-2020-8647 →CVE-2019-19533 →CVE-2019-20054 →CVE-2020-10732 →CVE-2020-10774 →CVE-2020-10942 →CVE-2020-12655 →CVE-2020-12770 →CVE-2020-14381 →CVE-2019-18809 →CVE-2020-8649 →CVE-2020-11668 →CVE-2020-25641 →CVE-2025-21727 →CVE-2019-20812 →CVE-2019-9455 →CVE-2019-12614 →CVE-2019-16231 →CVE-2019-19072 →CVE-2019-19767 →CVE-2021-3715 →CVE-2023-53585 →CVE-2019-19063 →CVE-2019-19068 →

📋 Description

CVE-2019-9455 — kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information disclosure CVE-2019-9458 — kernel: use after free due to race condition in the video driver leads to local privilege escalation CVE-2019-12614 — kernel: null pointer dereference in dlpar_parse_cc_property in arch/powerrc/platforms/pseries/dlpar.c causing denial of service CVE-2019-15917 — kernel: use-after-free in drivers/bluetooth/hci_ldisc.c CVE-2019-15925 — kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg CVE-2019-16231 — kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c CVE-2019-16233 — kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c CVE-2019-18808 — kernel: memory leak in ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c CVE-2019-18809 — kernel: memory leak in af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c CVE-2019-19046 — kernel: Denial Of Service in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c CVE-2019-19056 — kernel: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c allows to cause DoS CVE-2019-19062 — kernel: memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for DoS CVE-2019-19063 — kernel: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c allow for a DoS CVE-2019-19068 — kernel: A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c allows for a DoS CVE-2019-19072 — kernel: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c allows for a DoS CVE-2019-19319 — kernel: out-of-bounds write in ext4_xattr_set_entry in fs/ext4/xattr.c CVE-2019-19332 — Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid CVE-2019-19447 — kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c CVE-2019-19524 — kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free CVE-2019-19533 — kernel: information leak bug caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c CVE-2019-19537 — kernel: race condition caused by a malicious USB device in the USB character device driver layer CVE-2019-19543 — kernel: use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c CVE-2019-19602 — kernel: cached use of fpu_fpregs_owner_ctx in arch/x86/include/asm/fpu/internal.h can lead to DoS CVE-2019-19767 — kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry related to fs/ext4/inode.c and fs/ext4/super.c CVE-2019-19770 — kernel: use-after-free in debugfs_remove in fs/debugfs/inode.c CVE-2019-20054 — kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c CVE-2019-20636 — kernel: out-of-bounds write via crafted keycode table CVE-2019-20812 — kernel: af_packet: TPACKET_V3: invalid timer timeout on error CVE-2020-0305 — kernel: possible use-after-free due to a race condition in cdev_get of char_dev.c CVE-2020-0444 — kernel: bad kfree in auditfilter.c may lead to escalation of privilege CVE-2020-8647 — kernel: out-of-bounds read in in vc_do_resize function in drivers/tty/vt/vt.c CVE-2020-8648 — kernel: use-after-free in n_tty_receive_buf_common function in drivers/tty/n_tty.c CVE-2020-8649 — kernel: invalid read location in vgacon_invert_region function in drivers/video/console/vgacon.c CVE-2020-10732 — kernel: uninitialized kernel data leak in userspace coredumps CVE-2020-10751 — kernel: SELinux netlink permission check bypass CVE-2020-10773 — kernel: kernel stack information leak on s390/s390x CVE-2020-10774 — kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features CVE-2020-10942 — kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field CVE-2020-11565 — kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c CVE-2020-11668 — kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c CVE-2020-12465 — kernel: buffer overflow in mt76_add_fragment function in drivers/net/wireless/mediatek/mt76/dma.c CVE-2020-12655 — kernel: sync of excessive duration via an XFS v5 image with crafted metadata CVE-2020-12659 — kernel: xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write which could result in crash and data coruption CVE-2020-12770 — kernel: sg_write function lacks an sg_remove_request call in a certain failure case CVE-2020-12826 — kernel: possible to send arbitrary signals to a privileged (suidroot) parent process CVE-2020-14381 — kernel: referencing inode of removed superblock in get_futex_key() causes UAF CVE-2020-25641 — kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS CVE-2021-3715 — kernel: use-after-free in route4_change() in net/sched/cls_route.c CVE-2022-50219 — kernel: bpf: Fix KASAN use-after-free Read in compute_effective_progs CVE-2023-53585 — kernel: bpf: reject unhashed sockets in bpf_sk_assign CVE-2025-21727 — kernel: padata: fix UAF in padata_reorder

🎯 Affected products122

  • Red Hat CodeReady Linux Builder (v. 8)
  • Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-240.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-240.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-240.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-240.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-240.el8.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)
  • bpftool-debuginfo-0:4.18.0-240.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-240.el8.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)
  • bpftool-debuginfo-0:4.18.0-240.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-240.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-240.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)
  • bpftool-debuginfo-0:4.18.0-240.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-240.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-240.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-240.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-240.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-240.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-abi-whitelists-0:4.18.0-240.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-240.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-240.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-240.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-240.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-240.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-240.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-240.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-240.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-240.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-240.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-240.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • +92 more not shown

✅ Remediation

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, prevent modules v4l2-common, v4l2-dv-timings from being loaded if not being used for primary display. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this issue, prevent module hci_uart from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: Blacklisting the affected HCLGE driver module until a patch is available can be done using the blacklist mechanism. This will ensure the driver is not loaded at boot time. For instructions on how to black list a kernel module, please read: https://access.redhat.com/solutions/41278. Workaround: In order to mitigate this issue it is possible to prevent the affected code from being loaded by blacklisting the kernel module ccp. For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278 Workaround: In order to mitigate this issue it is possible to prevent the affected code from being loaded by blacklisting the kernel module dvb-usb-af9005. For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278 Workaround: In order to mitigate this issue it is possible to prevent the affected code from being loaded by blacklisting the kernel module mwifiex_pcie. For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278 . Workaround: In order to mitigate this issue it is possible to prevent the affected code from being loaded by blacklisting the kernel module crypto_user. For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278 . Workaround: In order to mitigate this issue it is possible to prevent the affected code from being loaded by blacklisting the kernel module rtl8192cu. For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278 . Workaround: In order to mitigate this issue it is possible to prevent the affected code from being loaded by blacklisting the kernel module rtl8xxxu. For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278 . Workaround: Ext4 filesytems are built into the kernel so it is not possible to prevent the kernel module from loading. However, this flaw can be prevented by disallowing mounting of untrusted filesystems. As mounting is a privileged operation, (except for device hotplug) removing the ability for mounting and unmounting will prevent this flaw from being exploited. Workaround: To mitigate this issue for the Red Hat Enterprise Linux 7 or higher version, prevent module ff-memless from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: As the ttusb_dec module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions: # echo "install ttusb_dec /bin/true" >> /etc/modprobe.d/disable-cifs.conf The system will need to be restarted if the ttusb_dec module is already loaded. In most circumstances, the CIFS kernel module will be unable to be unloaded while the device is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. Workaround: Many Character devices can trigger this flaw as they leverage the lower levels of the USB subsystem. The safest method that I have found would be to disable USB ports that are able to be attacked using this method, disable them first by disallowing them from waking up from low-power states with the command (Replace X with the port number available). echo disabled >> /sys/bus/usb/devices/usbX/power/wakeup The system must also disable the specific ports power after with the command: echo suspend | sudo tee /sys/bus/usb/devices/usbX/power/level This change not persist through system reboots and must be applied at each reboot to be effective. Workaround: As the module will be auto-loaded when the relevant hardware is required, its use can be disabled by preventing the module from loading with the following instructions: # echo "install serial_ir /bin/true" >> /etc/modprobe.d/disable-serial-ir.conf The system will need to be restarted if the CIFS modules are loaded. In most circumstances, the CIFS kernel modules will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. Workaround: The mitigation is not to use debug_want_extra_isize parameter when mounting ext4 FS. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible. Workaround: The attack vector can be significantly reduced by preventing users from being able to log into the local virtual console. See the instructions on disabling local login here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/managing_smart_cards/pam_configuration_files , See the section on "pam_console" to deny users logging into the console. This mechanism should work from el6 forward to current versions of Red Hat Enterprise Linux. Workaround: Possible mitigation would be to disable core dumps system-wide by setting: * hard core 0 In the /etc/security/limits.conf file and restarting applications/services/processes which users may have access to or simply reboot the system. This disables core dumps which may not be a suitable workaround in your environment. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is to skip loading the affected module 'xirlink-cit' onto the system till we have a fix available, this can be done by a blacklist mechanism, this will ensure the driver is not loaded at the boot time. ~~~ How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ Workaround: Mitigation for this issue is to skip loading the affected module mt76 onto the system until we have a fix available. This can be done by a blacklist mechanism and ensures the driver is not loaded at the boot time. ~~~ How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ Workaround: This flaw requires an attacker being able to have the system mount a crafted filesystem. If the xfs filesystem is not in use, the 'xfs' kernel module can be blacklisted and the module will not be loaded when the filesystem is mounted, mounting will fail. However, if thi…

🔗 References (57)