Debian LTS: Security Advisory for linux-4.19 (DLA-2483-1)

The remote host is missing an update for the 'linux-4.19' package(s) announced via the DLA-2483-1 advisory.

Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service or information leaks. CVE-2019-19039 'Team bobfuzzer' reported a bug in Btrfs that could lead to an assertion failure (WARN). A user permitted to mount and access arbitrary filesystems could use this to cause a denial of service (crash) if the panic_on_warn kernel parameter is set. CVE-2019-19377 'Team bobfuzzer' reported a bug in Btrfs that could lead to a use-after-free. A user permitted to mount and access arbitrary filesystems could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation. CVE-2019-19770 The syzbot tool discovered a race condition in the block I/O tracer (blktrace) that could lead to a system crash. Since blktrace can only be controlled by privileged users, the security impact of this is unclear. CVE-2019-19816 'Team bobfuzzer' reported a bug in Btrfs that could lead to an out-of-bounds write. A user permitted to mount and access arbitrary filesystems could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation. CVE-2020-0423 A race condition was discovered in the Android binder driver, that could result in a use-after-free. On systems using this driver, a local user could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation. CVE-2020-8694 Multiple researchers discovered that the powercap subsystem allowed all users to read CPU energy meters, by default. On systems using Intel CPUs, this provided a side channel that could leak sensitive information between user processes, or from the kernel to user processes. The energy meters are now readable only by root, by default. This issue can be mitigated by running: chmod go-r /sys/devices/virtual/powercap/*/*/energy_uj This needs to be repeated each time the system is booted with an unfixed kernel version. CVE-2020-14351 A race condition was discovered in the performance events subsystem, which could lead to a use-after-free. A local user permitted to access performance events could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation. Debian's kernel configuration does not allow unprivileged users to access performance events by default, which fully mitigates this issue. CVE-2020-25656 Yuan Ming and Bodong Zhao discovered a race condition in the virtual terminal (vt) driver that could lead to a use-after-free. A local user with the CAP_SYS_TTY_CONFIG capability could use this to caus ... Description truncated. Please see the references for more information.

'linux-4.19' package(s) on Debian Linux.

Checks if a vulnerable package version is present on the target host.

For Debian 9 stretch, these problems have been fixed in version 4.19.160-2~deb9u1. We recommend that you upgrade your linux-4.19 packages.