In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.

Security update for the Linux Kernel

kernel: Integer overflow in the alarm_timer_nsleep function kernel: NULL pointer dereference in xfs_da_shrink_inode function kernel: use-after-free in ucma_leave_multicast in drivers/infiniband/core/ucma.c kernel: Unprivileged users able to inspect kernel stacks of arbitrary tasks kernel: TLB flush happens too late on mremap kernel: Type confusion in drivers/tty/n_tty.c allows for a denial of service kernel: userfaultfd bypasses tmpfs file permissions kernel: lack of check for mmap minimum address in expand_downwards in mm/mmap.c leads to NULL pointer dereferences exploit on non-SMAP platforms

Security update for the Linux Kernel (Live Patch 34 for SLE 12)

Affected: Ubuntu:14.04:LTS: linux, Ubuntu:14.04:LTS: linux-aws, Ubuntu:14.04:LTS: linux-azure, Ubuntu:14.04:LTS: linux-lts-xenial, Ubuntu:16.04:LTS: linux, Ubuntu:16.04:LTS: linux-aws, Ubuntu:16.04:LTS: linux-aws-hwe, Ubuntu:16.04:LTS: linux-azure, Ubuntu:16.04:LTS: linux-gcp, Ubuntu:16.04:LTS: linux-hwe and 24 more

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.