Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

In the Linux kernel, the following vulnerability has been resolved:

spi: Fix null dereference on suspend

A race condition exists where a synchronous (noqueue) transfer can be active during a system suspend. This can cause a null pointer dereference exception to occur when the system resumes.

Example order of events leading to the exception: 1. spi_sync() calls __spi_transfer_message_noqueue() which sets ctlr->cur_msg 2. Spi transfer begins via spi_transfer_one_message() 3. System is suspended interrupting the transfer context 4. System is resumed 6. spi_controller_resume() calls spi_start_queue() which resets cur_msg to NULL 7. Spi transfer context resumes and spi_finalize_current_message() is called which dereferences cur_msg (which is now NULL)

Wait for synchronous transfers to complete before suspending by acquiring the bus mutex and setting/checking a suspend flag.

In the Linux kernel, the following vulnerability has been resolved:

spi: Fix null dereference on suspend

A race condition exists where a synchronous (noqueue) transfer can be active during a system suspend. This can cause a null pointer dereference exception to occur when the system resumes.

Example order of events leading to the exception: 1. spi_sync() calls __spi_transfer_message_noqueue() which sets ctlr->cur_msg 2. Spi transfer begins via spi_transfer_one_message() 3. System is suspended interrupting the transfer context 4. System is resumed 6. spi_controller_resume() calls spi_start_queue() which resets cur_msg to NULL 7. Spi transfer context resumes and spi_finalize_current_message() is called which dereferences cur_msg (which is now NULL)

Wait for synchronous transfers to complete before suspending by acquiring the bus mutex and setting/checking a suspend flag.

kernel: cifs: fix oops during encryption kernel: x86/mm: Randomize per-cpu entry area kernel: pstore/ram: Fix crash when setting number of cpus to an odd number kernel: spi: Fix null dereference on suspend kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number kernel: scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() kernel: scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() kernel: nouveau: fix instmem race condition around ptr stores kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout kernel: scsi: mpi3mr: Avoid memcpy field-spanning write WARNING kernel: s390/qeth: Fix kernel panic after setting hsuid kernel: tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). kernel: drm/radeon: fix UBSAN warning in kv_dpm.c kernel: bpf: Fix overrunning reservations in ringbuf kernel: xfs: add bounds checking to xlog_recover_process_data kernel: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() kernel: drm/amdgpu: avoid using null object of framebuffer kernel: tcp_metrics: validate source addr length kernel: x86/bhi: Avoid warning in #DB handler due to BHI mitigation kernel: block: initialize integrity buffer to zero before writing it to media

Security update for the Linux Kernel

Affected: Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 161 more

In the Linux kernel, the following vulnerability has been resolved: spi: Fix null dereference on suspend A race condition exists where a synchronous (noqueue) transfer can be active during a system suspend. This can cause a null pointer dereference exception to occur when the system resumes. Example order of events leading to the exception: 1. spi_sync() calls __spi_transfer_message_noqueue() which sets ctlr->cur_msg 2. Spi transfer begins via spi_transfer_one_message() 3. System is suspended interrupting the transfer context 4. System is resumed 6. spi_controller_resume() calls spi_start_queue() which resets cur_msg to NULL 7. Spi transfer context resumes and spi_finalize_current_message() is called which dereferences cur_msg (which is now NULL) Wait for synchronous transfers to complete before suspending by acquiring the bus mutex and setting/checking a suspend flag.

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder unspezifische Angriffe durchzuführen.