Medium: kernel

Issue Overview:

A use-after-free flaw was found in the debugfs_remove function in the Linux kernel. The flaw could allow a local attacker with special user (or root) privilege to crash the system at the time of file or directory removal. This vulnerability can lead to a kernel information leak. The highest threat from this vulnerability is to system availability. (CVE-2019-19770 __)

A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-14351 __)

A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality. (CVE-2020-25656 __)

A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op. (CVE-2020-25668 __)

The function sunkbd_reinit having been scheduled by sunkbd_interrupt before the struct sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit thus causing UAF. (CVE-2020-25669 __)

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service. (CVE-2020-25704 __)

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271. (CVE-2020-27673 __)

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5. (CVE-2020-27675 __)

The Linux kernel for powerpc has an issue with the Run-Time Abstraction Services (RTAS) interface, allowing root (or CAP_SYS_ADMIN users) in a VM to overwrite some parts of memory, including kernel memory. (CVE-2020-27777 __)

An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once. (CVE-2020-28941 __)

An out-of-bounds (OOB) SLAB memory access flaw was found in the Linux kernel’s fbcon driver module. A bounds check failure allows a local attacker with special user privileges to gain access to out-of-bounds memory, leading to a system crash or leaking of internal kernel information. The highest threat from this vulnerability is to system availability. (CVE-2020-28974 __)

A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height. (CVE-2020-28974 __)

A flaw was found in the Linux kernel’s implementation of Intel’s Running Average Power Limit (RAPL) implementation. A local attacker could infer secrets by measuring power usage and also infer private data by observing the power usage of calculations performed on the data. (CVE-2020-8694 __)

Affected Packages:

kernel

Issue Correction:
Run yum update kernel to update your system.

New Packages:

i686:  
    kernel-debuginfo-common-i686-4.14.209-117.337.amzn1.i686  
    kernel-tools-devel-4.14.209-117.337.amzn1.i686  
    kernel-headers-4.14.209-117.337.amzn1.i686  
    kernel-tools-4.14.209-117.337.amzn1.i686  
    perf-4.14.209-117.337.amzn1.i686  
    kernel-devel-4.14.209-117.337.amzn1.i686  
    kernel-tools-debuginfo-4.14.209-117.337.amzn1.i686  
    kernel-debuginfo-4.14.209-117.337.amzn1.i686  
    perf-debuginfo-4.14.209-117.337.amzn1.i686  
    kernel-4.14.209-117.337.amzn1.i686  
  
src:  
    kernel-4.14.209-117.337.amzn1.src  
  
x86_64:  
    kernel-4.14.209-117.337.amzn1.x86_64  
    kernel-tools-devel-4.14.209-117.337.amzn1.x86_64  
    kernel-debuginfo-common-x86_64-4.14.209-117.337.amzn1.x86_64  
    kernel-debuginfo-4.14.209-117.337.amzn1.x86_64  
    kernel-tools-4.14.209-117.337.amzn1.x86_64  
    kernel-headers-4.14.209-117.337.amzn1.x86_64  
    perf-debuginfo-4.14.209-117.337.amzn1.x86_64  
    kernel-devel-4.14.209-117.337.amzn1.x86_64  
    kernel-tools-debuginfo-4.14.209-117.337.amzn1.x86_64  
    perf-4.14.209-117.337.amzn1.x86_64