Arch Linux Security Advisory ASA-202003-6 ========================================= Severity: High Date : 2020-03-08 CVE-ID : CVE-2020-2732 CVE-2020-9383 Package : linux Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1108 Summary ======= The package linux before version 5.5.7.arch1-1 is vulnerable to multiple issues including authentication bypass and information disclosure. Resolution ========== Upgrade to 5.5.7.arch1-1. # pacman -Syu "linux>=5.5.7.arch1-1" The problems have been fixed upstream in version 5.5.7.arch1. Workaround ========== None. Description =========== - CVE-2020-2732 (information disclosure) An issue has been found in KVM before 5.5.7, where vmx_check_intercept ws is not yet fully implemented on Intel processors, causing e.g. the I/O or MSR interception bitmaps not to be checked. This in turn allowed the L2 guest to trick the L0 hypervisor into accessing sensitive information on the L1 hypervisor. - CVE-2020-9383 (authentication bypass) An issue was discovered in the Linux kernel through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2. Impact ====== A local malicious attacker can disclose sensitive information through side-channel cache attacks, or bypass authentication measures by abusing the floppy drivers. References ========== https://www.openwall.com/lists/oss-security/2020/02/25/3 https://www.spinics.net/lists/kvm/msg208259.html https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... https://github.com/torvalds/linux/commit/2e90ca68b0d2f5548804f22f0dd61145516... https://security.archlinux.org/CVE-2020-2732 https://security.archlinux.org/CVE-2020-9383