[ASA-202003-6] linux: multiple issues
foxboron at archlinux.org
Thu Mar 12 18:47:29 UTC 2020
Arch Linux Security Advisory ASA-202003-6
Date : 2020-03-08
CVE-ID : CVE-2020-2732 CVE-2020-9383
Package : linux
Type : multiple issues
Remote : No
Link : https://security.archlinux.org/AVG-1108
The package linux before version 5.5.7.arch1-1 is vulnerable to
multiple issues including authentication bypass and information
Upgrade to 5.5.7.arch1-1.
# pacman -Syu "linux>=5.5.7.arch1-1"
The problems have been fixed upstream in version 5.5.7.arch1.
- CVE-2020-2732 (information disclosure)
An issue has been found in KVM before 5.5.7, where vmx_check_intercept
ws is not yet fully implemented on Intel processors, causing e.g. the
I/O or MSR interception bitmaps not to be checked. This in turn allowed
the L2 guest to trick the L0 hypervisor into accessing sensitive
information on the L1 hypervisor.
- CVE-2020-9383 (authentication bypass)
An issue was discovered in the Linux kernel through 5.5.6. set_fdc in
drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read
because the FDC index is not checked for errors before assigning it,
A local malicious attacker can disclose sensitive information through
side-channel cache attacks, or bypass authentication measures by
abusing the floppy drivers.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security