[ASA-202011-10] linux-hardened: multiple issues
anthraxx at archlinux.org
Tue Nov 10 23:05:08 UTC 2020
Arch Linux Security Advisory ASA-202011-10
Date : 2020-11-10
CVE-ID : CVE-2020-8694 CVE-2020-25704
Package : linux-hardened
Type : multiple issues
Remote : No
Link : https://security.archlinux.org/AVG-1269
The package linux-hardened before version 5.9.8.a-1 is vulnerable to
multiple issues including denial of service and information disclosure.
Upgrade to 5.9.8.a-1.
# pacman -Syu "linux-hardened>=5.9.8.a-1"
The problems have been fixed upstream in version 5.9.8.a.
A temporary measure would be to remove the ability for non-root users
to read the current RAPL energy reporting metrics.
This can be done with the command:
# sudo chmod 400 /sys/class/powercap/intel_rapl/*/energy_uj
This mitigation will only work on the current boot and will need to be
reapplied at each system boot to remain in effect.
- CVE-2020-8694 (information disclosure)
An information disclosure flaw was found in the Linux kernel's Intel
Running Average Power Limit (RAPL) implementation. A local non-
privileged attacker could infer secrets by measuring power usage and
also infer private data by observing the power usage of calculations
performed on the data.
- CVE-2020-25704 (denial of service)
A memory leak has been found in the perf_event_parse_addr_filter
function of Linux before 5.9.7, leading to a denial of service.
A local attacker might be able to exhaust the memory available on the
system, causing a denial of service, or access sensitive information by
observing the power usage.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: OpenPGP digital signature
More information about the arch-security