MGASA-2020-0158

This update is based on upstream 5.5.15 and fixes at least the following security vulnerabilities:

In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the _blkaddtrace function in kernel/trace/blktrace.c (which is used to fill out a blkio_trace structure and place it in a per-cpu sub-buffer) (CVE-2019-19768).

In the Linux kernel 5.3.10, there is a use-after-free (read) in the perftracelock_acquire function (related to include/trace/events/lock.h) (CVE-2019-19769).

A flaw was found in the way KVM hypervisor handled instruction emulation for the L2 guest when nested(=1) virtualization is enabled. In the instruction emulation, the L2 guest could trick the L0 hypervisor into accessing sensitive bits of the L1 hypervisor. An L2 guest could use this flaw to potentially access information of the L1 hypervisor (CVE-2020-2732).

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vcdoresize function in drivers/tty/vt/vt.c (CVE-2020-8647).

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the nttyreceivebufcommon function in drivers/tty/n_tty.c (CVE-2020-8648).

Manfred Paul discovered that the bpf verifier in the Linux kernel did not properly calculate register bounds for certain operations. A local attacker could use this to expose sensitive information (kernel memory) or gain administrative privileges (CVE-2020-8835).

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgaconinvertregion function in drivers/video/console/vgacon.c. (CVE-2020-8649).

An issue was discovered in the Linux kernel through 5.5.6. setfdc in drivers/block/floppy.c leads to a waittil_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2 (CVE-2020-9383).

An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID- dcde237319e6. This has been observed to cause heap corruption with the GNU C Library malloc implementation (CVE-2020-9391).

Security fixes and hardenings to the mac00211 layer to prevent leaking keys and frames.

For other upstream fixes in this update, see the referenced changelogs.