Important: kernel security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-8694: A flaw was found in the Linux kernel's implementation of Intel's Running Average Power Limit (RAPL) implementation. A local attacker could infer secrets by measuring power usage and also infer private data by observing the power usage of calculations performed on the data. 1828580: CVE-2020-8694 kernel: Insufficient access control vulnerability in PowerCap Framework CVE-2020-28974: A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height. 1903126: CVE-2020-28974 kernel: slab-out-of-bounds read in fbcon CVE-2020-28941: An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once. 99999: CVE-2020-28941 kernel: NULL pointer dereference in spk_ttyio_ldisc_close function in drivers/accessibility/speakup/spk_ttyio.c CVE-2020-27777: No description is available for this CVE. 1900844: CVE-2020-27777 kernel: powerpc: RTAS calls can be used to compromise kernel integrity CVE-2020-27675: An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5. 99999: CVE-2020-27675 kernel: xen: race condition in event-channel removal during the event-handling loop (XSA-331) CVE-2020-27673: An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271. 99999: CVE-2020-27673 kernel: xen: guest OS users can cause a DoS via a high rate of events to dom0 (XSA-332) CVE-2020-25704: A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service. 1895961: CVE-2020-25704 kernel: perf_event_parse_addr_filter memory CVE-2020-25669: No description is available for this CVE. 1892176: CVE-2020-25669 kernel: use-after-free read in sunkbd_reinit in drivers/input/keyboard/sunkbd.c CVE-2020-25668: No description is available for this CVE. 1893287: CVE-2020-25668 kernel: race condition in fg_console can lead to use-after-free in con_font_op CVE-2020-25656: A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality. 1888726: CVE-2020-25656 kernel: use-after-free in read in vt_do_kdgkb_ioctl CVE-2020-14351: A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 1862849: CVE-2020-14351 kernel: performance counters race condition use-after-free CVE-2019-19770: A use-after-free flaw was found in the debugfs_remove function in the Linux kernel. The flaw could allow a local attacker with special user (or root) privilege to crash the system at the time of file or directory removal. This vulnerability can lead to a kernel information leak. The highest threat from this vulnerability is to system availability. 1786179: CVE-2019-19770 kernel: use-after-free in debugfs_remove in fs/debugfs/inode.c