SB2020061742 - Fedora 32 update for kernel
Published: June 17, 2020 Updated: April 25, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Race condition (CVE-ID: CVE-2020-10766)
The vulnerability allows a local user to gain access to sensitive information.
A logic bug flaw was found in Linux kernel before 5.8-rc1 in the
implementation of SSBD. A bug in the logic handling allows an attacker
with a local account to disable SSBD protection during a context switch
when additional speculative execution mitigations are in place. This
issue was introduced when the per task/process conditional STIPB
switching was added on top of the existing SSBD switching.
2) Resource management error (CVE-ID: CVE-2020-10767)
The vulnerability allows a local user to gain access to sensitive information.
A flaw was found in the Linux kernel before 5.8-rc1 in the
implementation of the Enhanced IBPB (Indirect Branch Prediction
Barrier). The IBPB mitigation will be disabled when STIBP is not
available or when the Enhanced Indirect Branch Restricted Speculation
(IBRS) is available. This flaw allows a local user to perform a Spectre
V2 style attack when this configuration is active.
3) Input validation error (CVE-ID: CVE-2020-10768)
The vulnerability allows a local authenticated user to gain access to sensitive information.
A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.
Remediation
Install update from vendor's website.