An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.

An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.

Security update for the Linux Kernel

kernel: nfs: use-after-free in svc_process_common() kernel: Information Disclosure in crypto_report_one in crypto/crypto_user.c kernel: oob memory read in hso_probe in drivers/net/usb/hso.c kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS kernel: Heap address information leak while using L2CAP_GET_CONF_OPT kernel: Heap address information leak while using L2CAP_PARSE_CONF_RSP kernel: SCTP socket buffer memory leak leading to denial of service kernel: denial of service vector through vfio DMA mappings Kernel: vhost_net: infinite loop while receiving packets leads to DoS Kernel: page cache side channel attacks Kernel: KVM: leak of uninitialized stack contents to guest hardware: bluetooth: BR/EDR encryption key negotiation attacks (KNOB) kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c kernel: null-pointer dereference in hci_uart_set_flow_control Kernel: net: weak IP ID generation leads to remote device tracking kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping kernel: fs/ext4/extents.c leads to information disclosure kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command kernel: use-after-free in arch/x86/lib/insn-eval.c Kernel: KVM: OOB memory access via mmio ring buffer kernel: out-of-bounds array access in __xfrm_policy_unlink kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of…

Security update for the Linux Kernel

Affected: Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:14.04:LTS: linux, Ubuntu:16.04:LTS: linux, Ubuntu:16.04:LTS: linux-aws, Ubuntu:16.04:LTS: linux-aws-hwe, Ubuntu:16.04:LTS: linux-azure, Ubuntu:16.04:LTS: linux-gcp, Ubuntu:16.04:LTS: linux-hwe and 31 more

An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.