In the Linux kernel, the following vulnerability has been resolved:

KVM: VMX: Prevent RSB underflow before vmenter

On VMX, there are some balanced returns between the time the guest's SPEC_CTRL value is written, and the vmenter.

Balanced returns (matched by a preceding call) are usually ok, but it's at least theoretically possible an NMI with a deep call stack could empty the RSB before one of the returns.

For maximum paranoia, don't allow *any* returns (balanced or otherwise) between the SPEC_CTRL write and the vmenter.

[ bp: Fix 32-bit build. ]

In the Linux kernel, the following vulnerability has been resolved:

KVM: VMX: Prevent RSB underflow before vmenter

On VMX, there are some balanced returns between the time the guest's SPEC_CTRL value is written, and the vmenter.

Balanced returns (matched by a preceding call) are usually ok, but it's at least theoretically possible an NMI with a deep call stack could empty the RSB before one of the returns.

For maximum paranoia, don't allow *any* returns (balanced or otherwise) between the SPEC_CTRL write and the vmenter.

[ bp: Fix 32-bit build. ]

kernel: information leak in scsi_ioctl() kernel: kernel info leak issue in pfkey_register kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions hw: cpu: AMD: Branch Type Confusion (non-retbleed) hw: cpu: Intel: information disclosure via local access hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions kernel: KVM: VMX: Prevent RSB underflow before vmenter kernel: x86/speculation: Fill RSB on vmexit for IBRS kernel: iavf: Fix reset error handling kernel: iavf: Fix NULL pointer dereference in iavf_get_link_ksettings kernel: iavf: Fix adminq error handling

kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() kernel: watch queue race condition can lead to privilege escalation hw: cpu: incomplete clean-up of multi-core shared buffers (aka SBDR) hw: cpu: incomplete clean-up of microarchitectural fill buffers (aka SBDS) hw: cpu: incomplete clean-up in specific special register write operations (aka DRPW) hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions hw: cpu: AMD: Branch Type Confusion (non-retbleed) hw: cpu: Intel: Post-barrier Return Stack Buffer Predictions hw: cpu: Intel: information disclosure via local access hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions kernel: nfsd buffer overflow by RPC message over TCP with garbage data kernel: net: openvswitch: fix leak of nested actions kernel: KVM: VMX: Prevent RSB underflow before vmenter kernel: x86/speculation: Fill RSB on vmexit for IBRS

Security update for the Linux Kernel

Affected: Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 144 more

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Prevent RSB underflow before vmenter On VMX, there are some balanced returns between the time the guest's SPEC_CTRL value is written, and the vmenter. Balanced returns (matched by a preceding call) are usually ok, but it's at least theoretically possible an NMI with a deep call stack could empty the RSB before one of the returns. For maximum paranoia, don't allow *any* returns (balanced or otherwise) between the SPEC_CTRL write and the vmenter. [ bp: Fix 32-bit build. ]