[ALAS-2021-1461] Amazon Linux AMI 2014.03 - ALAS-2021-1461: medium priority package update for kernel

Package updates are available for Amazon Linux AMI that fix the following vulnerabilities:
CVE-2020-8694:
A flaw was found in the Linux kernel's implementation of Intel's Running Average Power Limit (RAPL) implementation. A local attacker could infer secrets by measuring power usage and also infer private data by observing the power usage of calculations performed on the data.
1828580: CVE-2020-8694 kernel: Insufficient access control vulnerability in PowerCap Framework

CVE-2020-28974:
An out-of-bounds (OOB) SLAB memory access flaw was found in the Linux kernel's fbcon driver module. A bounds check failure allows a local attacker with special user privileges to gain access to out-of-bounds memory, leading to a system crash or leaking of internal kernel information. The highest threat from this vulnerability is to system availability.
A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height.
1903126: CVE-2020-28974 kernel: slab-out-of-bounds read in fbcon

CVE-2020-28941:
An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once.

CVE-2020-28941 kernel: NULL pointer dereference in spk_ttyio_ldisc_close function in drivers/accessibility/speakup/spk_ttyio.c

CVE-2020-27777:
No description is available for this CVE.
A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.
1900844: CVE-2020-27777 kernel: powerpc: RTAS calls can be used to compromise kernel integrity

CVE-2020-27675:
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5.

CVE-2020-27675 kernel: xen: race condition in event-channel removal during the event-handling loop (XSA-331)

CVE-2020-27673:
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.

CVE-2020-27673 kernel: xen: guest OS users can cause a DoS via a high rate of events to dom0 (XSA-332)

CVE-2020-25704:
A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.
1895961: CVE-2020-25704 kernel: perf_event_parse_addr_filter memory

CVE-2020-25669:
No description is available for this CVE.
1892176: CVE-2020-25669 kernel: use-after-free read in sunkbd_reinit in drivers/input/keyboard/sunkbd.c

CVE-2020-25668:
No description is available for this CVE.
1893287: CVE-2020-25668 kernel: race condition in fg_console can lead to use-after-free in con_font_op

CVE-2020-25656:
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.
1888726: CVE-2020-25656 kernel: use-after-free in read in vt_do_kdgkb_ioctl

CVE-2020-14351:
A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
1862849: CVE-2020-14351 kernel: performance counters race condition use-after-free

CVE-2019-19770:
A use-after-free flaw was found in the debugfs_remove function in the Linux kernel. The flaw could allow a local attacker with special user (or root) privilege to crash the system at the time of file or directory removal. This vulnerability can lead to a kernel information leak. The highest threat from this vulnerability is to system availability.
1786179: CVE-2019-19770 kernel: use-after-free in debugfs_remove in fs/debugfs/inode.c