Nadav Amit

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A race condition is possible in the Linux kernel when a process exits and its VMAs are removed by `exit mmap()` at the same time `userfaultfd writeprotect()` is called. This issue was detected by KASAN on a development kernel and appears to be possible on vanilla kernels as well. The race can be prevented by using `mmget not zero()` as done in other `userfaultfd` operations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.18.1 **Description** The issue is related to the mishandling of certain indirect calls in the arch/x86/kernel/paravirt.c file, making it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests. This can potentially allow an attacker to access confidential data. **Recommendations** For Linux kernel versions prior to 4.18.1, update to version 4.18.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 3.18.5 **Description** The issue allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction, specifically when the guest OS lacks SYSENTER MSR initialization. This occurs due to a problem in the em sysenter function in arch/x86/kvm/emulate.c. **Recommendations** For Linux kernel versions prior to 3.18.5, update to version 3.18.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 2.6.38 **Description** A race condition issue exists that allows L2 guest OS users to cause a denial of service, specifically an L1 guest OS crash, by utilizing a crafted instruction. This instruction triggers an L2 emulation failure report. **Recommendations** For Linux kernel versions prior to 2.6.38, update to version 2.6.38 or later to resolve the issue.