Debian LTS: DLA-1799-2 Critical: Linux Kernel Security Update

CVE-2018-5995

ADLab of VenusTech discovered that the kernel logged the virtual
addresses assigned to per-CPU data, which could make it easier to
exploit other vulnerabilities.

CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091

Multiple researchers have discovered vulnerabilities in the way
that Intel processor designs implement speculative forwarding of
data filled into temporary microarchitectural structures
(buffers). This flaw could allow an attacker controlling an
unprivileged process to read sensitive information, including from
the kernel and all other processes running on the system, or
across guest/host boundaries to read host memory.

See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html
for more details.

To fully resolve these vulnerabilities it is also necessary to
install updated CPU microcode. An updated intel-microcode package
(only available in Debian non-free) was provided via DLA-1789-1.