SUSE-SU-2019:1287-1: important: Security update for the Linux Kernel
sle-updates at lists.suse.com
sle-updates at lists.suse.com
Fri May 17 13:08:57 MDT 2019
SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________
Announcement ID: SUSE-SU-2019:1287-1
Rating: important
References: #1012382 #1024908 #1034113 #1043485 #1068032
#1073311 #1080157 #1080533 #1082632 #1087231
#1087659 #1087906 #1093158 #1094268 #1096748
#1100152 #1103186 #1106913 #1109772 #1111331
#1112178 #1113399 #1116841 #1118338 #1119019
#1122822 #1124832 #1125580 #1129279 #1131416
#1131427 #1131587 #1132673 #1132828 #1133188
Cross-References: CVE-2016-8636 CVE-2017-17741 CVE-2017-18174
CVE-2018-1091 CVE-2018-1120 CVE-2018-1128
CVE-2018-1129 CVE-2018-12126 CVE-2018-12127
CVE-2018-12130 CVE-2018-19407 CVE-2019-11091
CVE-2019-11486 CVE-2019-3882 CVE-2019-8564
CVE-2019-9503
Affected Products:
SUSE OpenStack Cloud 7
SUSE Linux Enterprise Server for SAP 12-SP2
SUSE Linux Enterprise Server 12-SP2-LTSS
SUSE Linux Enterprise Server 12-SP2-BCL
SUSE Linux Enterprise High Availability 12-SP2
SUSE Enterprise Storage 4
OpenStack Cloud Magnum Orchestration 7
______________________________________________________________________________
An update that solves 16 vulnerabilities and has 19 fixes
is now available.
Description:
The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various
security and bugfixes.
Four new speculative execution information leak issues have been
identified in Intel CPUs. (bsc#1111331)
- CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)
- CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)
- CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)
- CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory
(MDSUM)
This kernel update contains software mitigations for these issues, which
also utilize CPU microcode updates shipped in parallel.
For more information on this set of information leaks, check out
https://www.suse.com/support/kb/doc/?id=7023736
The following security bugs were fixed:
- CVE-2018-1128: It was found that cephx authentication protocol did not
verify ceph clients correctly and was vulnerable to replay attack. Any
attacker having access to ceph cluster network who is able to sniff
packets on network could use this vulnerability to authenticate with
ceph service and perform actions allowed by ceph service. (bnc#1096748).
- CVE-2018-1129: A flaw was found in the way signature calculation was
handled by cephx authentication protocol. An attacker having access to
ceph cluster network who is able to alter the message payload was able
to bypass signature checks done by cephx protocol. (bnc#1096748).
- CVE-2016-8636: Integer overflow in the mem_check_range function in
drivers/infiniband/sw/rxe/rxe_mr.c allowed local users to cause a denial
of service (memory corruption), obtain sensitive information or possibly
have unspecified other impact via a write or read request involving the
"RDMA protocol over infiniband" (aka Soft RoCE) technology (bnc#1024908).
- CVE-2017-18174: In the amd_gpio_remove function in
drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function,
leading to a double free (bnc#1080533).
- CVE-2018-1091: In the flush_tmregs_to_thread function in
arch/powerpc/kernel/ptrace.c, a guest kernel crash can be triggered from
unprivileged userspace during a core dump on a POWER host due to a
missing processor feature check and an erroneous use of transactional
memory (TM) instructions in the core dump path, leading to a denial of
service (bnc#1087231).
- CVE-2018-1120: By mmap()ing a FUSE-backed file onto a process's memory
containing command line arguments (or environment strings), an attacker
can cause utilities from psutils or procps (such as ps, w) or any other
program which made a read() call to the /proc/<pid>/cmdline (or
/proc/<pid>/environ) files to block indefinitely (denial of service) or
for some controlled time (as a synchronization primitive for other
attacks) (bnc#1093158).
- CVE-2019-11486: The Siemens R3964 line discipline driver in
drivers/tty/n_r3964.c has multiple race conditions (bnc#1133188).
- CVE-2019-3882: A flaw was found in the vfio interface implementation
that permits violation of the user's locked memory limit. If a device is
bound to a vfio driver, such as vfio-pci, and the local attacker is
administratively granted ownership of the device, it may cause a system
memory exhaustion and thus a denial of service (DoS) (bsc#1131427).
- CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c
allowed local users to cause a denial of service (NULL pointer
dereference and BUG) via crafted system calls that reach a situation
where ioapic is uninitialized (bnc#1116841).
- CVE-2017-17741: The KVM implementation allowed attackers to obtain
potentially sensitive information from kernel memory, aka a write_mmio
stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and
include/trace/events/kvm.h (bnc#1073311).
- CVE-2019-9503, CVE-2019-8564: Multiple brcmfmac frame validation
bypasses have been fixed (bnc#1132828, bnc#1132673).
The following non-security bugs were fixed:
- ACPI: acpi_pad: Do not launch acpi_pad threads on idle cpus
(bsc#1113399).
- add mainline tags to four hyperv patches
- cpu/speculation: Add 'mitigations=' cmdline option (bsc#1112178).
- Drivers: hv: vmbus: Define an API to retrieve virtual processor index
(bsc#1122822).
- Drivers: hv: vmbus: Define APIs to manipulate the event page
(bsc#1122822).
- Drivers: hv: vmbus: Define APIs to manipulate the message page
(bsc#1122822).++ kernel-source.spec (revision 4)Release:
<RELEASE>.gbd4498d
- Drivers: hv: vmbus: Define APIs to manipulate the synthetic interrupt
controller (bsc#1122822).
- hv: v4.12 API for hyperv-iommu (bsc#1122822).
- iommu/hyper-v: Add Hyper-V stub IOMMU driver (bsc#1122822).
- jump_label: remove bug.h, atomic.h dependencies for HAVE_JUMP_LABEL
(bsc#1111331).
- kvm: x86: Report STIBP on GET_SUPPORTED_CPUID (bsc#1111331).
- locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to
a new <linux/bits.h> file (bsc#1111331).
- MDS: Add CVE refs
- net: ena: add functions for handling Low Latency Queues in ena_com
(bsc#1129279).
- net: ena: add functions for handling Low Latency Queues in ena_netdev
(bsc#1129279).
- net: ena: change rx copybreak default to reduce kernel memory pressure
(bsc#1129279).
- net: ena: complete host info to match latest ENA spec (bsc#1129279).
- net: ena: enable Low Latency Queues (bsc#1129279).
- net: ena: explicit casting and initialization, and clearer error
handling (bsc#1129279).
- net: ena: fix auto casting to boolean (bsc#1129279).
- net: ena: fix compilation error in xtensa architecture (bsc#1129279).
- net: ena: fix crash during ena_remove() (bsc#1129279).
- net: ena: fix crash during failed resume from hibernation (bsc#1129279).
- net: ena: fix indentations in ena_defs for better readability
(bsc#1129279).
- net: ena: Fix Kconfig dependency on X86 (bsc#1129279).
- net: ena: fix NULL dereference due to untimely napi initialization
(bsc#1129279).
- net: ena: fix race between link up and device initalization
(bsc#1129279).
- net: ena: fix rare bug when failed restart/resume is followed by driver
removal (bsc#1129279).
- net: ena: fix warning in rmmod caused by double iounmap (bsc#1129279).
- net: ena: introduce Low Latency Queues data structures according to ENA
spec (bsc#1129279).
- net: ena: limit refill Rx threshold to 256 to avoid latency issues
(bsc#1129279).
- net: ena: minor performance improvement (bsc#1129279).
- net: ena: remove ndo_poll_controller (bsc#1129279).
- net: ena: remove redundant parameter in ena_com_admin_init()
(bsc#1129279).
- net: ena: update driver version from 2.0.1 to 2.0.2 (bsc#1129279).
- net: ena: update driver version from 2.0.2 to 2.0.3 (bsc#1129279).
- net: ena: update driver version to 2.0.1 (bsc#1129279).
- net: ena: use CSUM_CHECKED device indication to report skb's checksum
status (bsc#1129279).
- PCI: hv: Add vPCI version protocol negotiation (bnc#1043485,
bsc#1122822).
- PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC (bnc#1034113,
bsc#1122822).
- PCI: hv: Disable/enable IRQs rather than BH in hv_compose_msi_msg()
(bnc#1094268, bsc#1122822).
- PCI: hv: Do not sleep in compose_msi_msg() (bsc#1082632, bsc#1122822).
- PCI: hv: Fix 2 hang issues in hv_compose_msi_msg() (bsc#1087659,
bsc#1087906, bsc#1122822).
- PCI: hv: Fix a comment typo in _hv_pcifront_read_config() (bsc#1087659,
bsc#1122822).
- PCI: hv: Fix comment formatting and use proper integer fields
(bnc#1043485, bsc#1122822).
- PCI: hv: Only queue new work items in hv_pci_devices_present() if
necessary (bsc#1087659, bsc#1122822).
- PCI: hv: Remove the bogus test in hv_eject_device_work() (bsc#1087659,
bsc#1122822).
- PCI: hv: Serialize the present and eject work items (bsc#1087659,
bsc#1122822).
- PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when >= 32 CPUs
(bnc#1043485, bsc#1122822).
- PCI: hv: Temporary own CPU-number-to-vCPU-number infra (bnc#1043485,
bsc#1122822).
- PCI: hv: Use effective affinity mask (bsc#1109772, bsc#1122822).
- PCI: hv: Use page allocation for hbus structure (bnc#1043485,
bsc#1122822).
- PCI: hv: Use vPCI protocol version 1.2 (bnc#1043485, bsc#1122822).
- pci-hyperv: increase HV_VP_SET_BANK_COUNT_MAX to handle 1792 vcpus
(bsc#1122822).
- powerpc/64: Disable the speculation barrier from the command line
(bsc#1068032).
- powerpc/64s: Default l1d_size to 64K in RFI fallback flush (bsc#1068032,
git-fixes).
- powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2
(bsc#1068032, bsc#1080157, git-fixes).
- powerpc/speculation: Support 'mitigations=' cmdline option (bsc#1112178).
- powerpc/tm: Add commandline option to disable hardware transactional
memory (bsc#1118338).
- powerpc/tm: Add TM Unavailable Exception (bsc#1118338).
- powerpc/tm: Flip the HTM switch default to disabled (bsc#1125580).
- powerpc/vdso32: fix CLOCK_MONOTONIC on PPC64 (bsc#1131587).
- powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038
(bsc#1131587).
- s390: add explicit <linux/stringify.h> for jump label (bsc#1111331).
- sched/core: Optimize SCHED_SMT (bsc#1111331).
- sched/smt: Expose sched_smt_present static key (bsc#1106913).
- sched/smt: Make sched_smt_present track topology (bsc#1106913).
- sched/smt: Update sched_smt_present at runtime (bsc#1111331).
- scripts/git_sort/git_sort.py: Add fixes branch from mkp/scsi.git.
- scsi: ibmvscsi: Fix empty event pool access during host removal
(bsc#1119019).
- scsi: storvsc: Reduce default ring buffer size to 128 Kbytes ().
- time: Introduce jiffies64_to_nsecs() (bsc#1113399).
- Use upstream variant of two pci-hyperv patches
- vti6: flush x-netns xfrm cache when vti interface is removed
(bnc#1012382 bsc#1100152).
- x86/apic: Provide apic_ack_irq() (bsc#1122822).
- x86/bugs: Add AMD's variant of SSB_NO (bsc#1111331).
- x86/bugs: Rename SSBD_NO to SSB_NO (bsc#1111331).
- x86/cpu: Rename Merrifield2 to Moorefield (bsc#1111331).
- x86/cpu: Sanitize FAM6_ATOM naming (bsc#1111331).
- x86/Hyper-V: Set x2apic destination mode to physical when x2apic is
available (bsc#1122822).
- x86/irq: implement irq_data_get_effective_affinity_mask() for v4.12
(bsc#1109772, bsc#1122822).
- x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (bsc#1111331).
- x86/kvm/vmx: Add MDS protection when L1D Flush is not active
(bsc#1111331).
- x86/msr-index: Cleanup bit defines (bsc#1111331).
- x86/speculation: Consolidate CPU whitelists (bsc#1111331).
- x86/speculation/mds: Add basic bug infrastructure for MDS (bsc#1111331).
- x86/speculation/mds: Add BUG_MSBDS_ONLY (bsc#1111331).
- x86/speculation/mds: Add mds_clear_cpu_buffers() (bsc#1111331).
- x86/speculation/mds: Add mds=full,nosmt cmdline option (bsc#1111331).
- x86/speculation/mds: Add mitigation control for MDS (bsc#1111331).
- x86/speculation/mds: Add mitigation mode VMWERV (bsc#1111331).
- x86/speculation/mds: Add 'mitigations=' support for MDS (bsc#1111331).
- x86/speculation/mds: Add SMT warning message (bsc#1111331).
- x86/speculation/mds: Add sysfs reporting for MDS (bsc#1111331).
- x86/speculation/mds: Clear CPU buffers on exit to user (bsc#1111331).
- x86/speculation/mds: Conditionally clear CPU buffers on idle entry
(bsc#1111331).
- x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off
(bsc#1111331).
- x86/speculation: Move arch_smt_update() call to after mitigation
decisions (bsc#1111331).
- x86/speculation: Remove redundant arch_smt_update() invocation
(bsc#1111331).
- x86/speculation: Rework SMT state change (bsc#1111331).
- x86/speculation: Simplify the CPU bug detection logic (bsc#1111331).
- x86/speculation: Support 'mitigations=' cmdline option (bsc#1112178).
- x86: stop exporting msr-index.h to userland (bsc#1111331).
- xfrm6: call kfree_skb when skb is toobig (bnc#1012382 bsc#1100152).
- xfrm: fix missing dst_release() after policy blocking lbcast and
multicast (bnc#1012382 bsc#1100152).
Special Instructions and Notes:
Please reboot the system after installing this update.
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE OpenStack Cloud 7:
zypper in -t patch SUSE-OpenStack-Cloud-7-2019-1287=1
- SUSE Linux Enterprise Server for SAP 12-SP2:
zypper in -t patch SUSE-SLE-SAP-12-SP2-2019-1287=1
- SUSE Linux Enterprise Server 12-SP2-LTSS:
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2019-1287=1
- SUSE Linux Enterprise Server 12-SP2-BCL:
zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2019-1287=1
- SUSE Linux Enterprise High Availability 12-SP2:
zypper in -t patch SUSE-SLE-HA-12-SP2-2019-1287=1
- SUSE Enterprise Storage 4:
zypper in -t patch SUSE-Storage-4-2019-1287=1
- OpenStack Cloud Magnum Orchestration 7:
zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2019-1287=1
Package List:
- SUSE OpenStack Cloud 7 (s390x x86_64):
kernel-default-4.4.121-92.109.2
kernel-default-base-4.4.121-92.109.2
kernel-default-base-debuginfo-4.4.121-92.109.2
kernel-default-debuginfo-4.4.121-92.109.2
kernel-default-debugsource-4.4.121-92.109.2
kernel-default-devel-4.4.121-92.109.2
kernel-syms-4.4.121-92.109.2
- SUSE OpenStack Cloud 7 (noarch):
kernel-devel-4.4.121-92.109.2
kernel-macros-4.4.121-92.109.2
kernel-source-4.4.121-92.109.2
- SUSE OpenStack Cloud 7 (x86_64):
kgraft-patch-4_4_121-92_109-default-1-3.5.2
- SUSE OpenStack Cloud 7 (s390x):
kernel-default-man-4.4.121-92.109.2
- SUSE Linux Enterprise Server for SAP 12-SP2 (ppc64le x86_64):
kernel-default-4.4.121-92.109.2
kernel-default-base-4.4.121-92.109.2
kernel-default-base-debuginfo-4.4.121-92.109.2
kernel-default-debuginfo-4.4.121-92.109.2
kernel-default-debugsource-4.4.121-92.109.2
kernel-default-devel-4.4.121-92.109.2
kernel-syms-4.4.121-92.109.2
kgraft-patch-4_4_121-92_109-default-1-3.5.2
- SUSE Linux Enterprise Server for SAP 12-SP2 (noarch):
kernel-devel-4.4.121-92.109.2
kernel-macros-4.4.121-92.109.2
kernel-source-4.4.121-92.109.2
- SUSE Linux Enterprise Server 12-SP2-LTSS (ppc64le s390x x86_64):
kernel-default-4.4.121-92.109.2
kernel-default-base-4.4.121-92.109.2
kernel-default-base-debuginfo-4.4.121-92.109.2
kernel-default-debuginfo-4.4.121-92.109.2
kernel-default-debugsource-4.4.121-92.109.2
kernel-default-devel-4.4.121-92.109.2
kernel-syms-4.4.121-92.109.2
- SUSE Linux Enterprise Server 12-SP2-LTSS (ppc64le x86_64):
kgraft-patch-4_4_121-92_109-default-1-3.5.2
- SUSE Linux Enterprise Server 12-SP2-LTSS (noarch):
kernel-devel-4.4.121-92.109.2
kernel-macros-4.4.121-92.109.2
kernel-source-4.4.121-92.109.2
- SUSE Linux Enterprise Server 12-SP2-LTSS (s390x):
kernel-default-man-4.4.121-92.109.2
- SUSE Linux Enterprise Server 12-SP2-BCL (noarch):
kernel-devel-4.4.121-92.109.2
kernel-macros-4.4.121-92.109.2
kernel-source-4.4.121-92.109.2
- SUSE Linux Enterprise Server 12-SP2-BCL (x86_64):
kernel-default-4.4.121-92.109.2
kernel-default-base-4.4.121-92.109.2
kernel-default-base-debuginfo-4.4.121-92.109.2
kernel-default-debuginfo-4.4.121-92.109.2
kernel-default-debugsource-4.4.121-92.109.2
kernel-default-devel-4.4.121-92.109.2
kernel-syms-4.4.121-92.109.2
- SUSE Linux Enterprise High Availability 12-SP2 (ppc64le s390x x86_64):
cluster-md-kmp-default-4.4.121-92.109.2
cluster-md-kmp-default-debuginfo-4.4.121-92.109.2
cluster-network-kmp-default-4.4.121-92.109.2
cluster-network-kmp-default-debuginfo-4.4.121-92.109.2
dlm-kmp-default-4.4.121-92.109.2
dlm-kmp-default-debuginfo-4.4.121-92.109.2
gfs2-kmp-default-4.4.121-92.109.2
gfs2-kmp-default-debuginfo-4.4.121-92.109.2
kernel-default-debuginfo-4.4.121-92.109.2
kernel-default-debugsource-4.4.121-92.109.2
ocfs2-kmp-default-4.4.121-92.109.2
ocfs2-kmp-default-debuginfo-4.4.121-92.109.2
- SUSE Enterprise Storage 4 (noarch):
kernel-devel-4.4.121-92.109.2
kernel-macros-4.4.121-92.109.2
kernel-source-4.4.121-92.109.2
- SUSE Enterprise Storage 4 (x86_64):
kernel-default-4.4.121-92.109.2
kernel-default-base-4.4.121-92.109.2
kernel-default-base-debuginfo-4.4.121-92.109.2
kernel-default-debuginfo-4.4.121-92.109.2
kernel-default-debugsource-4.4.121-92.109.2
kernel-default-devel-4.4.121-92.109.2
kernel-syms-4.4.121-92.109.2
kgraft-patch-4_4_121-92_109-default-1-3.5.2
- OpenStack Cloud Magnum Orchestration 7 (x86_64):
kernel-default-4.4.121-92.109.2
kernel-default-debuginfo-4.4.121-92.109.2
kernel-default-debugsource-4.4.121-92.109.2
References:
https://www.suse.com/security/cve/CVE-2016-8636.html
https://www.suse.com/security/cve/CVE-2017-17741.html
https://www.suse.com/security/cve/CVE-2017-18174.html
https://www.suse.com/security/cve/CVE-2018-1091.html
https://www.suse.com/security/cve/CVE-2018-1120.html
https://www.suse.com/security/cve/CVE-2018-1128.html
https://www.suse.com/security/cve/CVE-2018-1129.html
https://www.suse.com/security/cve/CVE-2018-12126.html
https://www.suse.com/security/cve/CVE-2018-12127.html
https://www.suse.com/security/cve/CVE-2018-12130.html
https://www.suse.com/security/cve/CVE-2018-19407.html
https://www.suse.com/security/cve/CVE-2019-11091.html
https://www.suse.com/security/cve/CVE-2019-11486.html
https://www.suse.com/security/cve/CVE-2019-3882.html
https://www.suse.com/security/cve/CVE-2019-8564.html
https://www.suse.com/security/cve/CVE-2019-9503.html
https://bugzilla.suse.com/1012382
https://bugzilla.suse.com/1024908
https://bugzilla.suse.com/1034113
https://bugzilla.suse.com/1043485
https://bugzilla.suse.com/1068032
https://bugzilla.suse.com/1073311
https://bugzilla.suse.com/1080157
https://bugzilla.suse.com/1080533
https://bugzilla.suse.com/1082632
https://bugzilla.suse.com/1087231
https://bugzilla.suse.com/1087659
https://bugzilla.suse.com/1087906
https://bugzilla.suse.com/1093158
https://bugzilla.suse.com/1094268
https://bugzilla.suse.com/1096748
https://bugzilla.suse.com/1100152
https://bugzilla.suse.com/1103186
https://bugzilla.suse.com/1106913
https://bugzilla.suse.com/1109772
https://bugzilla.suse.com/1111331
https://bugzilla.suse.com/1112178
https://bugzilla.suse.com/1113399
https://bugzilla.suse.com/1116841
https://bugzilla.suse.com/1118338
https://bugzilla.suse.com/1119019
https://bugzilla.suse.com/1122822
https://bugzilla.suse.com/1124832
https://bugzilla.suse.com/1125580
https://bugzilla.suse.com/1129279
https://bugzilla.suse.com/1131416
https://bugzilla.suse.com/1131427
https://bugzilla.suse.com/1131587
https://bugzilla.suse.com/1132673
https://bugzilla.suse.com/1132828
https://bugzilla.suse.com/1133188
More information about the sle-updates
mailing list