SUSE-SU-2018:1375-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2018/suse-su-20181375-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:1375-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2018:1375-1

Related

Published

2018-05-22T11:30:24Z

Modified

2018-05-22T11:30:24Z

Summary

Security update for the Linux Kernel

Details

The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082).

A new boot commandline option was introduced, 'specstorebypass_disable', which can have following values:
- auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation.
- on: disable Speculative Store Bypass
- off: enable Speculative Store Bypass
- prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork.
- seccomp: Same as 'prctl' above, but all seccomp threads will disable SSB unless they explicitly opt out.
The default is 'seccomp', meaning programs need explicit opt-in into the mitigation.

Status can be queried via the /sys/devices/system/cpu/vulnerabilities/specstorebypass file, containing:
- 'Vulnerable'
- 'Mitigation: Speculative Store Bypass disabled'
- 'Mitigation: Speculative Store Bypass disabled via prctl'
- 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp'
CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modifyuserhw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895)
CVE-2018-10675: The dogetmempolicy function in mm/mempolicy.c allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls (bnc#1091755).

The following non-security bugs were fixed:

x86/bugs: Make sure that TIFSSBD does not end up in TIFALLWORK_MASK (bsc#1093215).
x86/bugs: correctly force-disable IBRS on !SKL systems (bsc#1092497).
x86/cpu/intel: Introduce macros for Intel family numbers (bsc#985025).
x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist (bsc#1087845).

References

Affected packages

SUSE:Linux Enterprise Module for Public Cloud 12 / kernel-ec2

Package

Name: kernel-ec2
Purl: pkg:rpm/suse/kernel-ec2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.12.74-60.64.93.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-ec2-extra": "3.12.74-60.64.93.1",
            "kernel-ec2": "3.12.74-60.64.93.1",
            "kernel-ec2-devel": "3.12.74-60.64.93.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / kernel-default

Package

Name: kernel-default
Purl: pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.12.74-60.64.93.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "3.12.74-60.64.93.1",
            "kernel-devel": "3.12.74-60.64.93.1",
            "kernel-default-base": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-default": "1-2.5.1",
            "kgraft-patch-3_12_74-60_64_93-xen": "1-2.5.1",
            "kernel-xen-devel": "3.12.74-60.64.93.1",
            "kernel-default": "3.12.74-60.64.93.1",
            "kernel-source": "3.12.74-60.64.93.1",
            "kernel-xen-base": "3.12.74-60.64.93.1",
            "kernel-syms": "3.12.74-60.64.93.1",
            "kernel-default-devel": "3.12.74-60.64.93.1",
            "kernel-xen": "3.12.74-60.64.93.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / kernel-source

Package

Name: kernel-source
Purl: pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.12.74-60.64.93.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "3.12.74-60.64.93.1",
            "kernel-devel": "3.12.74-60.64.93.1",
            "kernel-default-base": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-default": "1-2.5.1",
            "kgraft-patch-3_12_74-60_64_93-xen": "1-2.5.1",
            "kernel-xen-devel": "3.12.74-60.64.93.1",
            "kernel-default": "3.12.74-60.64.93.1",
            "kernel-source": "3.12.74-60.64.93.1",
            "kernel-xen-base": "3.12.74-60.64.93.1",
            "kernel-syms": "3.12.74-60.64.93.1",
            "kernel-default-devel": "3.12.74-60.64.93.1",
            "kernel-xen": "3.12.74-60.64.93.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / kernel-syms

Package

Name: kernel-syms
Purl: pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.12.74-60.64.93.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "3.12.74-60.64.93.1",
            "kernel-devel": "3.12.74-60.64.93.1",
            "kernel-default-base": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-default": "1-2.5.1",
            "kgraft-patch-3_12_74-60_64_93-xen": "1-2.5.1",
            "kernel-xen-devel": "3.12.74-60.64.93.1",
            "kernel-default": "3.12.74-60.64.93.1",
            "kernel-source": "3.12.74-60.64.93.1",
            "kernel-xen-base": "3.12.74-60.64.93.1",
            "kernel-syms": "3.12.74-60.64.93.1",
            "kernel-default-devel": "3.12.74-60.64.93.1",
            "kernel-xen": "3.12.74-60.64.93.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / kernel-xen

Package

Name: kernel-xen
Purl: pkg:rpm/suse/kernel-xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.12.74-60.64.93.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "3.12.74-60.64.93.1",
            "kernel-devel": "3.12.74-60.64.93.1",
            "kernel-default-base": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-default": "1-2.5.1",
            "kgraft-patch-3_12_74-60_64_93-xen": "1-2.5.1",
            "kernel-xen-devel": "3.12.74-60.64.93.1",
            "kernel-default": "3.12.74-60.64.93.1",
            "kernel-source": "3.12.74-60.64.93.1",
            "kernel-xen-base": "3.12.74-60.64.93.1",
            "kernel-syms": "3.12.74-60.64.93.1",
            "kernel-default-devel": "3.12.74-60.64.93.1",
            "kernel-xen": "3.12.74-60.64.93.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / kgraft-patch-SLE12-SP1_Update_28

Package

Name: kgraft-patch-SLE12-SP1_Update_28
Purl: pkg:rpm/suse/kgraft-patch-SLE12-SP1_Update_28&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1-2.5.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "3.12.74-60.64.93.1",
            "kernel-devel": "3.12.74-60.64.93.1",
            "kernel-default-base": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-default": "1-2.5.1",
            "kgraft-patch-3_12_74-60_64_93-xen": "1-2.5.1",
            "kernel-xen-devel": "3.12.74-60.64.93.1",
            "kernel-default": "3.12.74-60.64.93.1",
            "kernel-source": "3.12.74-60.64.93.1",
            "kernel-xen-base": "3.12.74-60.64.93.1",
            "kernel-syms": "3.12.74-60.64.93.1",
            "kernel-default-devel": "3.12.74-60.64.93.1",
            "kernel-xen": "3.12.74-60.64.93.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1-LTSS / kernel-default

Package

Name: kernel-default
Purl: pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.12.74-60.64.93.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "3.12.74-60.64.93.1",
            "kernel-devel": "3.12.74-60.64.93.1",
            "kernel-default-base": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-default": "1-2.5.1",
            "kernel-default-man": "3.12.74-60.64.93.1",
            "kernel-xen-devel": "3.12.74-60.64.93.1",
            "kernel-xen-base": "3.12.74-60.64.93.1",
            "kernel-default": "3.12.74-60.64.93.1",
            "kernel-source": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-xen": "1-2.5.1",
            "kernel-syms": "3.12.74-60.64.93.1",
            "kernel-default-devel": "3.12.74-60.64.93.1",
            "kernel-xen": "3.12.74-60.64.93.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1-LTSS / kernel-source

Package

Name: kernel-source
Purl: pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.12.74-60.64.93.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "3.12.74-60.64.93.1",
            "kernel-devel": "3.12.74-60.64.93.1",
            "kernel-default-base": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-default": "1-2.5.1",
            "kernel-default-man": "3.12.74-60.64.93.1",
            "kernel-xen-devel": "3.12.74-60.64.93.1",
            "kernel-xen-base": "3.12.74-60.64.93.1",
            "kernel-default": "3.12.74-60.64.93.1",
            "kernel-source": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-xen": "1-2.5.1",
            "kernel-syms": "3.12.74-60.64.93.1",
            "kernel-default-devel": "3.12.74-60.64.93.1",
            "kernel-xen": "3.12.74-60.64.93.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1-LTSS / kernel-syms

Package

Name: kernel-syms
Purl: pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.12.74-60.64.93.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "3.12.74-60.64.93.1",
            "kernel-devel": "3.12.74-60.64.93.1",
            "kernel-default-base": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-default": "1-2.5.1",
            "kernel-default-man": "3.12.74-60.64.93.1",
            "kernel-xen-devel": "3.12.74-60.64.93.1",
            "kernel-xen-base": "3.12.74-60.64.93.1",
            "kernel-default": "3.12.74-60.64.93.1",
            "kernel-source": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-xen": "1-2.5.1",
            "kernel-syms": "3.12.74-60.64.93.1",
            "kernel-default-devel": "3.12.74-60.64.93.1",
            "kernel-xen": "3.12.74-60.64.93.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1-LTSS / kernel-xen

Package

Name: kernel-xen
Purl: pkg:rpm/suse/kernel-xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.12.74-60.64.93.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "3.12.74-60.64.93.1",
            "kernel-devel": "3.12.74-60.64.93.1",
            "kernel-default-base": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-default": "1-2.5.1",
            "kernel-default-man": "3.12.74-60.64.93.1",
            "kernel-xen-devel": "3.12.74-60.64.93.1",
            "kernel-xen-base": "3.12.74-60.64.93.1",
            "kernel-default": "3.12.74-60.64.93.1",
            "kernel-source": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-xen": "1-2.5.1",
            "kernel-syms": "3.12.74-60.64.93.1",
            "kernel-default-devel": "3.12.74-60.64.93.1",
            "kernel-xen": "3.12.74-60.64.93.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1-LTSS / kgraft-patch-SLE12-SP1_Update_28

Package

Name: kgraft-patch-SLE12-SP1_Update_28
Purl: pkg:rpm/suse/kgraft-patch-SLE12-SP1_Update_28&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1-2.5.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "3.12.74-60.64.93.1",
            "kernel-devel": "3.12.74-60.64.93.1",
            "kernel-default-base": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-default": "1-2.5.1",
            "kernel-default-man": "3.12.74-60.64.93.1",
            "kernel-xen-devel": "3.12.74-60.64.93.1",
            "kernel-xen-base": "3.12.74-60.64.93.1",
            "kernel-default": "3.12.74-60.64.93.1",
            "kernel-source": "3.12.74-60.64.93.1",
            "kgraft-patch-3_12_74-60_64_93-xen": "1-2.5.1",
            "kernel-syms": "3.12.74-60.64.93.1",
            "kernel-default-devel": "3.12.74-60.64.93.1",
            "kernel-xen": "3.12.74-60.64.93.1"
        }
    ]
}