SUSE-SU-2017:1613-1: kernel-bigsmp&distro=SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise
Published
Published 19-06-2017Last modified 04-02-2026
Vulnerability summary
SUSE-SU-2017:1613-1 is a vulnerability in kernel-bigsmp&distro=SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 2 · Downstream 0 · Related 2Timeline
- 19-06-2017PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
Security update for the Linux Kernel The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security fixes. The following security bugs were fixed: - CVE-2017-1000364: The default stack guard page was too small and could be 'jumped over' by userland programs using more than one page of stack in functions and so lead to memory corruption. This update extends the stack guard page to 1 MB (for 4k pages) and 16 MB (for 64k pages) to reduce this attack vector. This is not a kernel bugfix, but a hardening measure against this kind of userland attack.(bsc#1039348) - CVE-2015-3288: mm/memory.c in the Linux kernel mishandled anonymous pages, which allowed local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero (bnc#979021).
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Suse15 products
- kernel-bigsmp&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 3.0.101-0.47.102.1
- kernel-default&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 3.0.101-0.47.102.1
- kernel-default&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 3.0.101-0.47.102.1
- kernel-ec2&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 3.0.101-0.47.102.1
- kernel-ec2&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 3.0.101-0.47.102.1
- kernel-pae&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 3.0.101-0.47.102.1
- kernel-pae&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 3.0.101-0.47.102.1
- kernel-source&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 3.0.101-0.47.102.1
- kernel-source&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 3.0.101-0.47.102.1
- kernel-syms&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 3.0.101-0.47.102.1
- kernel-syms&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 3.0.101-0.47.102.1
- kernel-trace&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 3.0.101-0.47.102.1
- kernel-trace&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 3.0.101-0.47.102.1
- kernel-xen&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 3.0.101-0.47.102.1
- kernel-xen&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 3.0.101-0.47.102.1
1 vendor · 15 products
References
5 links- bugzilla.suse.com/979021REPORT
Related vulnerabilities
Insufficient evidenceSUSE-SU-2019:13937-1SUSE Linux Enterprisesuse · kernel-bigsmp&distro=SUSE Linux Enterprise Server 11 SP3-LTSS +14 moresuse kernel-bigsmp&distro=SUSE Linux Enterprise Server 11 SP3-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 12 SP3 kernel was updated to 3.0.101 to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-9516: In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1108498).
- CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized (bnc#1116841).
- CVE-2018-19985: The function hso_probe read if_num from the USB device (as an u8) and used it without a length check to index an array, resulting in an OOB memory read in hso_probe or hso_get_config_data that could be used by local attackers (bnc#1120743).
- CVE-2018-20169: The USB subsystem mishandled size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c (bnc#1119714).
- CVE-2018-9568: In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1118319).
- CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c (bnc#1118152).
- CVE-2018-18281: The mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused (bnc#1113769).
- CVE-2018-18710: An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658 (bnc#1113751).
- CVE-2018-18386: drivers/tty/n_tty.c allowed local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ (bnc#1094825).
- CVE-2017-7273: The cp_report_fixup function in drivers/hid/hid-cypress.c allowed physically proximate attackers to cause a denial of service (integer underflow) or possibly have unspecified other impact via a crafted HID report (bnc#1031240).
- CVE-2017-16533: The usbhid_parse function in drivers/hid/usbhid/hid-core.c allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066674).
- CVE-2017-1000407: Fixed a denial of service, which was caused by flooding the diagnostic port 0x80 an exception leading to a kernel panic (bnc#1071021).
The following non-security bugs were fixed:
- ALSA: pcm: Fix potential deadlock in OSS emulation (bsc#968018, bsc#1104366).
- cpusets, isolcpus: exclude isolcpus from load balancing in cpusets (bsc#1119255).
- Drivers: scsi: storvsc: Change the limits to reflect the values on the host (bug#1107189).
- drivers: scsi: storvsc: Correctly handle TEST_UNIT_READY failure (bug#1107189).
- Drivers: scsi: storvsc: Filter commands based on the storage protocol version (bug#1107189).
- Drivers: scsi: storvsc: Fix a bug in handling VMBUS protocol version (bug#1107189).
- Drivers: scsi: storvsc: Implement a eh_timed_out handler (bug#1107189).
- Drivers: scsi: storvsc: Set cmd_per_lun to reflect value supported by the Host (bug#1107189).
- drivers: scsi: storvsc: Set srb_flags in all cases (bug#1107189).
- EHCI: improved logic for isochronous scheduling (bsc#1117515).
- ipv4: remove the unnecessary variable in udp_mcast_next (bsc#1104070).
- KEYS: prevent creating a different user's keyrings (bnc#1094186).
- KVM: x86: Fix the duplicate failure path handling in vmx_init (bsc#1104367).
- MM: increase safety margin provided by PF_LESS_THROTTLE (bsc#1116412).
- MM/vmscan.c: avoid throttling reclaim for loop-back nfsd threads (bsc#1116412).
- net/ipv6/udp: Fix ipv6 multicast socket filter regression (bsc#1104070).
- NFS: avoid deadlocks with loop-back mounted NFS filesystems (bsc#1116412).
- NFS: avoid waiting at all in nfs_release_page when congested (bsc#1116412).
- NFS: Do not write enable new pages while an invalidation is proceeding (bsc#1116412).
- NFS: Fix a regression in the read() syscall (bsc#1116412).
- NFS: Fix races in nfs_revalidate_mapping (bsc#1116412).
- NFS: fix the handling of NFS_INO_INVALID_DATA flag in nfs_revalidate_mapping (bsc#1116412).
- NFS: Fix writeback performance issue on cache invalidation (bsc#1116412).
- reiserfs: do not preallocate blocks for extended attributes (bsc#990682).
- reiserfs: fix race in readdir (bsc#1039803).
- sched, isolcpu: make cpu_isolated_map visible outside scheduler (bsc#1119255).
- scsi: storvsc: Always send on the selected outgoing channel (bug#1107189).
- scsi: storvsc: Do not assume that the scatterlist is not chained (bug#1107189).
- scsi: storvsc: Fix a bug in copy_from_bounce_buffer() (bug#1107189).
- scsi: storvsc: Increase the ring buffer size (bug#1107189).
- scsi: storvsc: Size the queue depth based on the ringbuffer size (bug#1107189).
- storvsc: fix a bug in storvsc limits (bug#1107189).
- storvsc: force discovery of LUNs that may have been removed (bug#1107189).
- storvsc: get rid of overly verbose warning messages (bug#1107189).
- storvsc: in responce to a scan event, scan the host (bug#1107189).
- storvsc: Set the SRB flags correctly when no data transfer is needed (bug#1107189).
- udp: ipv4: Add udp early demux (bsc#1104070).
- udp: restore UDPlite many-cast delivery (bsc#1104070).
- udp: Simplify __udp*_lib_mcast_deliver (bsc#1104070).
- udp: Use hash2 for long hash1 chains in __udp*_lib_mcast_deliver (bsc#1104070).
- USB: EHCI: add new root-hub state: STOPPING (bsc#1117515).
- USB: EHCI: add pointer to end of async-unlink list (bsc#1117515).
- USB: EHCI: add symbolic constants for QHs (bsc#1117515).
- USB: EHCI: always scan each interrupt QH (bsc#1117515).
- USB: EHCI: do not lose events during a scan (bsc#1117515).
- USB: EHCI: do not refcount iso_stream structures (bsc#1117515).
- USB: EHCI: do not refcount QHs (bsc#1117515).
- USB: EHCI: fix initialization bug in iso_stream_schedule() (bsc#1117515).
- USB: EHCI: fix up locking (bsc#1117515).
- USB: EHCI: initialize data before resetting hardware (bsc#1117515).
- USB: EHCI: introduce high-res timer (bsc#1117515).
- USB: EHCI: remove PS3 status polling (bsc#1117515).
- USB: EHCI: remove unneeded suspend/resume code (bsc#1117515).
- USB: EHCI: rename 'reclaim' (bsc#1117515).
- USB: EHCI: resolve some unlikely races (bsc#1117515).
- USB: EHCI: return void instead of 0 (bsc#1117515).
- USB: EHCI: simplify isochronous scanning (bsc#1117515).
- USB: EHCI: unlink multiple async QHs together (bsc#1117515).
- USB: EHCI: use hrtimer for async schedule (bsc#1117515).
- USB: EHCI: use hrtimer for controller death (bsc#1117515).
- USB: EHCI: use hrtimer for interrupt QH unlink (bsc#1117515).
- USB: EHCI: use hrtimer for (s)iTD deallocation (bsc#1117515).
- USB: EHCI: use hrtimer for the IAA watchdog (bsc#1117515).
- USB: EHCI: use hrtimer for the I/O watchdog (bsc#1117515).
- USB: EHCI: use hrtimer for the periodic schedule (bsc#1117515).
- USB: EHCI: use hrtimer for unlinking empty async QHs (bsc#1117515).
- XFS: do not BUG() on mixed direct and mapped I/O (bsc#1114920).
- XFS: stop searching for free slots in an inode chunk when there are none (bsc#1115007).
- XFS: validate sb_logsunit is a multiple of the fs blocksize (bsc#1115038).CVSSUnscoredInsufficient evidenceSUSE-SU-2018:3618-1SUSE Linux Enterprisesuse · kernel-bigsmp&distro=SUSE Linux Enterprise Server 11 SP3-LTSS +14 moresuse kernel-bigsmp&distro=SUSE Linux Enterprise Server 11 SP3-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. (bnc#1107829).
- CVE-2018-14617: There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory (bnc#1102870).
- CVE-2018-16276: An issue was discovered in yurex_read in drivers/usb/misc/yurex.c where local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges (bnc#1106095).
- CVE-2018-12896: An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically made the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls (bnc#1099922).
The following non-security bugs were fixed:
- net: fix neighbours after MAC change (bnc#905299).
- powerpc: Fix smp_mb__before_spinlock() (bsc#1110247).
- x86/fpu: Do not do __thread_fpu_end() if use_eager_fpu() (bnc#1109967).
- x86/fpu: fix signal handling with eager FPU switching (ia32) (bsc#1108227).
- retpoline: Introduce start/end markers of indirect thunk (bsc#1113337).CVSSUnscoredInsufficient evidenceSUSE-SU-2018:2907-1SUSE Linux Enterprisesuse · kernel-bigsmp&distro=SUSE Linux Enterprise Server 11 SP3-LTSS +14 moresuse kernel-bigsmp&distro=SUSE Linux Enterprise Server 11 SP3-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-14634: Prevent integer overflow in create_elf_tables that allowed a
local attacker to exploit this vulnerability via a SUID-root binary and obtain
full root privileges (bsc#1108912).
- CVE-2018-10940: The cdrom_ioctl_media_changed function allowed local
attackers to use a incorrect bounds check in the CDROM driver
CDROM_MEDIA_CHANGED ioctl to read out kernel memory (bsc#1092903)
- CVE-2018-16658: Prevent information leak in cdrom_ioctl_drive_status that
could have been used by local attackers to read kernel memory (bnc#1107689)
- CVE-2018-6555: The irda_setsockopt function allowed local users to cause a
denial of service (ias_object use-after-free and system crash) or possibly have
unspecified other impact via an AF_IRDA socket (bnc#1106511)
- CVE-2018-6554: Prevent memory leak in the irda_bind function that allowed
local users to cause a denial of service (memory consumption) by repeatedly
binding an AF_IRDA socket (bnc#1106509)
- CVE-2018-15572: The spectre_v2_select_mitigation function did not always fill
RSB upon a context switch, which made it easier for attackers to conduct
userspace-userspace spectreRSB attacks (bnc#1102517)
- CVE-2018-10902: Protect against concurrent access to prevent double realloc
(double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(). A
malicious local attacker could have used this for privilege escalation
(bnc#1105322).
- CVE-2018-14734: ucma_leave_multicast accessed a certain data structure after
a cleanup step in ucma_process_join, which allowed attackers to cause a denial
of service (use-after-free) (bsc#1103119).
The following non-security bugs were fixed:
- KVM: VMX: Work around kABI breakage in 'enum vmx_l1d_flush_state' (bsc#1106369).
- KVM: VMX: fixes for vmentry_l1d_flush module parameter (bsc#1106369).
- KVM: x86: Free vmx_msr_bitmap_longmode while kvm_init failed (bsc#1104367).
- Refresh patches.xen/xen3-x86-l1tf-04-protect-PROT_NONE-ptes.patch (bsc#1105100).
- kabi: x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ (bnc#1105536).
- kabi: x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ (bnc#1105536).
- ptrace: fix PTRACE_LISTEN race corrupting task->state (bnc#1107001).
- rpm/kernel-docs.spec.in: Expand kernel tree directly from sources (bsc#1057199)
- x86, l1tf: Protect PROT_NONE PTEs against speculation fixup (bnc#1104684, bnc#1104818).
- x86/speculation/l1tf: Fix off-by-one error when warning that system has too much RAM (bnc#1105536).
- x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit (bnc#1087081).
- x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ (bnc#1105536).
- x86/speculation/l1tf: Suggest what to do on systems with too much RAM (bnc#1105536).
- xen x86/speculation/l1tf: Fix off-by-one error when warning that system has too much RAM (bnc#1105536).
- xen x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ (bnc#1105536).
- xen, x86, l1tf: Protect PROT_NONE PTEs against speculation fixup (bnc#1104684, bnc#1104818).
- xen: x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit (bnc#1087081).CVSSUnscoredInsufficient evidenceSUSE-SU-2018:2366-1SUSE Linux Enterprisesuse · kernel-bigsmp&distro=SUSE Linux Enterprise Server 11 SP3-LTSS +14 moresuse kernel-bigsmp&distro=SUSE Linux Enterprise Server 11 SP3-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2016-8405: An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. (bnc#1099942).
- CVE-2017-13305: A information disclosure vulnerability existed in the encrypted-keys handling. (bnc#1094353).
- CVE-2018-1000204: A malformed SG_IO ioctl issued for a SCSI device could lead to a local kernel information leak manifesting in up to approximately 1000 memory pages copied to the userspace. The problem has limited scope as non-privileged users usually have no permissions to access SCSI device files. (bnc#1096728).
- CVE-2018-1068: A flaw was found in the implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bnc#1085107).
- CVE-2018-1130: A null pointer dereference in dccp_write_xmit() function in net/dccp/output.c allowed a local user to cause a denial of service by a number of certain crafted system calls (bnc#1092904).
- CVE-2018-12233: In the ea_get function in fs/jfs/xattr.c a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr (bnc#1097234).
- CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924).
- CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c kernel could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 1100418).
- CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
- CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
- CVE-2018-5803: An error in the '_sctp_make_chunk()' function (net/sctp/sm_make_chunk.c) when handling SCTP packets length could be exploited to cause a kernel crash (bnc#1083900).
- CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations could be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480).
- CVE-2018-7492: A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function allowing local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bnc#1082962).
The following non-security bugs were fixed:
- cpu/hotplug: Add sysfs state interface (bsc#1089343).
- cpu/hotplug: Provide knobs to control SMT (bsc#1089343).
- cpu/hotplug: Provide knobs to control SMT (bsc#1089343).
- cpu/hotplug: Split do_cpu_down() (bsc#1089343).
- disable-prot_none_mitigation.patch: disable prot_none native mitigation (bnc#1104684)
- fix pgd underflow (bnc#1104475) custom walk_page_range rework was incorrect and could underflow pgd if the given range was below a first vma.
- slab: introduce kmalloc_array() (bsc#909361).
- x86/apic: Ignore secondary threads if nosmt=force (bsc#1089343).
- x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info (bsc#1089343).
- x86/cpu/AMD: Evaluate smp_num_siblings early (bsc#1089343).
- x86/cpu/AMD: Evaluate smp_num_siblings early (bsc#1089343).
- x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (bsc#1089343).
- x86/cpu/AMD: Remove the pointless detect_ht() call (bsc#1089343).
- x86/cpu/common: Provide detect_ht_early() (bsc#1089343).
- x86/cpu/intel: Evaluate smp_num_siblings early (bsc#1089343).
- x86/cpu: Remove the pointless CPU printout (bsc#1089343).
- x86/cpu/topology: Provide detect_extended_topology_early() (bsc#1089343).
- x86/smpboot: Do not use smp_num_siblings in __max_logical_packages calculation (bsc#1089343).
- x86/smp: Provide topology_is_primary_thread() (bsc#1089343).
- x86/topology: Add topology_max_smt_threads() (bsc#1089343).
- x86/topology: Provide topology_smt_supported() (bsc#1089343).
- xen/x86/cpu/common: Provide detect_ht_early() (bsc#1089343).
- xen/x86/cpu: Remove the pointless CPU printout (bsc#1089343).
- xen/x86/cpu/topology: Provide detect_extended_topology_early() (bsc#1089343).
- x86/mm: Simplify p[g4um]d_page() macros (bnc#1087081, bnc#1104684).CVSSUnscoredRoutineCVE-2018-3665intel corporation · intel core-based microprocessors +186 moreintel corporation intel core-based microprocessorsSystem software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel.CVSS5.6MediumEPSS0.63%Insufficient evidenceSUSE-SU-2018:1376-1SUSE Linux Enterprisesuse · kernel-bigsmp&distro=SUSE Linux Enterprise Server 11 SP3-LTSS +14 moresuse kernel-bigsmp&distro=SUSE Linux Enterprise Server 11 SP3-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature
in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082).
A new boot commandline option was introduced,
'spec_store_bypass_disable', which can have following values:
- auto: Kernel detects whether your CPU model contains an implementation
of Speculative Store Bypass and picks the most appropriate mitigation.
- on: disable Speculative Store Bypass
- off: enable Speculative Store Bypass
- prctl: Control Speculative Store Bypass per thread via
prctl. Speculative Store Bypass is enabled for a process by default. The
state of the control is inherited on fork.
- seccomp: Same as 'prctl' above, but all seccomp threads will disable
SSB unless they explicitly opt out.
The default is 'seccomp', meaning programs need explicit opt-in into the mitigation.
Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypass file, containing:
- 'Vulnerable'
- 'Mitigation: Speculative Store Bypass disabled'
- 'Mitigation: Speculative Store Bypass disabled via prctl'
- 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp'
- CVE-2018-1000199: An address corruption flaw was discovered while
modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an
unprivileged user/process could use this flaw to crash the system kernel
resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895)
- CVE-2018-10675: The do_get_mempolicy function in mm/mempolicy.c allowed
local users to cause a denial of service (use-after-free) or possibly
have unspecified other impact via crafted system calls (bnc#1091755).
- CVE-2017-5715: The retpoline mitigation for Spectre v2 has been enabled also for 32bit x86.
- CVE-2017-5753: Spectre v1 mitigations have been improved by the versions
merged from the upstream kernel.
The following non-security bugs were fixed:
- Update config files. Set CONFIG_RETPOLINE=y for i386.
- x86/espfix: Fix return stack in do_double_fault() (bsc#1085279).
- xen-netfront: fix req_prod check to avoid RX hang when index wraps (bsc#1046610).CVSSUnscored