Security Fix(es) :

An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited.

Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software mitigation for this hardware issue at a cost of potential performance penalty. The performance impact of these patches may vary considerably based on workload and hardware configuration.

In this update mitigations for x86-64 architecture are provided.

Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel attacks. (CVE-2017-5753, Important)

Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. (CVE-2017-5715, Important)

Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. (CVE-2017-5754, Important)

Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64 microprocessors are not affected by this issue.

The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory (bnc#1068032).

  - CVE-2017-5753 / 'SpectreAttack': Local attackers on     systems with modern CPUs featuring deep instruction     pipelining could use attacker controllable speculative     execution over code patterns in the Linux Kernel to leak     content from otherwise not readable memory in the same     address space, allowing retrieval of passwords,     cryptographic keys and other secrets. This problem is     mitigated by adding speculative fencing on affected code     paths throughout the Linux kernel. This issue is     addressed for the x86_64, IBM Power and IBM zSeries     architecture.

  - CVE-2017-5715 / 'SpectreAttack': Local attackers on     systems with modern CPUs featuring branch prediction     could use mispredicted branches to speculatively execute     code patterns that in turn could be made to leak other     non-readable content in the same address space, an     attack similar to CVE-2017-5753. This problem is     mitigated by disabling predictive branches, depending on     CPU architecture either by firmware updates and/or fixes     in the user-kernel privilege boundaries. This is done     with help of Linux Kernel fixes on the Intel/AMD x86_64     and IBM zSeries architectures. On x86_64, this requires     also updates of the CPU microcode packages, delivered in     separate updates. For IBM Power and zSeries the required     firmware updates are supplied over regular channels by     IBM. As this feature can have a performance impact, it     can be disabled using the 'nospec' kernel commandline     option.

  - CVE-2017-5754 / 'MeltdownAttack': Local attackers on     systems with modern CPUs featuring deep instruction     pipelining could use code patterns in userspace to     speculative executive code that would read otherwise     read protected memory, an attack similar to     CVE-2017-5753. This problem is mitigated by unmapping     the Linux Kernel from the user address space during user     code execution, following a approach called 'KAISER'.
    The terms used here are 'KAISER' / 'Kernel Address     Isolation' and 'PTI' / 'Page Table Isolation'. This     update does this on the x86_64 architecture, it is not     required on the IBM zSeries architecture. This feature     can be enabled / disabled by the 'pti=[on|off|auto]' or     'nopti' commandline options. The following security bugs     were fixed :

  - CVE-2017-15868: The bnep_add_connection function in     net/bluetooth/bnep/core.c in the Linux kernel did not     ensure that an l2cap socket is available, which allowed     local users to gain privileges via a crafted application     (bnc#1071470).

  - CVE-2017-13167: An elevation of privilege vulnerability     in the kernel sound timer. (bnc#1072876).

  - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c     in the Linux kernel allowed local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner)     (bnc#1066569).

  - CVE-2017-17558: The usb_destroy_configuration function     in drivers/usb/core/config.c in the USB core subsystem     in the Linux kernel did not consider the maximum number     of configurations and interfaces before attempting to     release resources, which allowed local users to cause a     denial of service (out-of-bounds write access) or     possibly have unspecified other impact via a crafted USB     device (bnc#1072561).

  - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux     kernel did not require the CAP_NET_ADMIN capability for     add_callback and remove_callback operations, which     allowed local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all net namespaces (bnc#1071695).

  - CVE-2017-17449: The __netlink_deliver_tap_skb function     in net/netlink/af_netlink.c in the Linux kernel through     4.14.4, when CONFIG_NLMON is enabled, did not restrict     observations of Netlink messages to a single net     namespace, which allowed local users to obtain sensitive     information by leveraging the CAP_NET_ADMIN capability     to sniff an nlmon interface for all Netlink activity on     the system (bnc#1071694).

  - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in     the Linux kernel did not require the CAP_NET_ADMIN     capability for new, get, and del operations, which     allowed local users to bypass intended access     restrictions because the nfnl_cthelper_list data     structure is shared across all net namespaces     (bnc#1071693).

  - CVE-2017-8824: The dccp_disconnect function in     net/dccp/proto.c in the Linux kernel allowed local users     to gain privileges or cause a denial of service     (use-after-free) via an AF_UNSPEC connect system call     during the DCCP_LISTEN state (bnc#1070771).

  - CVE-2017-15115: The sctp_do_peeloff function in     net/sctp/socket.c in the Linux kernel did not check     whether the intended netns is used in a peel-off action,     which allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via crafted system calls     (bnc#1068671).

  - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux     kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is     enabled, did not ensure that the dir value of     xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which     allowed local users to cause a denial of service     (out-of-bounds access) or possibly have unspecified     other impact via an XFRM_MSG_MIGRATE xfrm Netlink     message (bnc#1050231).

  - CVE-2017-16534: The cdc_parse_cdc_header function in     drivers/usb/core/message.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066693).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory (bnc#1068032).

  - CVE-2017-5753 / 'SpectreAttack': Local attackers on     systems with modern CPUs featuring deep instruction     pipelining could use attacker controllable speculative     execution over code patterns in the Linux Kernel to leak     content from otherwise not readable memory in the same     address space, allowing retrieval of passwords,     cryptographic keys and other secrets. This problem is     mitigated by adding speculative fencing on affected code     paths throughout the Linux kernel. This issue is     addressed for the x86_64, the IBM Power and IBM zSeries     architecture.

  - CVE-2017-5715 / 'SpectreAttack': Local attackers on     systems with modern CPUs featuring branch prediction     could use mispredicted branches to speculatively execute     code patterns that in turn could be made to leak other     non-readable content in the same address space, an     attack similar to CVE-2017-5753. This problem is     mitigated by disabling predictive branches, depending on     CPU architecture either by firmware updates and/or fixes     in the user-kernel privilege boundaries. This is done     with help of Linux Kernel fixes on the Intel/AMD x86_64     and IBM zSeries architectures. On x86_64, this requires     also updates of the CPU microcode packages, delivered in     separate updates. For IBM Power and zSeries the required     firmware updates are supplied over regular channels by     IBM. As this feature can have a performance impact, it     can be disabled using the 'nospec' kernel commandline     option.

  - CVE-2017-5754 / 'MeltdownAttack': Local attackers on     systems with modern CPUs featuring deep instruction     pipelining could use code patterns in userspace to     speculative executive code that would read otherwise     read protected memory, an attack similar to     CVE-2017-5753. This problem is mitigated by unmapping     the Linux Kernel from the user address space during user     code execution, following a approach called 'KAISER'.
    The terms used here are 'KAISER' / 'Kernel Address     Isolation' and 'PTI' / 'Page Table Isolation'. This     update does this on the x86_64 architecture, it is not     required on the IBM zSeries architecture. This feature     can be enabled / disabled by the 'pti=[on|off|auto]' or     'nopti' commandline options. The following security bugs     were fixed :

  - CVE-2017-15868: The bnep_add_connection function in     net/bluetooth/bnep/core.c in the Linux kernel did not     ensure that an l2cap socket is available, which allowed     local users to gain privileges via a crafted application     (bnc#1071470).

  - CVE-2017-13167: An elevation of privilege vulnerability     in the kernel sound timer. (bnc#1072876).

  - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c     in the Linux kernel allowed local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner)     (bnc#1066569).

  - CVE-2017-17558: The usb_destroy_configuration function     in drivers/usb/core/config.c in the USB core subsystem     in the Linux kernel did not consider the maximum number     of configurations and interfaces before attempting to     release resources, which allowed local users to cause a     denial of service (out-of-bounds write access) or     possibly have unspecified other impact via a crafted USB     device (bnc#1072561).

  - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux     kernel did not require the CAP_NET_ADMIN capability for     add_callback and remove_callback operations, which     allowed local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all net namespaces (bnc#1071695).

  - CVE-2017-17449: The __netlink_deliver_tap_skb function     in net/netlink/af_netlink.c in the Linux kernel through     4.14.4, when CONFIG_NLMON is enabled, did not restrict     observations of Netlink messages to a single net     namespace, which allowed local users to obtain sensitive     information by leveraging the CAP_NET_ADMIN capability     to sniff an nlmon interface for all Netlink activity on     the system (bnc#1071694).

  - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in     the Linux kernel did not require the CAP_NET_ADMIN     capability for new, get, and del operations, which     allowed local users to bypass intended access     restrictions because the nfnl_cthelper_list data     structure is shared across all net namespaces     (bnc#1071693).

  - CVE-2017-8824: The dccp_disconnect function in     net/dccp/proto.c in the Linux kernel allowed local users     to gain privileges or cause a denial of service     (use-after-free) via an AF_UNSPEC connect system call     during the DCCP_LISTEN state (bnc#1070771).

  - CVE-2017-15115: The sctp_do_peeloff function in     net/sctp/socket.c in the Linux kernel did not check     whether the intended netns is used in a peel-off action,     which allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via crafted system calls     (bnc#1068671).

  - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux     kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is     enabled, did not ensure that the dir value of     xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which     allowed local users to cause a denial of service     (out-of-bounds access) or possibly have unspecified     other impact via an XFRM_MSG_MIGRATE xfrm Netlink     message (bnc#1050231).

  - CVE-2017-16534: The cdc_parse_cdc_header function in     drivers/usb/core/message.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066693).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - drivers/char/mem.c: deny access in open operation when     securelevel is set (Ethan Zhao) [Orabug: 27234850]     [Orabug: 27234850]

  - hugetlb: fix nr_pmds accounting with shared page tables     (Kirill A. Shutemov) [Orabug: 26988581]

  - x86/IBRS: Drop unnecessary WRITE_ONCE (Boris Ostrovsky)     [Orabug: 27416198]

  - x86/IBRS: Don't try to change IBRS mode if IBRS is not     available (Boris Ostrovsky) [Orabug: 27416198]

  - x86/IBRS: Remove support for IBRS_ENABLED_USER mode     (Boris Ostrovsky) 

  - x86: Include linux/device.h in bugs_64.c (Boris     Ostrovsky) [Orabug: 27418896]

  - x86/spectre: Drop the warning about ibrs being obsolete.
    (Konrad Rzeszutek Wilk)

  - x86/spec: Don't print the Missing arguments for option     spectre_v2. (Konrad Rzeszutek Wilk)

  - x86/spec: Also print IBRS if IBPB is disabled. (Konrad     Rzeszutek Wilk)

  - x86/IBPB: Provide debugfs interface for changing IBPB     mode (Boris Ostrovsky) [Orabug: 27449065]

  - xen: Make PV Dom0 Linux kernel NUMA aware (Elena     Ufimtseva)

  - net/rds: Fix incorrect error handling (H&aring kon     Bugge) [Orabug: 26848729]

  - net/rds: use multiple sge than buddy allocation in     congestion code (Wei Lin Guay) [Orabug: 26848729]

  - Revert 'RDS: fix the sg allocation based on actual     message size' (Wei Lin Guay) [Orabug: 26848729]

  - Revert 'RDS: avoid large pages for sg allocation for TCP     transport' (Wei Lin Guay) [Orabug: 26848729]

  - Revert 'net/rds: Reduce memory footprint in rds_sendmsg'     (Wei Lin Guay) [Orabug: 26848729]

  - net/rds: reduce memory footprint during ib_post_recv in     IB transport (Wei Lin Guay) [Orabug: 26848729]

  - net/rds: reduce memory footprint during rds_sendmsg with     IB transport (Wei Lin Guay) [Orabug: 26848729]

  - net/rds: set the rds_ib_init_frag based on supported sge     (Wei Lin Guay) [Orabug: 26848729]

  - bnxt_en: Fix possible corrupted NVRAM parameters from     firmware response. (Michael Chan) [Orabug: 27199588]

  - x86, kasan: Fix build failure on KASAN=y && KMEMCHECK=y     kernels (Andrey Ryabinin) [Orabug: 27255122]

  - x86, efi, kasan: Fix build failure on !KASAN &&     KMEMCHECK=y kernels (Andrey Ryabinin) [Orabug: 27255122]

  - x86, efi, kasan: #undef memset/memcpy/memmove per arch     (Andrey Ryabinin) [Orabug: 27255122]

  - Revert 'Makefile: Build with -Werror=date-time if the     compiler supports it' (Gayatri Vasudevan) [Orabug:
    27255122]

  - dccp: CVE-2017-8824: use-after-free in DCCP code     (Mohamed Ghannam) [Orabug: 27290300] (CVE-2017-8824)

  - x86/efi: Initialize and display UEFI secure boot state a     bit later during init (Daniel Kiper) [Orabug: 27309477]

  - x86/espfix: Init espfix on the boot CPU side (Zhu     Guihua) [Orabug: 27344552]

  - x86/espfix: Add 'cpu' parameter to init_espfix_ap (Zhu     Guihua) 

  - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)     [Orabug: 27344841] (CVE-2017-0861) (CVE-2017-0861)

  - fs/ocfs2: remove page cache for converted direct write     (Wengang Wang)

  - Revert 'ocfs2: code clean up for direct io' (Wengang     Wang)

  - assoc_array: Fix a buggy node-splitting case (David     Howells) [Orabug: 27364592] (CVE-2017-12193)     (CVE-2017-12193)

  - Sanitize 'move_pages' permission checks (Linus Torvalds)     [Orabug: 27364690] (CVE-2017-14140)

  - pti: compile fix for when PTI is disabled (Pavel     Tatashin) [Orabug: 27383147] (CVE-2017-5754)

  - sctp: do not peel off an assoc from one netns to another     one (Xin Long) [Orabug: 27386999] (CVE-2017-15115)

  - net: ipv4: fix for a race condition in raw_sendmsg     (Mohamed Ghannam) [Orabug: 27390682] (CVE-2017-17712)

  - mlx4: add mstflint secure boot access kernel support     (Qing Huang) 

  - x86: Move STUFF_RSB in to the idt macro (Konrad     Rzeszutek Wilk)

  - x86/spec: STUFF_RSB _before_ ENABLE_IBRS (Konrad     Rzeszutek Wilk)

  - x86: Move ENABLE_IBRS in the interrupt macro. (Konrad     Rzeszutek Wilk)

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent     information leaks via side effects of speculative     execution, aka 'Spectre' and 'Meltdown' attacks     (bsc#1074562, bsc#1068032)

  - CVE-2017-15595: x86 PV guest OS users were able to cause     a DoS (unbounded recursion, stack consumption, and     hypervisor crash) or possibly gain privileges via     crafted page-table stacking (bsc#1061081)

  - CVE-2017-17566: Prevent PV guest OS users to cause a     denial of service (host OS crash) or gain host OS     privileges in shadow mode by mapping a certain auxiliary     page (bsc#1070158).

  - CVE-2017-17563: Prevent guest OS users to cause a denial     of service (host OS crash) or gain host OS privileges by     leveraging an incorrect mask for reference-count     overflow checking in shadow mode (bsc#1070159).

  - CVE-2017-17564: Prevent guest OS users to cause a denial     of service (host OS crash) or gain host OS privileges by     leveraging incorrect error handling for reference     counting in shadow mode (bsc#1070160).

  - CVE-2017-17565: Prevent PV guest OS users to cause a     denial of service (host OS crash) if shadow mode and     log-dirty mode are in place, because of an incorrect     assertion related to M2P (bsc#1070163).

  - CVE-2018-5683: The vga_draw_text function allowed local     OS guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by     leveraging improper memory address validation     (bsc#1076116).

  - CVE-2017-18030: The cirrus_invalidate_region function     allowed local OS guest privileged users to cause a     denial of service (out-of-bounds array access and QEMU     process crash) via vectors related to negative pitch     (bsc#1076180).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2017-5715     Multiple researchers have discovered a vulnerability in     various processors supporting speculative execution,     enabling an attacker controlling an unprivileged process     to read memory from arbitrary addresses, including from     the kernel and all other processes running on the     system.

  This specific attack has been named Spectre variant 2 (branch target   injection) and is mitigated in the Linux kernel for the Intel x86-64   architecture by using the 'retpoline' compiler feature which allows   indirect branches to be isolated from speculative execution.

  - CVE-2017-5754     Multiple researchers have discovered a vulnerability in     Intel processors, enabling an attacker controlling an     unprivileged process to read memory from arbitrary     addresses, including from the kernel and all other     processes running on the system.

  This specific attack has been named Meltdown and is addressed in the   Linux kernel on the powerpc/ppc64el architectures by flushing the L1   data cache on exit from kernel mode to user mode (or from hypervisor   to kernel).

  This works on Power7, Power8 and Power9 processors.

  - CVE-2017-13166     A bug in the 32-bit compatibility layer of the v4l2     IOCTL handling code has been found. Memory protections     ensuring user-provided buffers always point to userland     memory were disabled, allowing destination address to be     in kernel space. This bug could be exploited by an     attacker to overwrite kernel memory from an unprivileged     userland process, leading to privilege escalation.

  - CVE-2018-5750     An information leak has been found in the Linux kernel.
    The acpi_smbus_hc_add() prints a kernel address in the     kernel log at every boot, which could be used by an     attacker on the system to defeat kernel ASLR.

Additionnaly to those vulnerability, some mitigations for CVE-2017-5753 are included in this release.

  - CVE-2017-5753     Multiple researchers have discovered a vulnerability in     various processors supporting speculative execution,     enabling an attacker controlling an unprivileged process     to read memory from arbitrary addresses, including from     the kernel and all other processes running on the     system.

  This specific attack has been named Spectre variant 1 (bounds-check   bypass) and is mitigated in the Linux kernel architecture by   identifying vulnerable code sections (array bounds checking followed   by array access) and replacing the array access with the   speculation-safe array_index_nospec() function.

  More use sites will be added over time.

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* hw: cpu: speculative execution branch target injection (s390-only) (CVE-2017-5715, Important)

* hw: cpu: speculative execution bounds-check bypass (s390 and powerpc) (CVE-2017-5753, Important)

* hw: cpu: speculative execution permission faults handling (powerpc-only) (CVE-2017-5754)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fixes :

* If a fibre channel (FC) switch was powered down and then powered on again, the SCSI device driver stopped permanently the SCSI device's request queue. Consequently, the FC port login failed, leaving the port state as 'Bypassed' instead of 'Online', and users had to reboot the operating system. This update fixes the driver to avoid the permanent stop of the request queue. As a result, SCSI device now continues working as expected after power cycling the FC switch.
(BZ#1519857)

* Previously, on final close or unlink of a file, the find_get_pages() function in the memory management sometimes found no pages even if there were some pages left to save. Consequently, a kernel crash occurred when attempting to enter the unlink() function. This update fixes the find_get_pages() function in the memory management code to not return 0 too early. As a result, the kernel no longer crashes due to this behavior.(BZ# 1527811)

* Using IPsec connections under a heavy load could previously lead to a network performance degradation, especially when using the aesni-intel module. This update fixes the issue by making the cryptd queue length configurable so that it can be increased to prevent an overflow and packet drop. As a result, using IPsec under a heavy load no longer reduces network performance. (BZ#1527802)

* Previously, a deadlock in the bnx2fc driver caused all adapters to block and the SCSI error handler to become unresponsive. As a result, data transferring through the adapter was sometimes blocked. This update fixes bnx2fc, and data transferring through the adapter is no longer blocked due to this behavior. (BZ#1523783)

* If an NFSv3 client mounted a subdirectory of an exported file system, a directory entry to the mount hosting the export was incorrectly held even after clearing the cache. Consequently, attempts to unmount the subdirectory with the umount command failed with the EBUSY error. With this update, the underlying source code has been fixed, and the unmount operation now succeeds as expected in the described situation. (BZ#1535938)

Users of kernel are advised to upgrade to these updated packages, which fix these bugs. The system must be rebooted for this update to take effect.

Security Fix(es) :

  - hw: cpu: speculative execution permission faults     handling (CVE-2017-5754, Important, KVM for Power)

  - kernel: Buffer overflow in firewire driver via crafted     incoming packets (CVE-2016-8633, Important)

  - kernel: Use-after-free vulnerability in DCCP socket     (CVE-2017-8824, Important)

  - Kernel: kvm: nVMX: L2 guest could access hardware(L0)     CR8 register (CVE-2017-12154, Important)

  - kernel: v4l2: disabled memory access protection     mechanism allowing privilege escalation (CVE-2017-13166,     Important)

  - kernel: media: use-after-free in [tuner-xc2028] media     driver (CVE-2016-7913, Moderate)

  - kernel: drm/vmwgfx: fix integer overflow in     vmw_surface_define_ioctl() (CVE-2017-7294, Moderate)

  - kernel: Incorrect type conversion for size during dma     allocation (CVE-2017-9725, Moderate)

  - kernel: memory leak when merging buffers in SCSI IO     vectors (CVE-2017-12190, Moderate)

  - kernel: vfs: BUG in truncate_inode_pages_range() and     fuse client (CVE-2017-15121, Moderate)

  - kernel: Use-after-free in     userfaultfd_event_wait_completion function in     userfaultfd.c (CVE-2017-15126, Moderate)

  - kernel: net: double-free and memory corruption in     get_net_ns_by_id() (CVE-2017-15129, Moderate)

  - kernel: Use-after-free in snd_seq_ioctl_create_port()     (CVE-2017-15265, Moderate)

  - kernel: Missing capabilities check in     net/netfilter/nfnetlink_cthelper.c allows for     unprivileged access to systemwide nfnl_cthelper_list     structure (CVE-2017-17448, Moderate)

  - kernel: Missing namespace check in     net/netlink/af_netlink.c allows for network monitors to     observe systemwide activity (CVE-2017-17449, Moderate)

  - kernel: Unallocated memory access by malicious USB     device via bNumInterfaces overflow (CVE-2017-17558,     Moderate)

  - kernel: netfilter: use-after-free in     tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate)

  - kernel: Race condition in     drivers/md/dm.c:dm_get_from_kobject() allows local users     to cause a denial of service (CVE-2017-18203, Moderate)

  - kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ     (CVE-2017-1000252, Moderate)

  - Kernel: KVM: DoS via write flood to I/O port 0x80     (CVE-2017-1000407, Moderate)

  - kernel: Stack information leak in the EFS element     (CVE-2017-1000410, Moderate)

  - kernel: Kernel address information leak in     drivers/acpi/sbshc.c:acpi_smbus_hc_add() function     potentially allowing KASLR bypass (CVE-2018-5750,     Moderate)

  - kernel: Race condition in sound system can lead to     denial of service (CVE-2018-1000004, Moderate)

  - kernel: multiple Low security impact security issues     (CVE-2016-3672, CVE-2017-14140, CVE-2017-15116,     CVE-2017-15127, CVE-2018-6927, Low)

Additional Changes :

An update of the linux package has been released.

The remote host is running a version of RancherOS that is prior to v1.1.3, hence is vulnerable to local privilege-escalation vulnerability. An attacker can exploit this issue to cause a denial-of-service condition.

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.

The version of Citrix XenServer running on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2018-8897: Prevent mishandling of debug exceptions     on x86 (XSA-260, bsc#1090820)

  - Handle HPET timers in IO-APIC mode correctly to prevent     malicious or buggy HVM guests from causing a hypervisor     crash or potentially privilege escalation/information     leaks (XSA-261, bsc#1090822)

  - Prevent unbounded loop, induced by qemu allowing an     attacker to permanently keep a physical CPU core busy     (XSA-262, bsc#1090823)

  - CVE-2018-10472: x86 HVM guest OS users (in certain     configurations) were able to read arbitrary dom0 files     via QMP live insertion of a CDROM, in conjunction with     specifying the target file as the backing file of a     snapshot (bsc#1089152).

  - CVE-2018-10471: x86 PV guest OS users were able to cause     a denial of service (out-of-bounds zero write and     hypervisor crash) via unexpected INT 80 processing,     because of an incorrect fix for CVE-2017-5754     (bsc#1089635).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions (a commonly used performance     optimization). There are three primary variants of the     issue which differ in the way the speculative execution     can be exploited. Variant CVE-2017-5754 relies on the     fact that, on impacted microprocessors, during     speculative execution of instruction permission faults,     exception generation triggered by a faulting access is     suppressed until the retirement of the whole     instruction block. In a combination with the fact that     memory accesses may populate the cache even when the     block is being dropped and never committed (executed),     an unprivileged local attacker could use this flaw to     read privileged (kernel space) memory by conducting     targeted cache side-channel attacks. NOTE: This update     fixes the 32-bit compatibility layer on x86-64     processors, i.e. when 32-bit containers are executed on     64-bit processors.

  - A bug in the 32-bit compatibility layer of the ioctl     handling code of the v4l2 video driver in the Linux     kernel has been found. A memory protection mechanism     ensuring that user-provided buffers always point to a     userspace memory were disabled, allowing destination     address to be in a kernel space. This flaw could be     exploited by an attacker to overwrite a kernel memory     from an unprivileged userspace process, leading to     privilege escalation.

  - The KEYS subsystem in the Linux kernel omitted an     access-control check when writing a key to the current     task's default keyring, allowing a local user to bypass     security checks to the keyring. This compromises the     validity of the keyring for those who rely on it.

  - A flaw was found in the processing of incoming L2CAP     bluetooth commands. Uninitialized stack variables can     be sent to an attacker leaking data in kernel address     space.

  - Linux kernel before version 4.16-rc7 is vulnerable to a     null pointer dereference in dccp_write_xmit() function     in net/dccp/output.c in that allows a local user to     cause a denial of service by a number of certain     crafted system calls.

  - A flaw was found in the way the Linux kernel handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged system user could use this flaw to crash     the system kernel resulting in the denial of service.

  - net/netfilter/xt_osf.c in the Linux kernel through     4.14.4 does not require the CAP_NET_ADMIN capability     for add_callback and remove_callback operations. This     allows local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all network namespaces.

  - The futex_requeue function in kernel/futex.c in the     Linux kernel, before 4.14.15, might allow attackers to     cause a denial of service (integer overflow) or     possibly have unspecified other impacts by triggering a     negative wake or requeue value.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues.

These security issues were fixed :

CVE-2018-8897: Prevent mishandling of debug exceptions on x86 (XSA-260, bsc#1090820)

Handle HPET timers in IO-APIC mode correctly to prevent malicious or buggy HVM guests from causing a hypervisor crash or potentially privilege escalation/information leaks (XSA-261, bsc#1090822)

Prevent unbounded loop, induced by qemu allowing an attacker to permanently keep a physical CPU core busy (XSA-262, bsc#1090823)

CVE-2018-10472: x86 HVM guest OS users (in certain configurations) were able to read arbitrary dom0 files via QMP live insertion of a CDROM, in conjunction with specifying the target file as the backing file of a snapshot (bsc#1089152).

CVE-2018-10471: x86 PV guest OS users were able to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754 (bsc#1089635).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
105535	Scientific Linux Security Update : kernel on SL7.x x86_64 (20180103) (Meltdown) (Spectre)	Nessus	Scientific Linux Local Security Checks	2018/1/4	2026/1/14	medium
105647	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0031-1) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	2018/1/8	2026/1/13	high
106095	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0115-1) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	2018/1/17	2026/1/13	high
106706	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0017) (Meltdown)	Nessus	OracleVM Local Security Checks	2018/2/9	2026/1/13	high
106834	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2018:0438-1) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	2018/2/15	2026/1/13	high
106955	Debian DSA-4120-1 : linux - security update (Meltdown) (Spectre)	Nessus	Debian Local Security Checks	2018/2/23	2026/1/13	high
108341	CentOS 6 : kernel (CESA-2018:0512) (Meltdown) (Spectre)	Nessus	CentOS Local Security Checks	2018/3/15	2026/1/13	medium
109449	Scientific Linux Security Update : kernel on SL7.x x86_64 (20180410) (Meltdown)	Nessus	Scientific Linux Local Security Checks	2018/5/1	2026/1/13	critical
121906	Photon OS 2.0: Linux PHSA-2018-2.0-0010	Nessus	PhotonOS Local Security Checks	2019/2/7	2026/1/12	medium
130736	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2019-2274)	Nessus	Huawei Local Security Checks	2019/11/8	2026/1/12	critical
132250	RancherOS < 1.1.3 Information Disclosure	Nessus	Misc.	2019/12/19	2026/1/12	medium
109725	Citrix XenServer Multiple Vulnerabilities (CTX234679)	Nessus	Misc.	2018/5/11	2026/1/13	high
109756	SUSE SLES12 Security Update : xen (SUSE-SU-2018:1216-1) (Meltdown)	Nessus	SuSE Local Security Checks	2018/5/14	2026/1/13	high
109801	Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2018-029)	Nessus	Virtuozzo Local Security Checks	2018/5/15	2026/1/13	high
118304	SUSE SLES12 Security Update : xen (SUSE-SU-2018:3230-1) (Meltdown)	Nessus	SuSE Local Security Checks	2018/10/22	2026/1/12	high

检测

插件搜索

medium

high

high

high

high

high

medium

critical

medium

critical

medium

high

high

high

high