Security update for the Linux Kernel (Live Patch 31 for SLE 12) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2354-1 Final 1 1 2018-08-16T06:04:25Z current 2018-08-16T06:04:25Z 2018-08-16T06:04:25Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 31 for SLE 12) This update for the Linux Kernel 3.12.61-52_119 fixes several issues. The following security issues were fixed: - CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306). - CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-SERVER-12-2018-1581 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182354-1/ Link for SUSE-SU-2018:2354-1 https://lists.suse.com/pipermail/sle-security-updates/2018-August/004437.html E-Mail link for SUSE-SU-2018:2354-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1097108 SUSE Bug 1097108 https://bugzilla.suse.com/1099306 SUSE Bug 1099306 https://www.suse.com/security/cve/CVE-2018-10853/ SUSE CVE CVE-2018-10853 page https://www.suse.com/security/cve/CVE-2018-3646/ SUSE CVE CVE-2018-3646 page SUSE Linux Enterprise Server 12-LTSS kgraft-patch-3_12_61-52_119-default-7-2.1 kgraft-patch-3_12_61-52_119-xen-7-2.1 kgraft-patch-3_12_61-52_119-default-7-2.1 as a component of SUSE Linux Enterprise Server 12-LTSS kgraft-patch-3_12_61-52_119-xen-7-2.1 as a component of SUSE Linux Enterprise Server 12-LTSS A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest. CVE-2018-10853 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_119-default-7-2.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_119-xen-7-2.1 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182354-1/ https://www.suse.com/security/cve/CVE-2018-10853.html CVE-2018-10853 https://bugzilla.suse.com/1097104 SUSE Bug 1097104 https://bugzilla.suse.com/1097108 SUSE Bug 1097108 Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis. CVE-2018-3646 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_119-default-7-2.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_119-xen-7-2.1 important 4.7 AV:L/AC:M/Au:N/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182354-1/ https://www.suse.com/security/cve/CVE-2018-3646.html CVE-2018-3646 https://bugzilla.suse.com/1087078 SUSE Bug 1087078 https://bugzilla.suse.com/1087081 SUSE Bug 1087081 https://bugzilla.suse.com/1089343 SUSE Bug 1089343 https://bugzilla.suse.com/1091107 SUSE Bug 1091107 https://bugzilla.suse.com/1099306 SUSE Bug 1099306 https://bugzilla.suse.com/1104365 SUSE Bug 1104365 https://bugzilla.suse.com/1104894 SUSE Bug 1104894 https://bugzilla.suse.com/1106548 SUSE Bug 1106548 https://bugzilla.suse.com/1113534 SUSE Bug 1113534 https://bugzilla.suse.com/1136865 SUSE Bug 1136865 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 https://bugzilla.suse.com/1201877 SUSE Bug 1201877