SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:1366-1) (Spectre)

High Nessus Plugin ID 110033

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.131 to receive various security and bugfixes. The following security bugs were fixed :

- CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082). A new boot commandline option was introduced, 'spec_store_bypass_disable', which can have following values :

- auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation.

- on: disable Speculative Store Bypass

- off: enable Speculative Store Bypass

- prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork.

- seccomp: Same as 'prctl' above, but all seccomp threads will disable SSB unless they explicitly opt out. The default is 'seccomp', meaning programs need explicit opt-in into the mitigation. Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypas s file, containing :

- 'Vulnerable'

- 'Mitigation: Speculative Store Bypass disabled'

- 'Mitigation: Speculative Store Bypass disabled via prctl'

- 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp'

- CVE-2018-8781: The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c had an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bnc#1090643).

- CVE-2018-10124: The kill_something_info function in kernel/signal.c might have allowed local users to cause a denial of service via an INT_MIN argument (bnc#1089752).

- CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might have allowed local users to cause a denial of service by triggering an attempted use of the
-INT_MIN value (bnc#1089608).

- CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895)

- CVE-2018-1130: The Linux kernel was vulnerable to a NULL pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allowed a local user to cause a denial of service by a number of certain crafted system calls (bnc#1092904).

- CVE-2018-5803: An error in the _sctp_make_chunk() function when handling SCTP, packet length could have been exploited by a malicious local user to cause a kernel crash and a DoS. (bnc#1083900).

- CVE-2018-1065: The netfilter subsystem mishandled the case of a rule blob that contains a jump but lacks a user-defined chain, which allowed local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c (bnc#1083650 1091925).

- CVE-2018-7492: A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function allowing local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bnc#1082962).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Workstation Extension 12-SP3:zypper in -t patch SUSE-SLE-WE-12-SP3-2018-955=1

SUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-955=1

SUSE Linux Enterprise Server 12-SP3:zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-955=1

SUSE Linux Enterprise Live Patching 12-SP3:zypper in -t patch SUSE-SLE-Live-Patching-12-SP3-2018-955=1

SUSE Linux Enterprise High Availability 12-SP3:zypper in -t patch SUSE-SLE-HA-12-SP3-2018-955=1

SUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-955=1

SUSE CaaS Platform ALL :

To install this update, use the SUSE CaaS Platform Velum dashboard. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way.

See Also

https://bugzilla.suse.com/show_bug.cgi?id=1005778

https://bugzilla.suse.com/show_bug.cgi?id=1005780

https://bugzilla.suse.com/show_bug.cgi?id=1005781

https://bugzilla.suse.com/show_bug.cgi?id=1009062

https://bugzilla.suse.com/show_bug.cgi?id=1012382

https://bugzilla.suse.com/show_bug.cgi?id=1015336

https://bugzilla.suse.com/show_bug.cgi?id=1015337

https://bugzilla.suse.com/show_bug.cgi?id=1015340

https://bugzilla.suse.com/show_bug.cgi?id=1015342

https://bugzilla.suse.com/show_bug.cgi?id=1015343

https://bugzilla.suse.com/show_bug.cgi?id=1022604

https://bugzilla.suse.com/show_bug.cgi?id=1022743

https://bugzilla.suse.com/show_bug.cgi?id=1024296

https://bugzilla.suse.com/show_bug.cgi?id=1031492

https://bugzilla.suse.com/show_bug.cgi?id=1036215

https://bugzilla.suse.com/show_bug.cgi?id=1043598

https://bugzilla.suse.com/show_bug.cgi?id=1044596

https://bugzilla.suse.com/show_bug.cgi?id=1056415

https://bugzilla.suse.com/show_bug.cgi?id=1056427

https://bugzilla.suse.com/show_bug.cgi?id=1060799

https://bugzilla.suse.com/show_bug.cgi?id=1068032

https://bugzilla.suse.com/show_bug.cgi?id=1075087

https://bugzilla.suse.com/show_bug.cgi?id=1075091

https://bugzilla.suse.com/show_bug.cgi?id=1075994

https://bugzilla.suse.com/show_bug.cgi?id=1076263

https://bugzilla.suse.com/show_bug.cgi?id=1080157

https://bugzilla.suse.com/show_bug.cgi?id=1082153

https://bugzilla.suse.com/show_bug.cgi?id=1082299

https://bugzilla.suse.com/show_bug.cgi?id=1082485

https://bugzilla.suse.com/show_bug.cgi?id=1082962

https://bugzilla.suse.com/show_bug.cgi?id=1083125

https://bugzilla.suse.com/show_bug.cgi?id=1083635

https://bugzilla.suse.com/show_bug.cgi?id=1083650

https://bugzilla.suse.com/show_bug.cgi?id=1083900

https://bugzilla.suse.com/show_bug.cgi?id=1084721

https://bugzilla.suse.com/show_bug.cgi?id=1085058

https://bugzilla.suse.com/show_bug.cgi?id=1085185

https://bugzilla.suse.com/show_bug.cgi?id=1085511

https://bugzilla.suse.com/show_bug.cgi?id=1085958

https://bugzilla.suse.com/show_bug.cgi?id=1087082

https://bugzilla.suse.com/show_bug.cgi?id=1088242

https://bugzilla.suse.com/show_bug.cgi?id=1088865

https://bugzilla.suse.com/show_bug.cgi?id=1089023

https://bugzilla.suse.com/show_bug.cgi?id=1089115

https://bugzilla.suse.com/show_bug.cgi?id=1089198

https://bugzilla.suse.com/show_bug.cgi?id=1089393

https://bugzilla.suse.com/show_bug.cgi?id=1089608

https://bugzilla.suse.com/show_bug.cgi?id=1089644

https://bugzilla.suse.com/show_bug.cgi?id=1089752

https://bugzilla.suse.com/show_bug.cgi?id=1089895

https://bugzilla.suse.com/show_bug.cgi?id=1089925

https://bugzilla.suse.com/show_bug.cgi?id=1090225

https://bugzilla.suse.com/show_bug.cgi?id=1090643

https://bugzilla.suse.com/show_bug.cgi?id=1090658

https://bugzilla.suse.com/show_bug.cgi?id=1090663

https://bugzilla.suse.com/show_bug.cgi?id=1090708

https://bugzilla.suse.com/show_bug.cgi?id=1090718

https://bugzilla.suse.com/show_bug.cgi?id=1090734

https://bugzilla.suse.com/show_bug.cgi?id=1090953

https://bugzilla.suse.com/show_bug.cgi?id=1091041

https://bugzilla.suse.com/show_bug.cgi?id=1091325

https://bugzilla.suse.com/show_bug.cgi?id=1091728

https://bugzilla.suse.com/show_bug.cgi?id=1091925

https://bugzilla.suse.com/show_bug.cgi?id=1091960

https://bugzilla.suse.com/show_bug.cgi?id=1092289

https://bugzilla.suse.com/show_bug.cgi?id=1092497

https://bugzilla.suse.com/show_bug.cgi?id=1092566

https://bugzilla.suse.com/show_bug.cgi?id=1092904

https://bugzilla.suse.com/show_bug.cgi?id=1093008

https://bugzilla.suse.com/show_bug.cgi?id=1093144

https://bugzilla.suse.com/show_bug.cgi?id=1093215

https://bugzilla.suse.com/show_bug.cgi?id=1094019

https://bugzilla.suse.com/show_bug.cgi?id=802154

https://bugzilla.suse.com/show_bug.cgi?id=966170

https://bugzilla.suse.com/show_bug.cgi?id=966172

https://bugzilla.suse.com/show_bug.cgi?id=966186

https://bugzilla.suse.com/show_bug.cgi?id=966191

https://bugzilla.suse.com/show_bug.cgi?id=969476

https://bugzilla.suse.com/show_bug.cgi?id=969477

https://bugzilla.suse.com/show_bug.cgi?id=981348

https://www.suse.com/security/cve/CVE-2018-1000199/

https://www.suse.com/security/cve/CVE-2018-10087/

https://www.suse.com/security/cve/CVE-2018-10124/

https://www.suse.com/security/cve/CVE-2018-1065/

https://www.suse.com/security/cve/CVE-2018-1130/

https://www.suse.com/security/cve/CVE-2018-3639/

https://www.suse.com/security/cve/CVE-2018-5803/

https://www.suse.com/security/cve/CVE-2018-7492/

https://www.suse.com/security/cve/CVE-2018-8781/

http://www.nessus.org/u?e94d3df8

Plugin Details

Severity: High

ID: 110033

File Name: suse_SU-2018-1366-1.nasl

Version: 1.9

Type: local

Agent: unix

Published: 2018/05/23

Updated: 2019/09/10

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSS v3.0

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-debugsource, p-cpe:/a:novell:suse_linux:kernel-default-devel, p-cpe:/a:novell:suse_linux:kernel-default-extra, p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-man, p-cpe:/a:novell:suse_linux:kernel-syms, cpe:/o:novell:suse_linux:12

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2018/05/22

Vulnerability Publication Date: 2018/02/26

Reference Information

CVE: CVE-2018-1000199, CVE-2018-10087, CVE-2018-10124, CVE-2018-1065, CVE-2018-1130, CVE-2018-3639, CVE-2018-5803, CVE-2018-7492, CVE-2018-8781