SUSE SLES11 Security Update : kernel (SUSE-SU-2019:14051-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

High Nessus Plugin ID 125250

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)

CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)

CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)

CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

This kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel.

For more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736

The following security bugs were fixed: CVE-2019-9213: The expand_downwards function in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

CVE-2013-0216: The Xen netback functionality allowed guest OS users to cause a denial of service (loop) by triggering ring pointer corruption (bnc#800280).

CVE-2013-0231: The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen allowed guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. (bnc#801178).

CVE-2012-3430: The rds_recvmsg function in net/rds/recv.c did not initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a recvfrom or recvmsg system call on an RDS socket (bnc#773383).

CVE-2012-3412: The sfc (aka Solarflare Solarstorm) driver allowed remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value (bnc#774523).

CVE-2013-0160: The kernel allowed local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device (bnc#797175).

CVE-2013-1979: The scm_set_cred function in include/net/scm.h uses incorrect uid and gid values during credentials passing, which allowed local users to gain privileges via a crafted application (bnc#816708).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server 11-SP4-LTSS:zypper in -t patch slessp4-kernel-20190508-14051=1

SUSE Linux Enterprise Server 11-EXTRA:zypper in -t patch slexsp3-kernel-20190508-14051=1

SUSE Linux Enterprise Debuginfo 11-SP4:zypper in -t patch dbgsp4-kernel-20190508-14051=1

See Also

https://bugzilla.suse.com/show_bug.cgi?id=1082943

https://bugzilla.suse.com/show_bug.cgi?id=1094244

https://bugzilla.suse.com/show_bug.cgi?id=1103186

https://bugzilla.suse.com/show_bug.cgi?id=1106886

https://bugzilla.suse.com/show_bug.cgi?id=1110436

https://bugzilla.suse.com/show_bug.cgi?id=1111331

https://bugzilla.suse.com/show_bug.cgi?id=1112178

https://bugzilla.suse.com/show_bug.cgi?id=1117515

https://bugzilla.suse.com/show_bug.cgi?id=1119019

https://bugzilla.suse.com/show_bug.cgi?id=1127082

https://bugzilla.suse.com/show_bug.cgi?id=1127376

https://bugzilla.suse.com/show_bug.cgi?id=1127445

https://bugzilla.suse.com/show_bug.cgi?id=1127534

https://bugzilla.suse.com/show_bug.cgi?id=1127738

https://bugzilla.suse.com/show_bug.cgi?id=1128166

https://bugzilla.suse.com/show_bug.cgi?id=1128383

https://bugzilla.suse.com/show_bug.cgi?id=1129248

https://bugzilla.suse.com/show_bug.cgi?id=1129437

https://bugzilla.suse.com/show_bug.cgi?id=1129439

https://bugzilla.suse.com/show_bug.cgi?id=1129770

https://bugzilla.suse.com/show_bug.cgi?id=1130353

https://bugzilla.suse.com/show_bug.cgi?id=1130384

https://bugzilla.suse.com/show_bug.cgi?id=1131107

https://bugzilla.suse.com/show_bug.cgi?id=1131587

https://bugzilla.suse.com/show_bug.cgi?id=1132589

https://bugzilla.suse.com/show_bug.cgi?id=773383

https://bugzilla.suse.com/show_bug.cgi?id=774523

https://bugzilla.suse.com/show_bug.cgi?id=797175

https://bugzilla.suse.com/show_bug.cgi?id=800280

https://bugzilla.suse.com/show_bug.cgi?id=801178

https://bugzilla.suse.com/show_bug.cgi?id=816708

https://www.suse.com/security/cve/CVE-2012-3412/

https://www.suse.com/security/cve/CVE-2012-3430/

https://www.suse.com/security/cve/CVE-2013-0160/

https://www.suse.com/security/cve/CVE-2013-0216/

https://www.suse.com/security/cve/CVE-2013-0231/

https://www.suse.com/security/cve/CVE-2013-1979/

https://www.suse.com/security/cve/CVE-2018-12126/

https://www.suse.com/security/cve/CVE-2018-12127/

https://www.suse.com/security/cve/CVE-2018-12130/

https://www.suse.com/security/cve/CVE-2019-11091/

https://www.suse.com/security/cve/CVE-2019-9213/

https://www.suse.com/support/kb/doc/?id=7023736

http://www.nessus.org/u?d083dd81

Plugin Details

Severity: High

ID: 125250

File Name: suse_SU-2019-14051-1.nasl

Version: 1.2

Type: local

Agent: unix

Published: 2019/05/17

Updated: 2019/05/17

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSS v3.0

Base Score: 6.5

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-default-devel, p-cpe:/a:novell:suse_linux:kernel-default-man, p-cpe:/a:novell:suse_linux:kernel-ec2, p-cpe:/a:novell:suse_linux:kernel-ec2-base, p-cpe:/a:novell:suse_linux:kernel-ec2-devel, p-cpe:/a:novell:suse_linux:kernel-pae, p-cpe:/a:novell:suse_linux:kernel-pae-base, p-cpe:/a:novell:suse_linux:kernel-pae-devel, p-cpe:/a:novell:suse_linux:kernel-source, p-cpe:/a:novell:suse_linux:kernel-syms, p-cpe:/a:novell:suse_linux:kernel-trace, p-cpe:/a:novell:suse_linux:kernel-trace-base, p-cpe:/a:novell:suse_linux:kernel-trace-devel, p-cpe:/a:novell:suse_linux:kernel-xen, p-cpe:/a:novell:suse_linux:kernel-xen-base, p-cpe:/a:novell:suse_linux:kernel-xen-devel, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2019/05/16

Vulnerability Publication Date: 2012/10/03

Reference Information

CVE: CVE-2012-3412, CVE-2012-3430, CVE-2013-0160, CVE-2013-0216, CVE-2013-0231, CVE-2013-1979, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091, CVE-2019-9213

BID: 54702, 54763, 57176, 57740, 57743, 59538