SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:2947-1)

High Nessus Plugin ID 130947

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 7.1

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The SUSE Linux Enterprise 15-SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735 CVE-2019-11135:
Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251 CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference.
(bsc#1150457).

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Workstation Extension 15-SP1:zypper in -t patch SUSE-SLE-Product-WE-15-SP1-2019-2947=1

SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1:zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-2947=1

SUSE Linux Enterprise Module for Live Patching 15-SP1:zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP1-2019-2947=1

SUSE Linux Enterprise Module for Legacy Software 15-SP1:zypper in -t patch SUSE-SLE-Module-Legacy-15-SP1-2019-2947=1

SUSE Linux Enterprise Module for Development Tools 15-SP1:zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP1-2019-2947=1

SUSE Linux Enterprise Module for Basesystem 15-SP1:zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2019-2947=1

SUSE Linux Enterprise High Availability 15-SP1:zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2019-2947=1

See Also

https://bugzilla.suse.com/show_bug.cgi?id=1046299

https://bugzilla.suse.com/show_bug.cgi?id=1046303

https://bugzilla.suse.com/show_bug.cgi?id=1046305

https://bugzilla.suse.com/show_bug.cgi?id=1050244

https://bugzilla.suse.com/show_bug.cgi?id=1050536

https://bugzilla.suse.com/show_bug.cgi?id=1050545

https://bugzilla.suse.com/show_bug.cgi?id=1051510

https://bugzilla.suse.com/show_bug.cgi?id=1055186

https://bugzilla.suse.com/show_bug.cgi?id=1061840

https://bugzilla.suse.com/show_bug.cgi?id=1064802

https://bugzilla.suse.com/show_bug.cgi?id=1065600

https://bugzilla.suse.com/show_bug.cgi?id=1066129

https://bugzilla.suse.com/show_bug.cgi?id=1073513

https://bugzilla.suse.com/show_bug.cgi?id=1082635

https://bugzilla.suse.com/show_bug.cgi?id=1083647

https://bugzilla.suse.com/show_bug.cgi?id=1086323

https://bugzilla.suse.com/show_bug.cgi?id=1087092

https://bugzilla.suse.com/show_bug.cgi?id=1089644

https://bugzilla.suse.com/show_bug.cgi?id=1090631

https://bugzilla.suse.com/show_bug.cgi?id=1093205

https://bugzilla.suse.com/show_bug.cgi?id=1096254

https://bugzilla.suse.com/show_bug.cgi?id=1097583

https://bugzilla.suse.com/show_bug.cgi?id=1097584

https://bugzilla.suse.com/show_bug.cgi?id=1097585

https://bugzilla.suse.com/show_bug.cgi?id=1097586

https://bugzilla.suse.com/show_bug.cgi?id=1097587

https://bugzilla.suse.com/show_bug.cgi?id=1097588

https://bugzilla.suse.com/show_bug.cgi?id=1098291

https://bugzilla.suse.com/show_bug.cgi?id=1101674

https://bugzilla.suse.com/show_bug.cgi?id=1109158

https://bugzilla.suse.com/show_bug.cgi?id=1111666

https://bugzilla.suse.com/show_bug.cgi?id=1112178

https://bugzilla.suse.com/show_bug.cgi?id=1113994

https://bugzilla.suse.com/show_bug.cgi?id=1114279

https://bugzilla.suse.com/show_bug.cgi?id=1117665

https://bugzilla.suse.com/show_bug.cgi?id=1119461

https://bugzilla.suse.com/show_bug.cgi?id=1119465

https://bugzilla.suse.com/show_bug.cgi?id=1123034

https://bugzilla.suse.com/show_bug.cgi?id=1123080

https://bugzilla.suse.com/show_bug.cgi?id=1133140

https://bugzilla.suse.com/show_bug.cgi?id=1134303

https://bugzilla.suse.com/show_bug.cgi?id=1135642

https://bugzilla.suse.com/show_bug.cgi?id=1135854

https://bugzilla.suse.com/show_bug.cgi?id=1135873

https://bugzilla.suse.com/show_bug.cgi?id=1135967

https://bugzilla.suse.com/show_bug.cgi?id=1137040

https://bugzilla.suse.com/show_bug.cgi?id=1137799

https://bugzilla.suse.com/show_bug.cgi?id=1137861

https://bugzilla.suse.com/show_bug.cgi?id=1138190

https://bugzilla.suse.com/show_bug.cgi?id=1139073

https://bugzilla.suse.com/show_bug.cgi?id=1140090

https://bugzilla.suse.com/show_bug.cgi?id=1140729

https://bugzilla.suse.com/show_bug.cgi?id=1140845

https://bugzilla.suse.com/show_bug.cgi?id=1140883

https://bugzilla.suse.com/show_bug.cgi?id=1141600

https://bugzilla.suse.com/show_bug.cgi?id=1142635

https://bugzilla.suse.com/show_bug.cgi?id=1142667

https://bugzilla.suse.com/show_bug.cgi?id=1143706

https://bugzilla.suse.com/show_bug.cgi?id=1144338

https://bugzilla.suse.com/show_bug.cgi?id=1144375

https://bugzilla.suse.com/show_bug.cgi?id=1144449

https://bugzilla.suse.com/show_bug.cgi?id=1144903

https://bugzilla.suse.com/show_bug.cgi?id=1145099

https://bugzilla.suse.com/show_bug.cgi?id=1146612

https://bugzilla.suse.com/show_bug.cgi?id=1148410

https://bugzilla.suse.com/show_bug.cgi?id=1149119

https://bugzilla.suse.com/show_bug.cgi?id=1149853

https://bugzilla.suse.com/show_bug.cgi?id=1150452

https://bugzilla.suse.com/show_bug.cgi?id=1150457

https://bugzilla.suse.com/show_bug.cgi?id=1150465

https://bugzilla.suse.com/show_bug.cgi?id=1150875

https://bugzilla.suse.com/show_bug.cgi?id=1151508

https://bugzilla.suse.com/show_bug.cgi?id=1151807

https://bugzilla.suse.com/show_bug.cgi?id=1152033

https://bugzilla.suse.com/show_bug.cgi?id=1152624

https://bugzilla.suse.com/show_bug.cgi?id=1152665

https://bugzilla.suse.com/show_bug.cgi?id=1152685

https://bugzilla.suse.com/show_bug.cgi?id=1152696

https://bugzilla.suse.com/show_bug.cgi?id=1152697

https://bugzilla.suse.com/show_bug.cgi?id=1152788

https://bugzilla.suse.com/show_bug.cgi?id=1152790

https://bugzilla.suse.com/show_bug.cgi?id=1152791

https://bugzilla.suse.com/show_bug.cgi?id=1153112

https://bugzilla.suse.com/show_bug.cgi?id=1153158

https://bugzilla.suse.com/show_bug.cgi?id=1153236

https://bugzilla.suse.com/show_bug.cgi?id=1153263

https://bugzilla.suse.com/show_bug.cgi?id=1153476

https://bugzilla.suse.com/show_bug.cgi?id=1153509

https://bugzilla.suse.com/show_bug.cgi?id=1153607

https://bugzilla.suse.com/show_bug.cgi?id=1153646

https://bugzilla.suse.com/show_bug.cgi?id=1153681

https://bugzilla.suse.com/show_bug.cgi?id=1153713

https://bugzilla.suse.com/show_bug.cgi?id=1153717

https://bugzilla.suse.com/show_bug.cgi?id=1153718

https://bugzilla.suse.com/show_bug.cgi?id=1153719

https://bugzilla.suse.com/show_bug.cgi?id=1153811

https://bugzilla.suse.com/show_bug.cgi?id=1153969

https://bugzilla.suse.com/show_bug.cgi?id=1154108

https://bugzilla.suse.com/show_bug.cgi?id=1154189

https://bugzilla.suse.com/show_bug.cgi?id=1154242

https://bugzilla.suse.com/show_bug.cgi?id=1154268

https://bugzilla.suse.com/show_bug.cgi?id=1154354

https://bugzilla.suse.com/show_bug.cgi?id=1154372

https://bugzilla.suse.com/show_bug.cgi?id=1154521

https://bugzilla.suse.com/show_bug.cgi?id=1154578

https://bugzilla.suse.com/show_bug.cgi?id=1154607

https://bugzilla.suse.com/show_bug.cgi?id=1154608

https://bugzilla.suse.com/show_bug.cgi?id=1154610

https://bugzilla.suse.com/show_bug.cgi?id=1154611

https://bugzilla.suse.com/show_bug.cgi?id=1154651

https://bugzilla.suse.com/show_bug.cgi?id=1154737

https://bugzilla.suse.com/show_bug.cgi?id=1154747

https://bugzilla.suse.com/show_bug.cgi?id=1154848

https://bugzilla.suse.com/show_bug.cgi?id=1154858

https://bugzilla.suse.com/show_bug.cgi?id=1154905

https://bugzilla.suse.com/show_bug.cgi?id=1154956

https://bugzilla.suse.com/show_bug.cgi?id=1155061

https://bugzilla.suse.com/show_bug.cgi?id=1155178

https://bugzilla.suse.com/show_bug.cgi?id=1155179

https://bugzilla.suse.com/show_bug.cgi?id=1155184

https://bugzilla.suse.com/show_bug.cgi?id=1155186

https://bugzilla.suse.com/show_bug.cgi?id=1155671

https://bugzilla.suse.com/show_bug.cgi?id=802154

https://bugzilla.suse.com/show_bug.cgi?id=814594

https://bugzilla.suse.com/show_bug.cgi?id=919448

https://bugzilla.suse.com/show_bug.cgi?id=987367

https://bugzilla.suse.com/show_bug.cgi?id=998153

https://www.suse.com/security/cve/CVE-2018-12207/

https://www.suse.com/security/cve/CVE-2019-10220/

https://www.suse.com/security/cve/CVE-2019-11135/

https://www.suse.com/security/cve/CVE-2019-16232/

https://www.suse.com/security/cve/CVE-2019-16233/

https://www.suse.com/security/cve/CVE-2019-16234/

https://www.suse.com/security/cve/CVE-2019-16995/

https://www.suse.com/security/cve/CVE-2019-17056/

https://www.suse.com/security/cve/CVE-2019-17133/

https://www.suse.com/security/cve/CVE-2019-17666/

https://www.suse.com/support/kb/doc/?id=7023735

https://www.suse.com/support/kb/doc/?id=7024251

http://www.nessus.org/u?6f4bae99

Plugin Details

Severity: High

ID: 130947

File Name: suse_SU-2019-2947-1.nasl

Version: 1.3

Type: local

Agent: unix

Published: 2019/11/13

Updated: 2019/12/18

Dependencies: 12634

Risk Information

Risk Factor: High

VPR Score: 7.1

CVSS Score Source: CVE-2019-10220

CVSS v2.0

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-debug, p-cpe:/a:novell:suse_linux:kernel-debug-base, p-cpe:/a:novell:suse_linux:kernel-debug-base-debuginfo, p-cpe:/a:novell:suse_linux:kernel-debug-debuginfo, p-cpe:/a:novell:suse_linux:kernel-debug-debugsource, p-cpe:/a:novell:suse_linux:kernel-debug-devel, p-cpe:/a:novell:suse_linux:kernel-debug-devel-debuginfo, p-cpe:/a:novell:suse_linux:kernel-debug-livepatch-devel, p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-debugsource, p-cpe:/a:novell:suse_linux:kernel-default-devel, p-cpe:/a:novell:suse_linux:kernel-default-devel-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-livepatch, p-cpe:/a:novell:suse_linux:kernel-default-man, p-cpe:/a:novell:suse_linux:kernel-kvmsmall, p-cpe:/a:novell:suse_linux:kernel-kvmsmall-base, p-cpe:/a:novell:suse_linux:kernel-kvmsmall-base-debuginfo, p-cpe:/a:novell:suse_linux:kernel-kvmsmall-debuginfo, p-cpe:/a:novell:suse_linux:kernel-kvmsmall-debugsource, p-cpe:/a:novell:suse_linux:kernel-kvmsmall-devel, p-cpe:/a:novell:suse_linux:kernel-kvmsmall-devel-debuginfo, p-cpe:/a:novell:suse_linux:kernel-kvmsmall-livepatch-devel, p-cpe:/a:novell:suse_linux:kernel-obs-build, p-cpe:/a:novell:suse_linux:kernel-obs-build-debugsource, p-cpe:/a:novell:suse_linux:kernel-obs-qa, p-cpe:/a:novell:suse_linux:kernel-syms, p-cpe:/a:novell:suse_linux:kernel-vanilla, p-cpe:/a:novell:suse_linux:kernel-vanilla-base, p-cpe:/a:novell:suse_linux:kernel-vanilla-base-debuginfo, p-cpe:/a:novell:suse_linux:kernel-vanilla-debuginfo, p-cpe:/a:novell:suse_linux:kernel-vanilla-debugsource, p-cpe:/a:novell:suse_linux:kernel-vanilla-devel, p-cpe:/a:novell:suse_linux:kernel-vanilla-devel-debuginfo, p-cpe:/a:novell:suse_linux:kernel-vanilla-livepatch-devel, p-cpe:/a:novell:suse_linux:kernel-zfcpdump, p-cpe:/a:novell:suse_linux:kernel-zfcpdump-debuginfo, p-cpe:/a:novell:suse_linux:kernel-zfcpdump-debugsource, p-cpe:/a:novell:suse_linux:kernel-zfcpdump-man, p-cpe:/a:novell:suse_linux:kselftests-kmp-default, p-cpe:/a:novell:suse_linux:kselftests-kmp-default-debuginfo, p-cpe:/a:novell:suse_linux:reiserfs-kmp-default, p-cpe:/a:novell:suse_linux:reiserfs-kmp-default-debuginfo, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 2019/11/12

Vulnerability Publication Date: 2019/09/11

Reference Information

CVE: CVE-2018-12207, CVE-2019-10220, CVE-2019-11135, CVE-2019-16232, CVE-2019-16233, CVE-2019-16234, CVE-2019-16995, CVE-2019-17056, CVE-2019-17133, CVE-2019-17666