The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)

CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)

CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)

CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

This kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel.

For more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736

The following security bugs were fixed: CVE-2019-9213: The expand_downwards function in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

CVE-2013-0216: The Xen netback functionality allowed guest OS users to cause a denial of service (loop) by triggering ring pointer corruption (bnc#800280).

CVE-2013-0231: The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen allowed guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. (bnc#801178).

CVE-2012-3430: The rds_recvmsg function in net/rds/recv.c did not initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a recvfrom or recvmsg system call on an RDS socket (bnc#773383).

CVE-2012-3412: The sfc (aka Solarflare Solarstorm) driver allowed remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value (bnc#774523).

CVE-2013-0160: The kernel allowed local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device (bnc#797175).

CVE-2013-1979: The scm_set_cred function in include/net/scm.h uses incorrect uid and gid values during credentials passing, which allowed local users to gain privileges via a crafted application (bnc#816708).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)

CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)

CVE-2018-12130: Microarchitectural Load Port Data Sampling (MLPDS)

CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

These updates contain the libvirt adjustments, that pass through the new 'md-clear' CPU flag (bsc#1135273).

For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1199 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines     that use KVM in environments managed by Red Hat products.

    Security Fix(es):

    * A flaw was found in the implementation of the fill buffer, a mechanism used by modern CPUs when a     cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page     fault, the execution will continue speculatively with incorrect data from the fill buffer while the data     is fetched from higher level caches. This response time can be measured to infer data in the fill buffer.
    (CVE-2018-12130)

    * Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of     writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore     Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into     these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed     processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use     this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

    * Microprocessors use a load port subcomponent to perform load operations from memory or IO. During     a load operation, the load port receives data from the memory or IO subsystem and then provides the data     to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in     the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an     attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a     timing side-channel. (CVE-2018-12127)

    * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks.

In addition this update provides mitigations for the 'TSX Asynchronous Abort'speculative side channel attack. For additional information please refer to https://xenbits.xen.org/xsa/advisory-305.html

The remote Windows host is missing security update 4494440. It is, therefore, affected by multiple vulnerabilities :

  - A new subclass of speculative execution side channel vulnerabilities,     known as Microarchitectural Data Sampling, exist in Windows.
    An attacker who successfully exploited these vulnerabilities     may be able to read privileged data across trust boundaries.     In shared resource environments (such as exists in some cloud     services configurations), these vulnerabilities could allow     one virtual machine to improperly access information from     another. In non-browsing scenarios on standalone systems, an     attacker would need prior access to the system or an ability     to run a specially crafted application on the target system     to leverage these vulnerabilities.
    (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091)

  - A security feature bypass vulnerability exists when     urlmon.dll improperly handles certain Mark of the Web     queries. The vulnerability allows Internet Explorer to     bypass Mark of the Web warnings or restrictions for     files downloaded or created in a specific way.
    (CVE-2019-0995)

  - A remote code execution vulnerability exists in the way     that Microsoft browsers access objects in memory. The     vulnerability could corrupt memory in a way that could     allow an attacker to execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2019-0940)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0889, CVE-2019-0890, CVE-2019-0891,     CVE-2019-0893, CVE-2019-0894, CVE-2019-0895,     CVE-2019-0896, CVE-2019-0897, CVE-2019-0898,     CVE-2019-0899, CVE-2019-0900, CVE-2019-0901,     CVE-2019-0902)

  - An elevation of privilege vulnerability exists when the     Windows Kernel improperly handles key enumeration. An     attacker who successfully exploited the vulnerability     could gain elevated privileges on a targeted system. A     locally authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The security update addresses the     vulnerability by helping to ensure that the Windows     Kernel properly handles key enumeration. (CVE-2019-0881)

  - A remote code execution vulnerability exists in the way     that the Windows Graphics Device Interface (GDI) handles     objects in the memory. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2019-0903)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2019-0886)

  - An elevation of privilege vulnerability exists in the     Unified Write Filter (UWF) feature for Windows 10 when     it improperly restricts access to the registry. An     attacker who successfully exploited the vulnerability     could make changes to the registry keys protected by UWF     without having administrator privileges.
    (CVE-2019-0942)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2019-0912, CVE-2019-0913,     CVE-2019-0914, CVE-2019-0915, CVE-2019-0916,     CVE-2019-0917, CVE-2019-0922, CVE-2019-0923,     CVE-2019-0924, CVE-2019-0925, CVE-2019-0927,     CVE-2019-0933)

  - A security feature bypass vulnerability exists in     Windows Defender Application Control (WDAC) which could     allow an attacker to bypass WDAC enforcement. An     attacker who successfully exploited this vulnerability     could circumvent Windows PowerShell Constrained Language     Mode on the machine.  (CVE-2019-0733)

  - An spoofing vulnerability exists when Internet Explorer     improperly handles URLs. An attacker who successfully     exploited this vulnerability could trick a user by     redirecting the user to a specially crafted website. The     specially crafted website could either spoof content or     serve as a pivot to chain an attack with other     vulnerabilities in web services.  (CVE-2019-0921)

  - An elevation of privilege vulnerability exists when the     Diagnostics Hub Standard Collector or the Visual Studio     Standard Collector allows file deletion in arbitrary     locations.  (CVE-2019-0727)

  - An elevation of privilege vulnerability exists in     Microsoft Windows when a man-in-the-middle attacker is     able to successfully decode and replace authentication     request using Kerberos, allowing an attacker to be     validated as an Administrator. The update addresses this     vulnerability by changing how these requests are     validated. (CVE-2019-0734)

  - A remote code execution vulnerability exists when     Microsoft Windows OLE fails to properly validate user     input. An attacker could exploit the vulnerability to     execute malicious code.  (CVE-2019-0885)

  - A remote code execution vulnerability exists in the way     the scripting engine handles objects in memory in     Microsoft browsers. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2019-0884, CVE-2019-0911, CVE-2019-0918)

  - An elevation of privilege vulnerability exists in the     way Windows Error Reporting (WER) handles files. An     attacker who successfully exploited this vulnerability     could run arbitrary code in kernel mode. An attacker     could then install programs; view, change, or delete     data; or create new accounts with administrator     privileges.  (CVE-2019-0863)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0930)

  - A denial of service vulnerability exists when .NET     Framework and .NET Core improperly process RegEx     strings. An attacker who successfully exploited this     vulnerability could cause a denial of service against a     .NET application. A remote unauthenticated attacker     could exploit this vulnerability by issuing specially     crafted requests to a .NET Framework (or .NET core)     application. The update addresses the vulnerability by     correcting how .NET Framework and .NET Core applications     handle RegEx string processing. (CVE-2019-0820)

  - An elevation of privilege vulnerability exists in     Microsoft Windows when Windows fails to properly handle     certain symbolic links. An attacker who successfully     exploited this vulnerability could potentially set     certain items to run at a higher level and thereby     elevate permissions.  (CVE-2019-0936)

  - A memory corruption vulnerability exists in the Windows     Server DHCP service when processing specially crafted     packets. An attacker who successfully exploited the     vulnerability could run arbitrary code on the DHCP     server.  (CVE-2019-0725)

  - A denial of service vulnerability exists when .NET     Framework improperly handles objects in heap memory. An     attacker who successfully exploited this vulnerability     could cause a denial of service against a .NET     application.  (CVE-2019-0864)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-0758, CVE-2019-0882, CVE-2019-0961)

  - An elevation of privilege vulnerability exists in     Microsoft Edge that could allow an attacker to escape     from the AppContainer sandbox in the browser. An     attacker who successfully exploited this vulnerability     could gain elevated privileges and break out of the Edge     AppContainer sandbox. The vulnerability by itself does     not allow arbitrary code to run. However, this     vulnerability could be used in conjunction with one or     more vulnerabilities (for example a remote code     execution vulnerability and another elevation of     privilege vulnerability) to take advantage of the     elevated privileges when running. The security update     addresses the vulnerability by modifying how Microsoft     Edge handles sandboxing. (CVE-2019-0938)

  - An elevation of privilege vulnerability exists in the     Network Driver Interface Specification (NDIS) when     ndis.sys fails to check the length of a buffer prior to     copying memory to it.  (CVE-2019-0707)

  - A denial of service vulnerability exists when .NET     Framework or .NET Core improperly handle web requests.
    An attacker who successfully exploited this     vulnerability could cause a denial of service against a     .NET Framework or .NET Core web application. The     vulnerability can be exploited remotely, without     authentication. A remote unauthenticated attacker could     exploit this vulnerability by issuing specially crafted     requests to the .NET Framework or .NET Core application.
    The update addresses the vulnerability by correcting how     .NET Framework or .NET Core web applications handles web     requests. (CVE-2019-0980, CVE-2019-0981)

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-12819: The function __mdiobus_register() called put_device(), which triggered a fixed_mdio_bus_init use-after-free. This would cause a denial of service. (bsc#1138291)

CVE-2019-12818: The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This used to affect nfc_llcp_build_gb in net/nfc/llcp_core.c. (bsc#1138293)

CVE-2019-11477: A sequence of SACKs may have been crafted such that one can trigger an integer overflow, leading to a kernel panic.

CVE-2019-11478: It was possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. An attacker may have been able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection.

CVE-2019-11479: An attacker could force the Linux kernel to segment its responses into multiple TCP segments. This would drastically increased the bandwidth required to deliver the same amount of data.
Further, it would consume additional resources such as CPU and NIC processing power.

CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network. (bsc#1136424)

CVE-2019-10124: An issue was discovered in the hwpoison implementation in mm/memory-failure.c in the Linux kernel. When soft_offline_in_use_page() runs on a thp tail page after pmd is split, an attacker could cause a denial of service (bsc#1130699, CVE-2019-10124).

CVE-2019-12382: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel There was an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).
(bsc#1136586)

CVE-2019-11487: The Linux kernel allowed page reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It could occur with FUSE requests.
(bbsc#1133190)

CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux kernel allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. (bsc#1120843)

CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. (bsc#1135281)

CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here :

https://www.intel.com/content/dam/www/public/us/en/documents/corporate
-info rmation/SA00233-microcode-update-guidance_05132019.
(bsc##1111331) CVE-2018-7191: In the tun subsystem in the Linux kernel, dev_get_valid_name was not called before register_netdevice.
This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. (bsc#1135603)

CVE-2018-12126 CVE-2018-12127 CVE-2018-12130: Microarchitectural Store Buffer Data Sampling (MSBDS): Stored buffers on some microprocessors utilizing speculative execution which may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here :

https://www.intel.com/content/dam/www/public/us/en/documents/corporate
-info rmation/SA00233-microcode-update-guidance_05132019.
(bsc#1103186) CVE-2019-11085: Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux may have allowed an authenticated user to potentially enable escalation of privilege via local access. (bsc#1135278)

CVE-2019-11815: An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel There was a race condition leading to a use-after-free, related to net namespace cleanup. (bsc#1135278)

CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel allowed a local user to obtain potentially sensitive information from kernel stack memory via a hidPCONNADD command, because a name field may not end with a '\0' character. (bsc#1134848)

CVE-2019-11811: An issue was discovered in the Linux kernel There was a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module was removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c. (bsc#1134397)

CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel has multiple race conditions. (bsc#1133188)

CVE-2019-9003: In the Linux kernel, attackers could trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a 'service ipmievd restart' loop. (bsc#1126704)

CVE-2018-16880: A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, could trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may have lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.(bsc#1122767)

CVE-2019-9503: An issue was discoved which meant that brcmfmac frame validation could be bypassed. (bsc#1132828)

CVE-2019-9500: An issue was discovered that lead to brcmfmac heap buffer overflow. (bsc#1132681)

CVE-2019-8564: An issue was discoved which meant that brcmfmac frame validation could be bypassed. (bsc#1132673)

CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

CVE-2019-3882: A flaw was found in the Linux kernel's vfio interface implementation that permitted violation of the user's locked memory limit. If a device was bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may have caused a system memory exhaustion and thus a denial of service (DoS). (bsc#1131427)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
125250	SUSE SLES11 Security Update : kernel (SUSE-SU-2019:14051-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	5/17/2019	2/18/2025	medium
126044	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2019:1547-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	6/19/2019	3/3/2025	medium
193984	RHEL 7 : qemu-kvm-rhev (RHSA-2019:1199)	Nessus	Red Hat Local Security Checks	4/27/2024	2/19/2025	medium
132875	Debian DSA-4602-1 : xen - security update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Debian Local Security Checks	1/15/2020	5/27/2024	critical
125058	KB4494440: Windows 10 Version 1607 and Windows Server 2016 May 2019 Security Update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Windows : Microsoft Bulletins	5/14/2019	12/5/2022	critical
126045	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:1550-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (SACK Panic) (SACK Slowness) (Spectre)	Nessus	SuSE Local Security Checks	6/19/2019	12/5/2022	high

Detections

Analytics

Plugins Search

medium

medium

medium

critical

critical

high