CVE-2020-0543

Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

The microcode_ctl packages provide microcode updates for Intel.

Security Fix(es):

• hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)

• hw: Vector Register Data Sampling (CVE-2020-0548)

• hw: L1D Cache Eviction Sampling (CVE-2020-0549)

• hw: vt-d related privilege escalation (CVE-2020-24489)

• hw: improper isolation of shared resources in some Intel Processors (CVE-2020-24511)

• hw: observable timing discrepancy in some Intel Processors (CVE-2020-24512)

• hw: Information disclosure issue in Intel SGX via RAPL interface (CVE-2020-8695)

• hw: Vector Register Leakage-Active (CVE-2020-8696)

• hw: Fast forward store predictor (CVE-2020-8698)

Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

It was discovered that the virtual terminal implementation in the Linux kernel did not properly handle resize events. A local attacker could use this to expose sensitive information. (CVE-2020-8647)

It was discovered that the virtual terminal implementation in the Linux kernel contained a race condition. A local attacker could possibly use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2020-8648)

It was discovered that the virtual terminal implementation in the Linux kernel did not properly handle resize events. A local attacker could use this to expose sensitive information. (CVE-2020-8649)

It was discovered that the Serial CAN interface driver in the Linux kernel did not properly initialize data. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-11494)

Piotr Krysiuk discovered that race conditions existed in the file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-12114)

Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2020-0543)

Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2020-0548)

Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2020-0549)

This provides an update to kernel 5.7 series, currently based on upstream 5.7.14 adding support for new hardware and features, and fixes at least the following security issues:

An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c (CVE-2019-18814).

relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result (CVE-2019-19462).

Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2020-0543).

A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data (CVE-2020-10732).

A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system (CVE-2020-10757).

A logic bug flaw was found in the Linux kernel’s implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality (CVE-2020-10766).

A flaw was found in the Linux kernel’s implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality (CVE-2020-10767).

A flaw was found in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality (CVE-2020-10768).

A flaw was found in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable (CVE-2020-10781).

In the Linux kernel through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak (CVE-2020-15393).

An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions (CVE-2020-15780).

An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tss_invalidate_io_bitmap mishandling causes a loss of synchronization between the I/O bitmaps of TSS and Xen (CVE-2020-15852).

For other upstream fixes and changes in this update, see the referenced changelogs.

Also, the xtables-addons package has been updated to version 3.10.

This update for ucode-intel fixes the following issues:

Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466)

This update contains security mitigations for:

• CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).
• CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to mitigate the Vector Register and L1D Eviction Sampling aka 'CacheOutAttack' attacks. (bsc#1156353)

Microcode Table:

Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New ---- new platforms ---------------------------------------- ---- updated platforms ------------------------------------ HSW C0 6-3c-3/32 00000027->00000028 Core Gen4 BDW-U/Y E0/F0 6-3d-4/c0 0000002e->0000002f Core Gen5 HSW-U C0/D0 6-45-1/72 00000025->00000026 Core Gen4 HSW-H C0 6-46-1/32 0000001b->0000001c Core Gen4 BDW-H/E3 E0/G0 6-47-1/22 00000021->00000022 Core Gen5 SKL-U/Y D0 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKL-U23e K1 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKX-SP B1 6-55-3/97 01000151->01000157 Xeon Scalable SKX-SP H0/M0/U0 6-55-4/b7 02000065->02006906 Xeon Scalable SKX-D M1 6-55-4/b7 02000065->02006906 Xeon D-21xx CLX-SP B0 6-55-6/bf 0400002c->04002f01 Xeon Scalable Gen2 CLX-SP B1 6-55-7/bf 0500002c->04002f01 Xeon Scalable Gen2 SKL-H/S R0/N0 6-5e-3/36 000000d6->000000dc Core Gen6; Xeon E3 v5 AML-Y22 H0 6-8e-9/10 000000ca->000000d6 Core Gen8 Mobile KBL-U/Y H0 6-8e-9/c0 000000ca->000000d6 Core Gen7 Mobile CFL-U43e D0 6-8e-a/c0 000000ca->000000d6 Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000ca->000000d6 Core Gen8 Mobile AML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile CML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile WHL-U V0 6-8e-c/94 000000ca->000000d6 Core Gen8 Mobile KBL-G/H/S/E3 B0 6-9e-9/2a 000000ca->000000d6 Core Gen7; Xeon E3 v6 CFL-H/S/E3 U0 6-9e-a/22 000000ca->000000d6 Core Gen8 Desktop, Mobile, Xeon E CFL-S B0 6-9e-b/02 000000ca->000000d6 Core Gen8 CFL-H/S P0 6-9e-c/22 000000ca->000000d6 Core Gen9 CFL-H R0 6-9e-d/22 000000ca->000000d6 Core Gen9 Mobile

Also contains the Intel CPU Microcode update to 20200520:

Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New ---- new platforms ---------------------------------------- ---- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061f->00000621 Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000718->0000071a Xeon E3/E5, Core X

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).
• CVE-2018-1000199: Fixed a potential local code execution via ptrace (bsc#1089895).
• CVE-2019-19462: relay_open in kernel/relay.c allowed local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result (bnc#1158265).
• CVE-2019-20806: Fixed a null pointer dereference in tw5864_handle_frame() which may had lead to denial of service (bsc#1172199).
• CVE-2019-20812: The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3, aka CID-b43d1f9f7067 (bnc#1172453).
• CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bsc#1170345).
• CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).
• CVE-2020-10711: Fixed a null pointer dereference in SELinux subsystem which could have allowed a remote network user to crash the kernel resulting in a denial of service (bsc#1171191).
• CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).
• CVE-2020-10732: Fixed kernel data leak in userspace coredumps due to uninitialized data (bsc#1171220).
• CVE-2020-10751: Fixed an improper implementation in SELinux LSM hook where it was assumed that an skb would only contain a single netlink message (bsc#1171189).
• CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).
• CVE-2020-11608: An issue was discovered in drivers/media/usb/gspca/ov519.c that allowed NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d (bnc#1168829).
• CVE-2020-11609: An issue was discovered in the stv06xx subsystem in drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93 (bnc#1168854).
• CVE-2020-12114: Fixed a pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).
• CVE-2020-12464: Fixed a use-after-free due to a transfer without a reference (bsc#1170901).
• CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).
• CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).
• CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).
• CVE-2020-12655: Fixed an issue which could have allowed attackers to trigger a sync of excessive duration via an XFS v5 image with crafted metadata (bsc#1171217).
• CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).
• CVE-2020-12657: An a use-after-free in block/bfq-iosched.c (bsc#1171205).
• CVE-2020-12659: Fixed an out-of-bounds write (by a user with the CAP_NET_ADMIN capability) due to improper headroom validation (bsc#1171214).
• CVE-2020-12769: Fixed an issue which could have allowed attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one (bsc#1171983).
• CVE-2020-13143: Fixed an out-of-bounds read in gadget_dev_desc_UDC_store in…

This update for xen to version 4.12.3 fixes the following issues:

• CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1172205).
• Added support for new 64bit libxl memory API (bsc#1167007 and bsc#1157490).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for xen fixes the following issues:

• CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking (bsc#1173377).
• CVE-2020-15565: Fixed insufficient cache write-back under VT-d (bsc#1173378).
• CVE-2020-15566: Fixed incorrect error handling in event channel port allocation (bsc#1173376).
• CVE-2020-15567: Fixed non-atomic modification of live EPT PTE (bsc#1173380).
• CVE-2020-0543: Special Register Buffer Data Sampling (SRBDS) aka 'CrossTalk' (bsc#1172205).

Additional upstream bug fixes (bsc#1027519)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for xen fixes the following issues:

• CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking (bsc#1173377).
• CVE-2020-15565: Fixed insufficient cache write-back under VT-d (bsc#1173378).
• CVE-2020-15566: Fixed incorrect error handling in event channel port allocation (bsc#1173376).
• CVE-2020-15567: Fixed non-atomic modification of live EPT PTE (bsc#1173380).
• CVE-2020-0543: Special Register Buffer Data Sampling (SRBDS) aka 'CrossTalk' (bsc#1172205).

Additional upstream bug fixes (bsc#1027519)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update syncs the RT kernel from the SUSE Linux Enterprise 15-SP2 codestream.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the sca-patterns-sle11-1.3.5-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sca-patterns-sle12-1.0.8-2.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sca-patterns-sle15-1.0.8-2.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ucode-intel-20210608-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the xen-4.15.1_01-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the spectre-meltdown-checker-26.36.0602723-1.1 package on the GA media of openSUSE Tumbleweed.

This update for SCA patterns fixes the following issues:

sca-patterns-base:

• Version update from 1.3.1 to 1.5.0 to implement the conversion of SCA Tool to Python3 (jsc#SLE-25064, jsc#SLE-24335):
  • Convert SCA Tool from Python2 to Python3 (bsc#1191005, SLE-21579)
  • Added Core.loadFullFile for sectionless parsing (bsc#1187194)
  • Added SUSE.getNetworkInterfaces (bsc#1144162)
  • Changed required dependencies from python to python3-base (bsc#1191199)
  • Fix SUSE.getFileSystems invalid index error (bsc#1185594)
  • Fix SUSE.getFileSystems unbound local SWAP variable (bsc#1185593)
  • Removed Novell/OES references from libraries (bsc#1186034)
  • Updated documentation for SUSE.compareKernel
  • Updated kernel version constants for all SUSE libraries (bsc#1189483)

sca-patterns-hae:

• Version update from 1.3.1 to 1.5.1 to implement the conversion of SCA Tool to Python3 (jsc#SLE-25064, jsc#SLE-24335):
  • Convert SCA Tool from Python2 to Python3 (bsc#1191005, SLE-21579)
  • Added distribution and service pack subdirectories (bsc#1193878)
  • False positive hit from /usr/lib/sca/patterns/HAE/stonith-00002.pl (bsc#1124793)
  • HAE Policies Quorum 2 node cluster requires ignore policy (bsc#1167689)
  • supportconfig indicates IPv6 required by HAE, is already enabled (bsc#1045605)

sca-patterns-suma:

• Version update from 1.0 to 1.5.1 to implement the conversion of SCA Tool to Python3 (jsc#SLE-25064, jsc#SLE-24335):
  • Convert SCA Tool from Python2 to Python3 (bsc#1191005, SLE-21579)

sca-server-report:

• Version update from 1.0.1 to 1.5.1 to implement the conversion of SCA Tool to Python3 (jsc#SLE-25064, jsc#SLE-24335):
  • Convert SCA Tool from Python2 to Python3 (bsc#1191005, SLE-21579)
  • Changed absolute paths to relative ones (bsc#1186316)
  • Changed required dependencies from python to python3-base (bsc#1191199)
  • Ensure that the legacy SuSE-release file works (bsc#1196730)
  • Fix sca report header supportconfig file (bsc#1186442)
  • Fix the report file output path (bsc#1180894)
  • Removed preprocessor elements for OES Filr eDir (bsc#1186420)

sca-patterns-sle15:

• Version update from 1.0.1 to 1.5.1 to implement the conversion of SCA Tool to Python3 (jsc#SLE-25064, jsc#SLE-24335):
  • Convert SCA Tool from Python2 to Python3 (bsc#1191005, SLE-21579)
  • Added Video link to coredumpctl-000018634.py
  • Added video links to patterns (bsc#1190460):
    • bhc-scc-expired.py, bhc-scc-registered.py, bhc-diskused-00001.pl, bhc-memused-00001.pl
  • Fixed crosstalk message strings (bsc#1186312)
  • Fixed field reference in sle15all/lvm-00003.pl
  • Fixed metadata tags in scc-registered.py
  • Fixed percent used calculation for bhc-memused-00001.pl (bsc#1189889)
  • Removed outdated TID2 link in bhc-diskused-00001.pl (bsc#1190260)
  • Requires Core library 1.3.3 which contains Core.logFullFile function
  • Updated registration link in bhc-scc-registered.py
  • Updated renewal link in bhc-scc-expired.py
• New security announcement patterns:
  • Apr 2022 (13) for SUSE-SU-2022:1293-1 SUSE-SU-2022:1313-1 SUSE-SU-2022:1250-1 SUSE-SU-2022:1108-1 SUSE-SU-2022:1292-1 SUSE-SU-2022:1313-1 SUSE-SU-2022:1448-1 SUSE-SU-2022:1250-1 SUSE-SU-2022:1255-1 SUSE-SU-2022:1255-1 SUSE-SU-2022:1288-1 SUSE-SU-2022:1427-1 SUSE-SU-2022:1139-1
  • Mar 2022 (48) for SUSE-SU-2022:1293-1 SUSE-SU-2022:1313-1 SUSE-SU-2022:1250-1 SUSE-SU-2022:1108-1 SUSE-SU-2022:1292-1 SUSE-SU-2022:1313-1 SUSE-SU-2022:1448-1 SUSE-SU-2022:1250-1 SUSE-SU-2022:1255-1 SUSE-SU-2022:1255-1 SUSE-SU-2022:1288-1 SUSE-SU-2022:1427-1 SUSE-SU-2022:1139-1 SUSE-SU-2022:0931-1 SUSE-SU-2022:0703-1 SUSE-SU-2022:0779-1 SUSE-SU-2022:0695-1 SUSE-SU-2022:0826-1 SUSE-SU-2022:0825-1 SUSE-SU-2022:1058-1 SUSE-SU-2022:0679-1 SUSE-SU-2022:0853-1 SUSE-SU-2022:0819-1 SUSE-SU-2022:0778-1 SUSE-SU-2022:0676-1 SUSE-SU-2022:0725-1 SUSE-SU-2022:0754-1 SUSE-SU-2022:0929-1 SUSE-SU-2022:0732-1 SUSE-SU-2022:0703-1 SUSE-SU-2022:0810-1 SUSE-SU-2022:0694-1…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).
• CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).
• CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).
• CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).
• CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).

The following non-security bugs were fixed:

• nfsd4: clean up open owners on OPEN failure (bsc#1154290).
• random: always use batched entropy for get_random_u{32,64} (bsc#1164871).