CVE-2019-11135

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• hw: TSX Transaction Asynchronous Abort (TAA) (CVE-2019-11135)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• hw: TSX Transaction Asynchronous Abort (TAA) (CVE-2019-11135)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This kernel update is based on the upstream 5.3.11 and fixes at least the following security issues:

Insufficient access control in a subsystem for Intel (R) processor graphics may allow an authenticated user to potentially enable escalation of privilege via local access (CVE-2019-0155).

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access (CVE-2019-11135).

Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access (CVE-2018-12207).

For proper mitigations and fixes for theese issues, a microcode update is also needed, either with a bios/uefi update from your hardware vendor or by installing the microcode-0.20191112-1.mga7.nonfree update (mga#25688).

For other upstream fixes in this update, see the referenced changelogs.

This kernel-linus update is based on the upstream 5.3.11 and fixes at least the following security issues:

Insufficient access control in a subsystem for Intel (R) processor graphics may allow an authenticated user to potentially enable escalation of privilege via local access (CVE-2019-0155).

A Spectre SWAPGS gadget was found in the Linux kernel's implementation of system interrupts. An attacker with local access could use this information to reveal private data through a Spectre like side channel (CVE-2019-1125).

A flaw was found in the Linux kernel’s Bluetooth implementation of UART. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash (CVE-2019-10207).

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access (CVE-2019-11135).

Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access (CVE-2018-12207).

For proper mitigations and fixes for theese issues, a microcode update is also needed, either with a bios/uefi update from your hardware vendor or by installing the microcode-0.20191112-1.mga7.nonfree update (mga#25688).

There is heap-based buffer overflow in the marvell wifi chip driver that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code (CVE-2019-14814, CVE-2019-14815, CVE-2019-14816).

An out-of-bounds access issue was found in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (CVE-2019-14821).

A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host (CVE-2019-14835).

In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are not initialized (CVE-2019-16714)

rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow (CVE-2019-17666)

For other upstream fixes in this update, see the referenced changelogs.

This update provides the Intel 20191112 microcode release that adds the microcode side fixes and mitigations for at least the following security issues:

A flaw was found in the implementation of SGX around the access control of protected memory. A local attacker of a system with SGX enabled and an affected intel GPU with the ability to execute code is able to infer the contents of the SGX protected memory (CVE-2019-0117).

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11135).

Improper conditions check in the voltage modulation interface for some Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable denial of service via local access (CVE-2019-11139).

Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access (CVE-2018-12207).

TA Indirect Sharing Erratum (Information Leak)

Incomplete fixes for previous MDS mitigations (VERW)

SHUF* instruction implementation flaw (DoS)

EGETKEY Erratum

Conditional Jump Macro-fusion (DoS or Privilege Escalation)

For the software side fixes and mitigations of theese issues, the kernel must be updated to 5.3.13-1.mga7 (mga¤25686) or later.

NOTE! This is a refresh of the 20191112 security update we released as MGASA-2019-0334. This update provides the Intel 20191115 microcode release that adds more microcode side fixes and mitigations for the Core Gen 6 to Core gen 10, some Xeon E series, adressing at least the following security issues:

A flaw was found in the implementation of SGX around the access control of protected memory. A local attacker of a system with SGX enabled and an affected intel GPU with the ability to execute code is able to infer the contents of the SGX protected memory (CVE-2019-0117).

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11135).

Improper conditions check in the voltage modulation interface for some Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable denial of service via local access (CVE-2019-11139).

Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access (CVE-2018-12207).

TA Indirect Sharing Erratum (Information Leak)

Incomplete fixes for previous MDS mitigations (VERW)

SHUF* instruction implementation flaw (DoS)

EGETKEY Erratum

Conditional Jump Macro-fusion (DoS or Privilege Escalation)

For the software side fixes and mitigations of theese issues, the kernel must be updated to 5.3.13-1.mga7 (mga¤25686) or later.

• Updated from 4.12.0 to 4.12.1
• Device quarantine for alternate pci assignment methods [XSA-306]
• x86: Machine Check Error on Page Size Change DoS [XSA-304, CVE-2018-12207]
• TSX Asynchronous Abort speculative side channel [XSA-305, CVE-2019-11135]
• VCPUOP_initialise DoS [XSA-296, CVE-2019-18420] (rhbz#1771368)
• missing descriptor table limit checking in x86 PV emulation [XSA-298, CVE-2019-18425] (rhbz#1771341)
• Issues with restartable PV type change operations [XSA-299, CVE-2019-18421] (rhbz#1767726)
• add-to-physmap can be abused to DoS Arm hosts [XSA-301, CVE-2019-18423] (rhbz#1771345)
• passed through PCI devices may corrupt host memory after deassignment [XSA-302, CVE-2019-18424] (rhbz#1767731)
• ARM: Interrupts are unconditionally unmasked in exception handlers [XSA-303, CVE-2019-18422] (rhbz#1771443)
• Unlimited Arm Atomics Operations [XSA-295, CVE-2019-17349, CVE-2019-17350] (rhbz#1720760)
• fix HVM DomU boot on some chipsets
• adjust grub2 workaround

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-0154: An unprotected read access to i915 registers has been fixed that could have been abused to facilitate a local denial-of-service attack. (bsc#1135966)

• CVE-2019-0155: A privilege escalation vulnerability has been fixed in the i915 module that allowed batch buffers from user mode to gain super user privileges. (bsc#1135967)

• CVE-2019-16231: drivers/net/fjes/fjes_main.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference (bnc#1150466).

• CVE-2019-18805: There was a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6 (bnc#1156187).

• CVE-2019-17055: base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module did not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21 (bnc#1152782).

• CVE-2019-16995: A memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c, if hsr_add_port fails to add a port, which may cause denial of service, aka CID-6caabe7f197d (bnc#1152685).

• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

  The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

  The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

• CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference (bnc#1150457).

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

  The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed.

  More information can be found on https://www.suse.com/support/kb/doc/?id=7023735

• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

The following non-security bugs were fixed:

• ALSA: bebob: Fix prototype of helper function to return negative value (bsc#1051510).
• ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series (git-fixes).
• ALSA: hda: Add Elkhart Lake PCI ID (bsc#1051510).
• ALSA: hda: Add Tigerlake/Jasperlake PCI ID (bsc#1051510).
• ALSA: hda/ca0132 - Fix possible workqueue stall (bsc#1155836).
• ALSA: hda/realtek - Add support for ALC623 (bsc#1051510).
• ALSA: hda/realtek - Add support for ALC711 (bsc#1051510).
• ALSA: hda/realtek - Fix 2 front mics of codec 0x623 (bsc#1051510).
• ALSA: timer: Fix incorrectly assigned timer instance (git-fixes).
• ALSA: timer: Fix mutex deadlock at releasing card (bsc#1051510).
• arcnet: provide a buffer big enough to actually receive packets (networking-stable-19_09_30).
• ASoc: rockchip: i2s: Fix RPM imbalance (bsc#1051510).
• ASoC: rsnd: Reinitialize bit clock inversion flag for every format setting (bsc#1051510).
• bpf: fix use after free in prog symbol exposure (bsc#1083647).
• btrfs: block-group: Fix a memory leak due to missing btrfs_put_block_group() (bsc#1155178).
• btrfs: qgroup: Always free PREALLOC META reserve in btrfs_delalloc_release_extents() (bsc#1155179).
• btrfs: tracepoints: Fix bad entry members of qgroup events (bsc#1155186).
• btrfs: tracepoints: Fix wrong parameter…

This update for ucode-intel fixes the following issues:

• Updated to 20191112 security release (bsc#1155988)
  • Processor Identifier Version Products
  • Model Stepping F-MO-S/PI Old->New
  • ---- new platforms ----------------------------------------
  • CML-U62 A0 6-a6-0/80 000000c6 Core Gen10 Mobile
  • CNL-U D0 6-66-3/80 0000002a Core Gen8 Mobile
  • SKX-SP B1 6-55-3/97 01000150 Xeon Scalable
  • ICL U/Y D1 6-7e-5/80 00000046 Core Gen10 Mobile
  • ---- updated platforms ------------------------------------
  • SKL U/Y D0 6-4e-3/c0 000000cc->000000d4 Core Gen6 Mobile
  • SKL H/S/E3 R0/N0 6-5e-3/36 000000cc->000000d4 Core Gen6
  • AML-Y22 H0 6-8e-9/10 000000b4->000000c6 Core Gen8 Mobile
  • KBL-U/Y H0 6-8e-9/c0 000000b4->000000c6 Core Gen7 Mobile
  • CFL-U43e D0 6-8e-a/c0 000000b4->000000c6 Core Gen8 Mobile
  • WHL-U W0 6-8e-b/d0 000000b8->000000c6 Core Gen8 Mobile
  • AML-Y V0 6-8e-c/94 000000b8->000000c6 Core Gen10 Mobile
  • CML-U42 V0 6-8e-c/94 000000b8->000000c6 Core Gen10 Mobile
  • WHL-U V0 6-8e-c/94 000000b8->000000c6 Core Gen8 Mobile
  • KBL-G/X H0 6-9e-9/2a 000000b4->000000c6 Core Gen7/Gen8
  • KBL-H/S/E3 B0 6-9e-9/2a 000000b4->000000c6 Core Gen7; Xeon E3 v6
  • CFL-H/S/E3 U0 6-9e-a/22 000000b4->000000c6 Core Gen8 Desktop, Mobile, Xeon E
  • CFL-S B0 6-9e-b/02 000000b4->000000c6 Core Gen8
  • CFL-H R0 6-9e-d/22 000000b8->000000c6 Core Gen9 Mobile
• Includes security fixes for:
  • CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  • CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)

This update was imported from the SUSE:SLE-15:Update update project.

This update for qemu fixes the following issues:

• Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE15
• Fix use-after-free in slirp (CVE-2018-20126 bsc#1119991)
• Fix potential DOS in lsi scsi controller emulation (CVE-2019-12068 bsc#1146873)
• Expose taa-no 'feature', indicating CPU does not have the TSX Async Abort vulnerability. (CVE-2019-11135 bsc#1152506)
• Expose pschange-mc-no 'feature', indicating CPU does not have the page size change machine check vulnerability (CVE-2018-12207 bsc#1155812)

This update was imported from the SUSE:SLE-15:Update update project.

This update for xen fixes the following issues:

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional. (bsc#1155945)
• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack. (bsc#1152497).
• CVE-2019-18425: 32-bit PV guest user mode could elevate its privileges to that of the guest kernel. (bsc#1154456).
• CVE-2019-18421: A malicious PV guest administrator may have been able to escalate their privilege to that of the host. (bsc#1154458).
• CVE-2019-18420: Malicious x86 PV guests may have caused a hypervisor crash, resulting in a Denial of Service (Dos). (bsc#1154448)

This update was imported from the SUSE:SLE-15:Update update project.

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-0154: An unprotected read access to i915 registers has been fixed that could have been abused to facilitate a local denial-of-service attack. (bsc#1135966)

• CVE-2019-0155: A privilege escalation vulnerability has been fixed in the i915 module that allowed batch buffers from user mode to gain super user privileges. (bsc#1135967)

• CVE-2019-16231: drivers/net/fjes/fjes_main.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference (bnc#1150466).

• CVE-2019-18805: There was a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6 (bnc#1156187).

• CVE-2019-17055: base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module did not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21 (bnc#1152782).

• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

  The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

  The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

• CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

  The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed.

  More information can be found on https://www.suse.com/support/kb/doc/?id=7023735

• CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

The following non-security bugs were fixed:

• ALSA: bebob: Fix prototype of helper function to return negative value (bsc#1051510).
• ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series (git-fixes).
• ALSA: firewire-motu: add support for MOTU 4pre (bsc#1111666).
• ALSA: hda/ca0132 - Fix possible workqueue stall (bsc#1155836).
• ALSA: hda/realtek - Add support for ALC623 (bsc#1051510).
• ALSA: hda/realtek - Fix 2 front mics of codec 0x623 (bsc#1051510).
• ALSA: timer: Fix incorrectly assigned timer instance (git-fixes).
• ALSA: timer: Fix mutex deadlock at releasing card (bsc#1051510).
• ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB Interface (bsc#1051510).
• ALSA: usb-audio: Disable quirks for BOSS Katana amplifiers (bsc#1111666).
• ALSA: usb-audio: Fix copy&paste error in the validator (bsc#1111666).
• arm64: Add decoding macros for CP15_32 and CP15_64 traps (jsc#ECO-561).
• arm64: Add part number for Neoverse N1 (jsc#ECO-561).
• arm64: Add silicon-errata.txt entry for ARM erratum 1188873 (jsc#ECO-561).
• arm64: Add support for new control bits CTR_EL0.DIC and CTR_EL0.IDC (jsc#ECO-561,jsc#SLE-10671).
• arm64: Apply ARM64_ERRATUM_1188873 to Neoverse-N1 (jsc#ECO-561).
• arm64: arch_timer: Add workaround for ARM erratum 1188873 (jsc#ECO-561).
• arm64: arch_timer: avoid unused function warning (jsc#ECO-561).
• arm64: compat: Add CNTFRQ trap handler (jsc#ECO-561).
• arm64: compat: Add CNTVCT trap handler (jsc#ECO-561).
• arm64: compat: Add condition code checks and IT advance (jsc#ECO-561).
• arm64: compat: Add cp15_32 and cp15_64 handler arrays (jsc#ECO-561).
• arm64: compat: Add separate CP15 trapping hook (jsc#ECO-561).
• arm64:…

This update for ucode-intel fixes the following issues:

• Updated to 20191112 security release (bsc#1155988)
  • Processor Identifier Version Products
  • Model Stepping F-MO-S/PI Old->New
  • ---- new platforms ----------------------------------------
  • CML-U62 A0 6-a6-0/80 000000c6 Core Gen10 Mobile
  • CNL-U D0 6-66-3/80 0000002a Core Gen8 Mobile
  • SKX-SP B1 6-55-3/97 01000150 Xeon Scalable
  • ICL U/Y D1 6-7e-5/80 00000046 Core Gen10 Mobile
  • ---- updated platforms ------------------------------------
  • SKL U/Y D0 6-4e-3/c0 000000cc->000000d4 Core Gen6 Mobile
  • SKL H/S/E3 R0/N0 6-5e-3/36 000000cc->000000d4 Core Gen6
  • AML-Y22 H0 6-8e-9/10 000000b4->000000c6 Core Gen8 Mobile
  • KBL-U/Y H0 6-8e-9/c0 000000b4->000000c6 Core Gen7 Mobile
  • CFL-U43e D0 6-8e-a/c0 000000b4->000000c6 Core Gen8 Mobile
  • WHL-U W0 6-8e-b/d0 000000b8->000000c6 Core Gen8 Mobile
  • AML-Y V0 6-8e-c/94 000000b8->000000c6 Core Gen10 Mobile
  • CML-U42 V0 6-8e-c/94 000000b8->000000c6 Core Gen10 Mobile
  • WHL-U V0 6-8e-c/94 000000b8->000000c6 Core Gen8 Mobile
  • KBL-G/X H0 6-9e-9/2a 000000b4->000000c6 Core Gen7/Gen8
  • KBL-H/S/E3 B0 6-9e-9/2a 000000b4->000000c6 Core Gen7; Xeon E3 v6
  • CFL-H/S/E3 U0 6-9e-a/22 000000b4->000000c6 Core Gen8 Desktop, Mobile, Xeon E
  • CFL-S B0 6-9e-b/02 000000b4->000000c6 Core Gen8
  • CFL-H R0 6-9e-d/22 000000b8->000000c6 Core Gen9 Mobile
• Includes security fixes for:
  • CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  • CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for qemu fixes the following issues:

qemu was updated to v3.1.1.1, a stable, bug-fix-only release, which includes 2 fixes we already carry, as well as one additional use- after-free fix in slirp. (CVE-2018-20126 bsc#1119991, CVE-2019-14378 bsc#1143794, and CVE-2019-15890 bsc#1149811 respectively)

Security issues fixed:

• CVE-2019-12068: Fixed potential DOS in lsi scsi controller emulation (bsc#1146873)
• CVE-2019-11135: Expose taa-no 'feature', indicating CPU does not have the TSX Async Abort vulnerability. (bsc#1152506)
• CVE-2018-12207: Expose pschange-mc-no 'feature', indicating CPU does not have the page size change machine check vulnerability (bsc#1117665)

Other issues fixed:

• Change how this bug gets fixed (bsc#1144087)
• Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was removed again in qemu-4.0. (bsc#1079730, bsc#1098403, bsc#1111025, bsc#1145427, bsc#1145774)
• Feature support for vfio-ccw dasd ipl (bsc#1145379 jira-SLE-6132)
• Additional hardware instruction support for s390, also update qemu linux headers to 5.2-rc1 (bsc#1145436 jira-SLE-6237)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for ucode-intel fixes the following issues:

• Updated to 20191112 official security release (bsc#1155988)
• Includes security fixes for:
  • CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  • CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)

This update was imported from the SUSE:SLE-15:Update update project.

This update for ucode-intel fixes the following issues:

• Updated to 20191112 official security release (bsc#1155988)
• Includes security fixes for:
  • CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  • CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)

This update was imported from the SUSE:SLE-15-SP1:Update update project.