CVE-2018-3665

System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel.

System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel.

These are all security issues fixed in the xen-4.15.1_01-1.2 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086)
• CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356)
• CVE-2018-1000204: Prevent infoleak caused by incorrect handling of the SG_IO ioctl (bsc#1096728)
• CVE-2017-13305: Prevent information disclosure vulnerability in encrypted-keys (bsc#1094353)
• CVE-2018-1094: The ext4_fill_super function did not always initialize the crc32c checksum driver, which allowed attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (bsc#1087007).
• CVE-2018-1093: The ext4_valid_block_bitmap function allowed attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers (bsc#1087095).
• CVE-2018-1092: The ext4_iget function mishandled the case of a root directory with a zero i_links_count, which allowed attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (bsc#1087012).
• CVE-2018-1130: NULL pointer dereference in dccp_write_xmit() function that allowed a local user to cause a denial of service by a number of certain crafted system calls (bsc#1092904)
• CVE-2018-5803: Prevent error in the '_sctp_make_chunk()' function when handling SCTP packets length that could have been exploited to cause a kernel crash (bnc#1083900)
• CVE-2018-7492: Prevent NULL pointer dereference in the net/rds/rdma.c __rds_rdma_map() function that allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bsc#1082962)

The following non-security bugs were fixed:

• Btrfs: fix unexpected balance crash due to BUG_ON (bsc#1038553).
• Fix excessive newline in /proc/*/status (bsc#1094823).
• KVM: x86: Sync back MSR_IA32_SPEC_CTRL to VCPU data structure (bsc#1096242, bsc#1096281).
• dm thin metadata: call precommit before saving the roots (bsc#1083382).
• dm thin: fix inability to discard blocks when in out-of-data-space mode (bsc#1083382).
• dm thin: fix missing out-of-data-space to write mode transition if blocks are released (bsc#1083382).
• dm thin: restore requested 'error_if_no_space' setting on OODS to WRITE transition (bsc#1083382).
• dm: fix various targets to dm_register_target after module __init resources created (bsc#1083382).
• kABI: work around BPF SSBD removal (bsc#1087082).
• kgraft/bnx2fc: Do not block kGraft in bnx2fc_l2_rcv kthread (bsc#1094033).
• mm, page_alloc: do not break __GFP_THISNODE by zonelist reset (bsc#1079152).
• usbip: usbip_host: fix NULL-ptr deref and use-after-free errors (bsc#1096480).
• usbip: usbip_host: fix bad unlock balance during stub_probe() (bsc#1096480).
• x86/boot: Fix early command-line parsing when matching at end (bsc#1096281).
• x86/boot: Fix early command-line parsing when partial word matches (bsc#1096281).
• x86/bugs: spec_ctrl must be cleared from cpu_caps_set when being disabled (bsc#1096140).
• x86/kaiser: export symbol kaiser_set_shadow_pgd() (bsc#1092813)
• xen-netfront: fix req_prod check to avoid RX hang when index wraps (bsc#1046610).

The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086)
• CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356)
• CVE-2018-1000204: Prevent infoleak caused by incorrect handling of the SG_IO ioctl (bsc#1096728)
• CVE-2017-13305: Prevent information disclosure vulnerability in encrypted-keys (bsc#1094353)
• CVE-2018-1094: The ext4_fill_super function did not always initialize the crc32c checksum driver, which allowed attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (bsc#1087007)
• CVE-2018-1093: The ext4_valid_block_bitmap function allowed attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers (bsc#1087095)
• CVE-2018-1092: The ext4_iget function mishandled the case of a root directory with a zero i_links_count, which allowed attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (bsc#1087012)
• CVE-2018-1130: NULL pointer dereference in dccp_write_xmit() function that allowed a local user to cause a denial of service by a number of certain crafted system calls (bsc#1092904)
• CVE-2018-5803: Prevent error in the '_sctp_make_chunk()' function when handling SCTP packets length that could have been exploited to cause a kernel crash (bnc#1083900)
• CVE-2018-7492: Prevent NULL pointer dereference in the net/rds/rdma.c __rds_rdma_map() function that allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bsc#1082962)

The following non-security bugs were fixed:

• Fix excessive newline in /proc/*/status (bsc#1094823).
• KVM: x86: Sync back MSR_IA32_SPEC_CTRL to VCPU data structure (bsc#1096242, bsc#1096281).
• ipv6: add mtu lock check in __ip6_rt_update_pmtu (bsc#1092552).
• kABI: work around BPF SSBD removal (bsc#1087082).
• kgraft/bnx2fc: Do not block kGraft in bnx2fc_l2_rcv kthread (bsc#1094033).
• mm, page_alloc: do not break __GFP_THISNODE by zonelist reset (bsc#1079152).
• usbip: usbip_host: fix NULL-ptr deref and use-after-free errors (bsc#1096480).
• usbip: usbip_host: fix bad unlock balance during stub_probe() (bsc#1096480).
• x86/boot: Fix early command-line parsing when matching at end (bsc#1096281).
• x86/boot: Fix early command-line parsing when partial word matches (bsc#1096281).
• x86/bugs: spec_ctrl must be cleared from cpu_caps_set when being disabled (bsc#1096140).
• x86/kaiser: export symbol kaiser_set_shadow_pgd() (bsc#1092813)
• xen-netfront: fix req_prod check to avoid RX hang when index wraps (bsc#1046610).

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.136 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356).
• CVE-2017-18249: The add_free_nid function did not properly track an allocated nid, which allowed local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads (bnc#1087036).
• CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086).
• CVE-2017-18241: Prevent a NULL pointer dereference by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure (bnc#1086400).
• CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read (bnc#1073311).
• CVE-2018-12233: In the ea_get function in fs/jfs/xattr.c, a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr (bnc#1097234).

The following non-security bugs were fixed:

• 8139too: Use disable_irq_nosync() in rtl8139_poll_controller() (bnc#1012382).
• ACPI: acpi_pad: Fix memory leak in power saving threads (bnc#1012382).
• ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c (bnc#1012382).
• ACPICA: Events: add a return on failure from acpi_hw_register_read (bnc#1012382).
• ACPI: processor_perflib: Do not send _PPC change notification if not ready (bnc#1012382).
• affs_lookup(): close a race with affs_remove_link() (bnc#1012382).
• af_key: Always verify length of provided sadb_key (bnc#1012382).
• aio: fix io_destroy(2) vs. lookup_ioctx() race (bnc#1012382).
• alsa: control: fix a redundant-copy issue (bnc#1012382).
• alsa: hda: Add Lenovo C50 All in one to the power_save blacklist (bnc#1012382).
• alsa: hda - Use IS_REACHABLE() for dependency on input (bnc#1012382 bsc#1031717).
• alsa: timer: Call notifier in the same spinlock (bnc#1012382 bsc#973378).
• alsa: timer: Fix pause event notification (bnc#1012382 bsc#973378).
• alsa: usb: mixer: volume quirk for CM102-A+/102S+ (bnc#1012382).
• alsa: vmaster: Propagate slave error (bnc#1012382).
• arc: Fix malformed ARC_EMUL_UNALIGNED default (bnc#1012382).
• arm64: Add ARCH_WORKAROUND_2 probing (bsc#1085308).
• arm64: Add per-cpu infrastructure to call ARCH_WORKAROUND_2 (bsc#1085308).
• arm64: Add 'ssbd' command-line option (bsc#1085308).
• arm64: Add this_cpu_ptr() assembler macro for use in entry.S (bsc#1085308).
• arm64: Add work around for Arm Cortex-A55 Erratum 1024718 (bnc#1012382).
• arm64: alternatives: Add dynamic patching feature (bsc#1085308).
• arm64: assembler: introduce ldr_this_cpu (bsc#1085308).
• arm64: Call ARCH_WORKAROUND_2 on transitions between EL0 and EL1 (bsc#1085308).
• arm64: do not call C code with el0's fp register (bsc#1085308).
• arm64: fix endianness annotation for __apply_alternatives()/get_alt_insn() (bsc#1085308).
• arm64: introduce mov_q macro to move a constant into a 64-bit register (bnc#1012382 bsc#1068032).
• arm64: lse: Add early clobbers to some input/output asm operands (bnc#1012382).
• arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics (bnc#1012382).
• arm64: ssbd: Add global mitigation state accessor (bsc#1085308).
• arm64: ssbd: Add prctl interface for per-thread mitigation (bsc#1085308).
• arm64: ssbd: Introduce thread flag to control…

The SUSE Linux Enterprise 12 SP3 RT kernel was updated to 4.4.138 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-12233: A memory corruption bug in JFS could have been triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability could be triggered by an unprivileged user with the ability to create files and execute programs (bsc#1097234)
• CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086)
• CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356)
• CVE-2017-18249: The add_free_nid function did not properly track an allocated nid, which allowed local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads (bnc#1087036)
• CVE-2017-18241: Prevent a NULL pointer dereference by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure (bnc#1086400)
• CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read (bnc#1073311)
• CVE-2018-3639: Systems with microprocessors utilizing speculative execution and speculative execution of memory reads the addresses of all prior memory writes are known may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4 (bsc#1087082).
• CVE-2018-8781: The udl_fb_mmap function had an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bsc#1090643).
• CVE-2017-13305: Prevent information disclosure vulnerability in encrypted-keys (bsc#1094353)
• CVE-2018-1093: The ext4_valid_block_bitmap function allowed attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers (bsc#1087095)
• CVE-2018-1094: The ext4_fill_super function did not always initialize the crc32c checksum driver, which allowed attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (bsc#1087007)
• CVE-2018-1092: The ext4_iget function mishandled the case of a root directory with a zero i_links_count, which allowed attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (bsc#1087012)
• CVE-2018-1130: NULL pointer dereference in dccp_write_xmit() function that allowed a local user to cause a denial of service by a number of certain crafted system calls (bsc#1092904)
• CVE-2018-5803: Prevent error in the '_sctp_make_chunk()' function when handling SCTP packets length that could have been exploited to cause a kernel crash (bnc#1083900)
• CVE-2018-1065: The netfilter subsystem mishandled the case of a rule blob that contains a jump but lacks a user-defined chain, which allowed local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability (bsc#1083650)
• CVE-2018-7492: Prevent NULL pointer dereference in the net/rds/rdma.c __rds_rdma_map() function that allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bsc#1082962)
• CVE-2018-1000199: Prevent vulnerability in modify_user_hw_breakpoint() that …

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

This new feature was added:

• Btrfs: Remove empty block groups in the background

The following security bugs were fixed:

• CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086)

The following non-security bugs were fixed:

• ALSA: timer: Fix pause event notification (bsc#973378).
• Btrfs: Avoid trucating page or punching hole in a already existed hole (bsc#1088998).
• Btrfs: Avoid truncate tailing page if fallocate range does not exceed inode size (bsc#1094424).
• Btrfs: Fix lost-data-profile caused by auto removing bg.
• Btrfs: Fix misuse of chunk mutex
• Btrfs: Fix out-of-space bug (bsc#1089231).
• Btrfs: Set relative data on clear btrfs_block_group_cache->pinned.
• Btrfs: Use ref_cnt for set_block_group_ro() (bsc#1089239).
• Btrfs: add alloc_fs_devices and switch to it (bsc#1089205).
• Btrfs: add btrfs_alloc_device and switch to it (bsc#1089204).
• Btrfs: add missing discards when unpinning extents with -o discard.
• Btrfs: add missing inode update when punching hole (bsc#1089006).
• Btrfs: add support for asserts (bsc#1089207).
• Btrfs: avoid syncing log in the fast fsync path when not necessary (bsc#1089010).
• Btrfs: btrfs_issue_discard ensure offset/length are aligned to sector boundaries.
• Btrfs: check pending chunks when shrinking fs to avoid corruption (bsc#1089235).
• Btrfs: cleanup backref search commit root flag stuff (bsc#1089200).
• Btrfs: delete chunk allocation attemp when setting block group ro.
• Btrfs: do not leak transaction in btrfs_sync_file() (bsc#1089210).
• Btrfs: do not mix the ordered extents of all files together during logging the inodes (bsc#1089214).
• Btrfs: do not remove extents and xattrs when logging new names (bsc#1089005).
• Btrfs: eliminate races in worker stopping code (bsc#1089211).
• Btrfs: ensure deletion from pinned_chunks list is protected.
• Btrfs: explictly delete unused block groups in close_ctree and ro-remount.
• Btrfs: fix -ENOSPC on block group removal.
• Btrfs: fix -ENOSPC when finishing block group creation.
• Btrfs: fix BUG_ON in btrfs_orphan_add() when delete unused block group.
• Btrfs: fix NULL pointer crash when running balance and scrub concurrently (bsc#1089220).
• Btrfs: fix chunk allocation regression leading to transaction abort (bsc#1089236).
• Btrfs: fix crash caused by block group removal.
• Btrfs: fix data loss in the fast fsync path (bsc#1089007).
• Btrfs: fix deadlock caused by fsync when logging directory entries (bsc#1093194).
• Btrfs: fix directory inconsistency after fsync log replay (bsc#1089001).
• Btrfs: fix directory recovery from fsync log (bsc#1088999).
• Btrfs: fix empty symlink after creating symlink and fsync parent dir (bsc#1093195).
• Btrfs: fix file loss on log replay after renaming a file and fsync (bsc#1093196).
• Btrfs: fix file/data loss caused by fsync after rename and new inode (bsc#1089241).
• Btrfs: fix find_free_dev_extent() malfunction in case device tree has hole (bsc#1089232).
• Btrfs: fix fitrim discarding device area reserved for boot loader's use.
• Btrfs: fix freeing used extent after removing empty block group.
• Btrfs: fix freeing used extents after removing empty block group.
• Btrfs: fix fs mapping extent map leak (bsc#1089229).
• Btrfs: fix fsync data loss after a ranged fsync (bsc#1089221).
• Btrfs: fix fsync data loss after adding hard link to inode (bsc#1089004).
• Btrfs: fix fsync data loss after append write (bsc#1089238).
• Btrfs: fix fsync log replay for inodes with a mix of regular refs and extrefs (bsc#1089003).
• Btrfs: fix fsync race leading to invalid data after log replay (bsc#1089000).
• Btrfs: fix fsync when extend references are added to an inode (bsc#1089002).
• Btrfs: fix fsync xattr loss in the fast fsync path (bsc#1094423).
• Btrfs: fix invalid…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

This new feature was added:

• Btrfs: Remove empty block groups in the background

The following security bugs were fixed:

• : Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086)
• : Systems with microprocessors utilizing speculative execution and speculative execution of memory reads the addresses of all prior memory writes are known may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4 (bsc#1087082)
• : Prevent vulnerability in modify_user_hw_breakpoint() that could have caused a crash and possibly memory corruption (bsc#1089895)
• : The do_get_mempolicy function allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls (bnc#1091755).

The following non-security bugs were fixed:

• ALSA: timer: Fix pause event notification (bsc#973378).
• Avoid quadratic search when freeing delegations (bsc#1084760).
• Btrfs: Avoid trucating page or punching hole in a already existed hole (bsc#1088998).
• Btrfs: Avoid truncate tailing page if fallocate range does not exceed inode size (bsc#1094424).
• Btrfs: Fix lost-data-profile caused by auto removing bg
• Btrfs: Fix misuse of chunk mutex
• Btrfs: Fix out-of-space bug (bsc#1089231).
• Btrfs: Set relative data on clear btrfs_block_group_cache->pinned
• Btrfs: Use ref_cnt for set_block_group_ro() (bsc#1089239).
• Btrfs: add alloc_fs_devices and switch to it (bsc#1089205).
• Btrfs: add btrfs_alloc_device and switch to it (bsc#1089204).
• Btrfs: add missing discards when unpinning extents with -o discard
• Btrfs: add missing inode update when punching hole (bsc#1089006).
• Btrfs: add support for asserts (bsc#1089207).
• Btrfs: avoid syncing log in the fast fsync path when not necessary (bsc#1089010).
• Btrfs: btrfs_issue_discard ensure offset/length are aligned to sector boundaries
• Btrfs: check pending chunks when shrinking fs to avoid corruption (bsc#1089235).
• Btrfs: cleanup backref search commit root flag stuff (bsc#1089200).
• Btrfs: do not leak transaction in btrfs_sync_file() (bsc#1089210).
• Btrfs: do not mix the ordered extents of all files together during logging the inodes (bsc#1089214).
• Btrfs: do not remove extents and xattrs when logging new names (bsc#1089005).
• Btrfs: eliminate races in worker stopping code (bsc#1089211).
• Btrfs: ensure deletion from pinned_chunks list is protected
• Btrfs: fix -ENOSPC on block group removal
• Btrfs: fix -ENOSPC when finishing block group creation
• Btrfs: fix NULL pointer crash when running balance and scrub concurrently (bsc#1089220).
• Btrfs: fix chunk allocation regression leading to transaction abort (bsc#1089236).
• Btrfs: fix crash caused by block group removal
• Btrfs: fix data loss in the fast fsync path (bsc#1089007).
• Btrfs: fix deadlock caused by fsync when logging directory entries (bsc#1093194).
• Btrfs: fix directory inconsistency after fsync log replay (bsc#1089001).
• Btrfs: fix directory recovery from fsync log (bsc#1088999).
• Btrfs: fix empty symlink after creating symlink and fsync parent dir (bsc#1093195).
• Btrfs: fix file loss on log replay after renaming a file and fsync (bsc#1093196).
• Btrfs: fix file/data loss caused by fsync after rename and new inode (bsc#1089241).
• Btrfs: fix find_free_dev_extent() malfunction in case device tree has hole (bsc#1089232).
• Btrfs: fix fitrim discarding device area reserved for boot loader's use
• Btrfs: fix freeing used extent after removing empty block group
• Btrfs: fix freeing used extents after removing empty block group
• Btrfs: fix fs mapping extent map leak (bsc#1089229).
• Btrfs: fix fsync data loss after a ranged fsync…

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes.

The following security bug was fixed:

• CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086)

The following non-security bugs were fixed:

• KVM: x86: Sync back MSR_IA32_SPEC_CTRL to VCPU data structure (bsc#1096242, bsc#1096281).
• Xen counterparts of eager FPU implementation.
• x86/boot: Fix early command-line parsing when partial word matches (bsc#1096140).
• x86/bugs: spec_ctrl must be cleared from cpu_caps_set when being disabled (bsc#1096140).
• xen/x86/CPU: Check speculation control CPUID bit (bsc#1068032).
• xen/x86/CPU: Sync CPU feature flags late (bsc#1075994 bsc#1075091).
• xen/x86/cpu: Factor out application of forced CPU caps (bsc#1075994 bsc#1075091).
• xen/x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option (bsc#1065600).
• xen/x86/entry/64: Do not use IST entry for #BP stack (bsc#1087088).
• xen/x86/entry: Use IBRS on entry to kernel space (bsc#1068032).
• xen/x86/idle: Toggle IBRS when going idle (bsc#1068032).
• xen/x86/kaiser: Move feature detection up (bsc#1068032).

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356)
• CVE-2018-1000204: Prevent infoleak caused by incorrect handling of the SG_IO ioctl (bsc#1096728).
• CVE-2017-18249: The add_free_nid function did not properly track an allocated nid, which allowed local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads (bnc#1087036)
• CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086)
• CVE-2017-18241: Prevent a NULL pointer dereference by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure (bnc#1086400)
• CVE-2017-13305: Prevent information disclosure vulnerability in encrypted-keys (bsc#1094353).
• CVE-2018-1093: The ext4_valid_block_bitmap function allowed attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c did not validate bitmap block numbers (bsc#1087095).
• CVE-2018-1094: The ext4_fill_super function did not always initialize the crc32c checksum driver, which allowed attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (bsc#1087007).
• CVE-2018-1092: The ext4_iget function mishandled the case of a root directory with a zero i_links_count, which allowed attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (bsc#1087012).
• CVE-2018-1130: NULL pointer dereference in dccp_write_xmit() function that allowed a local user to cause a denial of service by a number of certain crafted system calls (bsc#1092904).
• CVE-2018-1065: The netfilter subsystem mishandled the case of a rule blob that contains a jump but lacks a user-defined chain, which allowed local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability (bsc#1083650).
• CVE-2018-5803: Prevent error in the '_sctp_make_chunk()' function when handling SCTP packets length that could have been exploited to cause a kernel crash (bnc#1083900).
• CVE-2018-7492: Prevent NULL pointer dereference in the net/rds/rdma.c __rds_rdma_map() function that allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bsc#1082962).
• CVE-2018-1000199: Prevent vulnerability in modify_user_hw_breakpoint() that could have caused a crash and possibly memory corruption (bsc#1089895).

The following non-security bugs were fixed:

• ALSA: timer: Fix pause event notification (bsc#973378).
• Fix excessive newline in /proc/*/status (bsc#1094823).
• Fix the patch content (bsc#1085185)
• KVM: x86: Sync back MSR_IA32_SPEC_CTRL to VCPU data structure (bsc#1096242, bsc#1096281).
• Revert 'bs-upload-kernel: do not set %opensuse_bs' This reverts commit e89e2b8cbef05df6c874ba70af3cb4c57f82a821.
• ipv6: add mtu lock check in __ip6_rt_update_pmtu (bsc#1092552).
• ipv6: omit traffic class when calculating flow hash (bsc#1095042).
• kgraft/bnx2fc: Do not block kGraft in bnx2fc_l2_rcv kthread (bsc#1094033).
• mm, page_alloc: do not break __GFP_THISNODE by zonelist reset (bsc#1079152, VM Functionality).
• x86/boot: Fix early command-line parsing when partial word matches (bsc#1096140).
• x86/bugs: IBRS: make runtime disabling fully dynamic (bsc#1096281).
• x86/bugs: Respect retpoline command line option (bsc#1068032).
• x86/bugs: correctly force-disable…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356)
• CVE-2018-1000204: Prevent infoleak caused by incorrect handling of the SG_IO ioctl (bsc#1096728).
• CVE-2017-18249: The add_free_nid function did not properly track an allocated nid, which allowed local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads (bnc#1087036)
• CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086)
• CVE-2017-18241: Prevent a NULL pointer dereference by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure (bnc#1086400)
• CVE-2017-13305: Prevent information disclosure vulnerability in encrypted-keys (bsc#1094353).
• CVE-2018-1093: The ext4_valid_block_bitmap function allowed attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c did not validate bitmap block numbers (bsc#1087095).
• CVE-2018-1094: The ext4_fill_super function did not always initialize the crc32c checksum driver, which allowed attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (bsc#1087007).
• CVE-2018-1092: The ext4_iget function mishandled the case of a root directory with a zero i_links_count, which allowed attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (bsc#1087012).
• CVE-2018-1130: NULL pointer dereference in dccp_write_xmit() function that allowed a local user to cause a denial of service by a number of certain crafted system calls (bsc#1092904).
• CVE-2018-1065: The netfilter subsystem mishandled the case of a rule blob that contains a jump but lacks a user-defined chain, which allowed local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability (bsc#1083650).
• CVE-2018-5803: Prevent error in the '_sctp_make_chunk()' function when handling SCTP packets length that could have been exploited to cause a kernel crash (bnc#1083900).
• CVE-2018-7492: Prevent NULL pointer dereference in the net/rds/rdma.c __rds_rdma_map() function that allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bsc#1082962).
• CVE-2018-1000199: Prevent vulnerability in modify_user_hw_breakpoint() that could have caused a crash and possibly memory corruption (bsc#1089895).

The following non-security bugs were fixed:

• ALSA: timer: Fix pause event notification (bsc#973378).
• Fix excessive newline in /proc/*/status (bsc#1094823).
• Fix the patch content (bsc#1085185)
• KVM: x86: Sync back MSR_IA32_SPEC_CTRL to VCPU data structure (bsc#1096242, bsc#1096281).
• Revert 'bs-upload-kernel: do not set %opensuse_bs' This reverts commit e89e2b8cbef05df6c874ba70af3cb4c57f82a821.
• ipv6: add mtu lock check in __ip6_rt_update_pmtu (bsc#1092552).
• ipv6: omit traffic class when calculating flow hash (bsc#1095042).
• kgraft/bnx2fc: Do not block kGraft in bnx2fc_l2_rcv kthread (bsc#1094033).
• mm, page_alloc: do not break __GFP_THISNODE by zonelist reset (bsc#1079152, VM Functionality).
• x86/boot: Fix early command-line parsing when partial word matches (bsc#1096140).
• x86/bugs: IBRS: make runtime disabling fully dynamic (bsc#1096281).
• x86/bugs: Respect retpoline command line option (bsc#1068032).
• x86/bugs: correctly force-disable…

This update for the Linux Kernel 4.4.103-92_53 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 4.4.90-92_45 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 4.4.114-92_67 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 4.4.103-92_56 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 4.4.114-92_64 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 4.4.121-92_80 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 4.4.90-92_50 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 4.4.120-92_70 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 4.4.121-92_73 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for xen fixes the following issues:

Security issues fixed:

• CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242).
• CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521).
• CVE-2018-12892: Fix libxl to honour the readonly flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523).
• CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522).

Bug fixes:

• bsc#1027519: Add upstream patches from January.
• bsc#1098403: Fix regression introduced by changes for bsc#1079730. A PV domU without qcow2 and/or vfb has no qemu attached. Ignore QMP errors for PV domUs to handle PV domUs with and without an attached qemu-xen.
• bsc#1087289: Fix xen scheduler crash.

This update for xen fixes the following issues:

Security issues fixed:

• CVE-2018-12617: Fix integer overflow that causes segmentation fault in qmp_guest_file_read() with g_malloc() (bsc#1098744).
• CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242).
• CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224).
• CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521).
• CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522).

Bug fixes:

• bsc#1079730: Fix failed 'write' lock.
• bsc#1027519: Add upstream patches from January.

This update for the Linux Kernel 4.4.74-92_32 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for xen fixes the following issues:

Security issues fixed:

• CVE-2018-12617: Fix integer overflow that causes segmentation fault in qmp_guest_file_read() with g_malloc() (bsc#1098744).
• CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242).
• CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224).
• CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521).
• CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522).

Bug fixes:

• bsc#1079730: Fix failed 'write' lock.
• bsc#1027519: Add upstream patches from January.

This update for xen fixes the following issues:

Security issues fixed:

• CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242).
• CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521).
• CVE-2018-12892: Fix libxl to honour the readonly flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523).
• CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522).
• CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224).

Bug fixes:

• bsc#1027519: Add upstream patches from January.
• bsc#1087289: Fix xen scheduler crash.

This update for xen fixes the following issues:

Security issues fixed:

• CVE-2018-12617: Fix integer overflow that causes segmentation fault in qmp_guest_file_read() with g_malloc() (bsc#1098744).
• CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242).
• CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224).
• CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521).
• CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522).

Bug fixes:

• bsc#1079730: Fix failed 'write' lock.
• bsc#1027519: Add upstream patches from January.

This update for xen fixes the following issues:

Security issues fixed:

• CVE-2018-12891: Fix preemption checks bypass in x86 PV MM handling (XSA-264) (bsc#1097521).
• CVE-2018-12892: Fix libxl failure to honour readonly flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523).
• CVE-2018-12893: Fix #DB exception safety check that could be triggered by a guest (XSA-265) (bsc#1097522).
• CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224).
• CVE-2018-3665: Fix lazy FP Save/Restore (XSA-267) (bsc#1095242).

Bug fixes:

• bsc#1027519: Update to Xen 4.7.6 bug fix only release.
• bsc#1087289: Xen BUG at sched_credit.c:1663.
• bsc#1094725: virsh blockresize does not work with Xen qdisks.

This update for xen fixes the following issues:

Security issues fixed:

• CVE-2018-12891: Fix preemption checks bypass in x86 PV MM handling (XSA-264) (bsc#1097521).
• CVE-2018-12892: Fix libxl failure to honour readonly flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523).
• CVE-2018-12893: Fix #DB exception safety check that could be triggered by a guest (XSA-265) (bsc#1097522).
• CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224).
• CVE-2018-3665: Fix lazy FP Save/Restore (XSA-267) (bsc#1095242).

Bug fixes:

• bsc#1027519: Update to Xen 4.7.6 bug fix only release.
• bsc#1087289: Xen BUG at sched_credit.c:1663.
• bsc#1094725: virsh blockresize does not work with Xen qdisks.

This update for the Linux Kernel 3.12.74-60_64_57 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 3.12.74-60_64_93 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 3.12.74-60_64_54 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 3.12.61-52_128 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 4.4.74-92_35 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 3.12.74-60_64_85 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 3.12.61-52_92 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 3.12.61-52_119 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 3.12.61-52_122 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 3.12.74-60_64_69 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).

This update for the Linux Kernel 3.12.61-52_106 fixes several issues.

The following security issue was fixed:

• CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740).