{"id":"SUSE-SU-2018:1482-1","aliases":[],"status":"published","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.\n\nThis update main focus is a regression fix in SystemV IPC handling. (bsc#1093600)\n\nThe following non-security bugs were fixed:\n\n- Drop cBPF SSBD as classic BPF does not really have a proper concept of pointers, and without eBPF maps the out-of-bounds access in speculative execution branch can't be mounted. Moreoever, seccomp BPF uses only such a subset of BPF that can only do absolute indexing, and therefore seccomp data buffer boundarier can't be crossed. Information condensed from Alexei and Kees.\n- ibrs used instead of retpoline on Haswell processor with spectre_v2=retpoline (bsc#1092497)\n- ib/mlx4: Convert slave port before building address-handle (bug#919382 FATE#317529).\n- KABI protect struct _lowcore (bsc#1089386).\n- Update config files, add Spectre mitigation for s390x (bnc#1089386, LTC#166572).\n- Update s390 config files (bsc#1089386).\n- fanotify: fix logic of events on child (bsc#1013018).\n- ipc/msg: Fix faulty parsing of msgctl args (bsc#1093600,bsc#1072689).\n- ocfs2/dlm: Fix up kABI in dlm_ctxt (bsc#1070404).\n- ocfs2/dlm: wait for dlm recovery done when migrating all lock resources (bsc#1013018).\n- powerpc, KVM: Split HVMODE_206 cpu feature bit into separate HV and architecture bits (bsc#1087082).\n- powerpc: Fix /proc/cpuinfo revision for POWER9 DD2 (FATE#325713, bsc#1093710).\n- s390/cio: update chpid descriptor after resource accessibility event (bnc#1091659, LTC#167429).\n- s390/dasd: fix IO error for newly defined devices (bnc#1091659, LTC#167398).\n- s390/qdio: fix access to uninitialized qdio_q fields (bnc#1091659, LTC#168037).\n- s390/qeth: on channel error, reject further cmd requests (bnc#1088343, LTC#165985).\n- s390: add automatic detection of the spectre defense (bnc#1089386, LTC#166572).\n- s390: add optimized array_index_mask_nospec (bnc#1089386, LTC#166572).\n- s390: add sysfs attributes for spectre (bnc#1089386, LTC#166572).\n- s390: correct module section names for expoline code revert (bsc#1089386).\n- s390: correct nospec auto detection init order (bnc#1089386, LTC#166572).\n- s390: do not bypass BPENTER for interrupt system calls (bnc#1089386, LTC#166572).\n- s390: fix retpoline build on 31bit (bsc#1089386).\n- s390: improve cpu alternative handling for gmb and nobp (bnc#1089386, LTC#166572).\n- s390: introduce execute-trampolines for branches (bnc#1089386, LTC#166572).\n- s390: move nobp parameter functions to nospec-branch.c (bnc#1089386, LTC#166572).\n- s390: report spectre mitigation via syslog (bnc#1089386, LTC#166572).\n- s390: run user space and KVM guests with modified branch prediction (bnc#1089386, LTC#166572).\n- s390: scrub registers on kernel entry and KVM exit (bnc#1089386, LTC#166572).\n- x86, mce: Fix mce_start_timer semantics (bsc#1090607).\n- x86/kaiser: symbol kaiser_set_shadow_pgd() exported with non GPL","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-05-31T18:27:37Z","modified":"2018-05-31T18:27:37Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"kernel-docs","fixed_in":["3.0.101-108.52.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-bigmem","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-default","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-ec2","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-pae","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-ppc64","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-source","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-syms","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-trace","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-xen","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-bigmem","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-default","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-ec2","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-pae","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-ppc64","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-source","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-syms","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-trace","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-xen","fixed_in":["3.0.101-108.52.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-bigmem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-ppc64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-bigmem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-ppc64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.52.1"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181482-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1013018","tags":["report"]},{"url":"https://bugzilla.suse.com/1070404","tags":["report"]},{"url":"https://bugzilla.suse.com/1072689","tags":["report"]},{"url":"https://bugzilla.suse.com/1087082","tags":["report"]},{"url":"https://bugzilla.suse.com/1088343","tags":["report"]},{"url":"https://bugzilla.suse.com/1089386","tags":["report"]},{"url":"https://bugzilla.suse.com/1090607","tags":["report"]},{"url":"https://bugzilla.suse.com/1091659","tags":["report"]},{"url":"https://bugzilla.suse.com/1092497","tags":["report"]},{"url":"https://bugzilla.suse.com/1093600","tags":["report"]},{"url":"https://bugzilla.suse.com/1093710","tags":["report"]},{"url":"https://bugzilla.suse.com/919382","tags":["report"]}],"sources":{"osv":[{"id":"SUSE-SU-2018:1482-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.\n\nThis update main focus is a regression fix in SystemV IPC handling. (bsc#1093600)\n\nThe following non-security bugs were fixed:\n\n- Drop cBPF SSBD as classic BPF does not really have a proper concept of pointers, and without eBPF maps the out-of-bounds access in speculative execution branch can't be mounted. Moreoever, seccomp BPF uses only such a subset of BPF that can only do absolute indexing, and therefore seccomp data buffer boundarier can't be crossed. Information condensed from Alexei and Kees.\n- ibrs used instead of retpoline on Haswell processor with spectre_v2=retpoline (bsc#1092497)\n- ib/mlx4: Convert slave port before building address-handle (bug#919382 FATE#317529).\n- KABI protect struct _lowcore (bsc#1089386).\n- Update config files, add Spectre mitigation for s390x (bnc#1089386, LTC#166572).\n- Update s390 config files (bsc#1089386).\n- fanotify: fix logic of events on child (bsc#1013018).\n- ipc/msg: Fix faulty parsing of msgctl args (bsc#1093600,bsc#1072689).\n- ocfs2/dlm: Fix up kABI in dlm_ctxt (bsc#1070404).\n- ocfs2/dlm: wait for dlm recovery done when migrating all lock resources (bsc#1013018).\n- powerpc, KVM: Split HVMODE_206 cpu feature bit into separate HV and architecture bits (bsc#1087082).\n- powerpc: Fix /proc/cpuinfo revision for POWER9 DD2 (FATE#325713, bsc#1093710).\n- s390/cio: update chpid descriptor after resource accessibility event (bnc#1091659, LTC#167429).\n- s390/dasd: fix IO error for newly defined devices (bnc#1091659, LTC#167398).\n- s390/qdio: fix access to uninitialized qdio_q fields (bnc#1091659, LTC#168037).\n- s390/qeth: on channel error, reject further cmd requests (bnc#1088343, LTC#165985).\n- s390: add automatic detection of the spectre defense (bnc#1089386, LTC#166572).\n- s390: add optimized array_index_mask_nospec (bnc#1089386, LTC#166572).\n- s390: add sysfs attributes for spectre (bnc#1089386, LTC#166572).\n- s390: correct module section names for expoline code revert (bsc#1089386).\n- s390: correct nospec auto detection init order (bnc#1089386, LTC#166572).\n- s390: do not bypass BPENTER for interrupt system calls (bnc#1089386, LTC#166572).\n- s390: fix retpoline build on 31bit (bsc#1089386).\n- s390: improve cpu alternative handling for gmb and nobp (bnc#1089386, LTC#166572).\n- s390: introduce execute-trampolines for branches (bnc#1089386, LTC#166572).\n- s390: move nobp parameter functions to nospec-branch.c (bnc#1089386, LTC#166572).\n- s390: report spectre mitigation via syslog (bnc#1089386, LTC#166572).\n- s390: run user space and KVM guests with modified branch prediction (bnc#1089386, LTC#166572).\n- s390: scrub registers on kernel entry and KVM exit (bnc#1089386, LTC#166572).\n- x86, mce: Fix mce_start_timer semantics (bsc#1090607).\n- x86/kaiser: symbol kaiser_set_shadow_pgd() exported with non GPL\n","status":"published","published":"2018-05-31T18:27:37Z","modified":"2018-05-31T18:27:37Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}