<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for the Linux Kernel (Live Patch 13 for SLE 12 SP2)</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2018:2387-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2018-08-16T16:00:10Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2018-08-16T16:00:10Z</InitialReleaseDate>
    <CurrentReleaseDate>2018-08-16T16:00:10Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for the Linux Kernel (Live Patch 13 for SLE 12 SP2)</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for the Linux Kernel 4.4.74-92_38 fixes several issues.

The following security issues were fixed:

- CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
- CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent-&gt;sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203).
before 4.14.8
- CVE-2017-11600: net/xfrm/xfrm_policy.c did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bsc#1096564) 
- CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-SLE-SAP-12-SP2-2018-1651,SUSE-SLE-SERVER-12-SP2-2018-1651</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20182387-1/</URL>
      <Description>Link for SUSE-SU-2018:2387-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2018-August/004455.html</URL>
      <Description>E-Mail link for SUSE-SU-2018:2387-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1096564</URL>
      <Description>SUSE Bug 1096564</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1097108</URL>
      <Description>SUSE Bug 1097108</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1099306</URL>
      <Description>SUSE Bug 1099306</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1103203</URL>
      <Description>SUSE Bug 1103203</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-11600/</URL>
      <Description>SUSE CVE CVE-2017-11600 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-18344/</URL>
      <Description>SUSE CVE CVE-2017-18344 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-10853/</URL>
      <Description>SUSE CVE CVE-2018-10853 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-3646/</URL>
      <Description>SUSE CVE CVE-2018-3646 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP2-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS" CPE="cpe:/o:suse:sles-ltss:12:sp2">SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2" CPE="cpe:/o:suse:sles_sap:12:sp2">SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="kgraft-patch-4_4_74-92_38-default-11-2.1">
      <FullProductName ProductID="kgraft-patch-4_4_74-92_38-default-11-2.1">kgraft-patch-4_4_74-92_38-default-11-2.1</FullProductName>
    </Branch>
    <Relationship ProductReference="kgraft-patch-4_4_74-92_38-default-11-2.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:kgraft-patch-4_4_74-92_38-default-11-2.1">kgraft-patch-4_4_74-92_38-default-11-2.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="kgraft-patch-4_4_74-92_38-default-11-2.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:kgraft-patch-4_4_74-92_38-default-11-2.1">kgraft-patch-4_4_74-92_38-default-11-2.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.</Note>
    </Notes>
    <CVE>CVE-2017-11600</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:kgraft-patch-4_4_74-92_38-default-11-2.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:kgraft-patch-4_4_74-92_38-default-11-2.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5.9</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:N/C:P/I:P/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20182387-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-11600.html</URL>
        <Description>CVE-2017-11600</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1050231</URL>
        <Description>SUSE Bug 1050231</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1096564</URL>
        <Description>SUSE Bug 1096564</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1115893</URL>
        <Description>SUSE Bug 1115893</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent-&gt;sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).</Note>
    </Notes>
    <CVE>CVE-2017-18344</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:kgraft-patch-4_4_74-92_38-default-11-2.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:kgraft-patch-4_4_74-92_38-default-11-2.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.1</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20182387-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-18344.html</URL>
        <Description>CVE-2017-18344</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1087082</URL>
        <Description>SUSE Bug 1087082</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1102851</URL>
        <Description>SUSE Bug 1102851</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1103203</URL>
        <Description>SUSE Bug 1103203</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1103580</URL>
        <Description>SUSE Bug 1103580</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1215674</URL>
        <Description>SUSE Bug 1215674</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest.</Note>
    </Notes>
    <CVE>CVE-2018-10853</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:kgraft-patch-4_4_74-92_38-default-11-2.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:kgraft-patch-4_4_74-92_38-default-11-2.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.6</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.4</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20182387-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-10853.html</URL>
        <Description>CVE-2018-10853</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1097104</URL>
        <Description>SUSE Bug 1097104</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1097108</URL>
        <Description>SUSE Bug 1097108</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis.</Note>
    </Notes>
    <CVE>CVE-2018-3646</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:kgraft-patch-4_4_74-92_38-default-11-2.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:kgraft-patch-4_4_74-92_38-default-11-2.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.7</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:N/C:C/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.6</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20182387-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-3646.html</URL>
        <Description>CVE-2018-3646</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1087078</URL>
        <Description>SUSE Bug 1087078</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1087081</URL>
        <Description>SUSE Bug 1087081</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1089343</URL>
        <Description>SUSE Bug 1089343</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1091107</URL>
        <Description>SUSE Bug 1091107</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1099306</URL>
        <Description>SUSE Bug 1099306</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104365</URL>
        <Description>SUSE Bug 1104365</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104894</URL>
        <Description>SUSE Bug 1104894</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1106548</URL>
        <Description>SUSE Bug 1106548</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1113534</URL>
        <Description>SUSE Bug 1113534</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1136865</URL>
        <Description>SUSE Bug 1136865</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178658</URL>
        <Description>SUSE Bug 1178658</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1201877</URL>
        <Description>SUSE Bug 1201877</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
