SUSE-SU-2018:1849-1

Dashboard / Vulnerabilities / SUSE-SU-2018:1849-1

SUSE-SU-2018:1849-1

Summary: Security update for the Linux Kernel

Details: The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bug was fixed: - CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086) The following non-security bugs were fixed: - KVM: x86: Sync back MSR_IA32_SPEC_CTRL to VCPU data structure (bsc#1096242, bsc#1096281). - Xen counterparts of eager FPU implementation. - x86/boot: Fix early command-line parsing when partial word matches (bsc#1096140). - x86/bugs: spec_ctrl must be cleared from cpu_caps_set when being disabled (bsc#1096140). - xen/x86/CPU: Check speculation control CPUID bit (bsc#1068032). - xen/x86/CPU: Sync CPU feature flags late (bsc#1075994 bsc#1075091). - xen/x86/cpu: Factor out application of forced CPU caps (bsc#1075994 bsc#1075091). - xen/x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option (bsc#1065600). - xen/x86/entry/64: Do not use IST entry for #BP stack (bsc#1087088). - xen/x86/entry: Use IBRS on entry to kernel space (bsc#1068032). - xen/x86/idle: Toggle IBRS when going idle (bsc#1068032). - xen/x86/kaiser: Move feature detection up (bsc#1068032).

References: https://www.suse.com/support/update/announcement/2018/suse-su-20181849-1/, https://bugzilla.suse.com/1065600, https://bugzilla.suse.com/1068032, https://bugzilla.suse.com/1075091, https://bugzilla.suse.com/1075994, https://bugzilla.suse.com/1087086, https://bugzilla.suse.com/1087088, https://bugzilla.suse.com/1096140, https://bugzilla.suse.com/1096242, https://bugzilla.suse.com/1096281, https://www.suse.com/security/cve/CVE-2018-3665