Bugzilla – Bug 1137586
EMU: VUL-0: kernel-source: multiple remote denial of service issues (SACK Panic)
Last modified: 2024-07-04 09:12:16 UTC
Issue #1 ("SACK Panic"): this is most serious, AFAICS, remotely triggerable BUG_ON() check which for many users means a crash. Affects all our branches from 2.6.32 up. 2.6.16 should be safe, AFAICS. The patch doesn't break kABI and seems reasonably simple and straightforward so that even if it doesn't apply cleanly, it should be feasible to apply its logic to older kernels.
Issue #2 ("SACK Slowness / extensive resource usage"): remotely triggered DoS, hard to say how serious without trying to reproduce. More serious on pre-4.15 kernels which have retransmit queue implemented as a linear linked list (it's rbtree since 4.15; I considered this for a backport to SLE15 but decided it was too late). The patch, as is, breaks kABI but it's only the part that adds a new SNMP counter which is only diagnostic so that it can be omitted (we could make the counter available in a different way but I don't think it's necessary). What remains is one simple check which is kABI safe and should be easy to backport to older kernels.
(Issue #3 seems to be FreeBSD specific version of #2.) Issue #4 ("Excess Resource Consumption Due to Low MSS Values"): this seems least serious but the solution is IMHO the most questionable. The patch itself does not change anything, it only makes the minimum accepted MSS (which is 48 now) configurable but leaves the default value at 48. The patch itself is kABI safe and simple enough so that backports shouldn't be too complicated. To actually mitigate this kind of attack, one needs to set the new sysctl (net.ipv4.tcp_min_snd_mss) to some higher value. I would say a value like 400 would improve the response to this attack considerably without breaking any reasonable use case. However, there is a risk that there might be some strange setup where the peer really requires shorter MSS so that this would break the communication. There seem to be two options: (a) only apply the patch, leave the default at 48 and document the new sysctl on the CVE page and/or in a TID so that users who want to be safe (and risk the hypothetical problems) can raise the limit (b) apply the patch and raise the default to e.g. 400, either via a SUSE specific kernel patch or (preferrably) via a file in sysctl.d; document on CVE page and/or in a TID so that users who would encounter problems can lower the value to whatever they need; in this case, we probably should add a ratelimited warning to kernel log when MSS clamping happens so that it's easy to see when it happens
Created attachment 807156 [details] 0001-tcp-enforce-tcp_min_snd_mss-in-tcp_mtu_probing.patch from tyler hicks via distros Eric discovered that the third Linux patch was incomplete when attempting to set a minimum MSS. I've attached an additional patch that he wrote. He also mentioned the need to ensure that MTU probing is disabled when attempting to use the low-MSS filters that Netflix provided as Linux workarounds for issues #1, #2, and #4. From my quick review of the MTU probing code, I think that means the net.ipv4.tcp_mtu_probing sysctl should be set to '0' which looks to be the default. Tyler
For the sake of completeness: third patch adding the tcp_min_snd_mss sysctl also needs a kabi hack as the sysctl is per netns so that its value is stored in a member of struct netns_ipv4 and adding such member changes the layout of struct net in an incompatible way. Fortunately, struct net can be safely extended by adding new members at its end so that the kabi hack is trivial. As our backports to branches based on 3.12 and older have this sysctl global, its value is stored in a regular variable and there is no kabi breakage.
Created attachment 807247 [details] tcp-fix-fack_count-accounting-on-tcp_shift_skb_data.patch From: John Haxby <john.haxby@oracle.com> To: distros Hello All, A further patch is needed for 4.14 and prior kernels, without it you will see a WARN_ON of sacked_out at the top of tcp_fast_retrans_alert() and some spurious softlockups. The following +patch is out for review, it's been tentatively accepted. jch
From: Seth Arnold <seth.arnold@canonical.com> CVE-2019-11477 -- u16 overflow of TCP_SKB_CB(skb)->tcp_gso_segs Fixed in patch named 0001-tcp-limit-payload-size-of-sacked-skbs.patch CVE-2019-11478 -- tcp_fragment, prevent fragmenting a packet when the socket is already using more than half the allowed space Fixed in patch 0002-tcp-tcp_fragment-should-apply-sane-memory-limits.patch CVE-2019-11479 -- tcp mss hardcoded to 48 Fixed in patch 0003-tcp-add-tcp_min_snd_mss-sysctl.patch
Created attachment 807256 [details] tcp-fix-fack_count-accounting-on-tcp_shift_skb_data.patch Latest patch was malformed (whitespace mangled). Recreated from git.
An update workflow for this issue was started. This issue was rated as critical. Please submit fixed packages until 2019-06-13. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/64297
As an FYI, the TID number for this will be: 7023928
Patch series submitted to upstream: http://patchwork.ozlabs.org/project/netdev/list/?series=114310 I'm going to compare these with what we have.
with the patch series listing the CVEs, we can make this public.
Submitted patches are exactly the same as those in comments 2, 3, 4 and 11 except for some differences in commit messages (added CVE references and Cc/Acked-by tags).
This is an autogenerated message for OBS integration: This bug (1137586) was mentioned in https://build.opensuse.org/request/show/710395 15.1 / kernel-source https://build.opensuse.org/request/show/710403 15.0 / kernel-source https://build.opensuse.org/request/show/710405 42.3 / kernel-source
From: Security Report <security-report@saasmail.netflix.com> Subject: [oss-security] Linux and FreeBSD Kernel: Multiple TCP-based remote denial of service issues Date: Mon, 17 Jun 2019 10:33:38 -0700 (PDT) Netflix has identified several TCP networking vulnerabilities in FreeBSD and Linux kernels. The vulnerabilities specifically relate to the minimum segment size (MSS) and TCP Selective Acknowledgement (SACK) capabilities. The most serious, dubbed “SACK Panic,” allows a remotely-triggered kernel panic on recent Linux kernels. There are patches that address most of these vulnerabilities. If patches can not be applied, certain mitigations will be effective. We recommend that affected parties enact one of those described below, based on their environment. #1: CVE-2019-11477: SACK Panic (Linux >= 2.6.29) Description: A sequence of SACKs may be crafted such that one can trigger an integer overflow, leading to a kernel panic. Fix: Apply the attached patch (“PATCH_net_1_4.patch”). Additionally, versions of the Linux kernel up to, and including, 4.14 require a second patch (“PATCH_net_1a.patch”). Workaround #1: Block connections with a low MSS using one of the attached filters. (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the net.ipv4.tcp_mtu_probing sysctl is set to 0, which appears to be the default value for that sysctl). Workaround #2: Disable SACK processing (/proc/sys/net/ipv4/tcp_sack set to 0). (Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.) #2: CVE-2019-11478: SACK Slowness (Linux < 4.15) or Excess Resource Usage (all Linux versions) Description: It is possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. On Linux kernels prior to 4.15, an attacker may be able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection. Fix: Apply the attached patch (“PATCH_net_2_4.patch”) Workaround #1: Block connections with a low MSS using one of the attached filters. (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the net.ipv4.tcp_mtu_probing sysctl is set to 0, which appears to be the default value for that sysctl). Workaround #2: Disable SACK processing (/proc/sys/net/ipv4/tcp_sack set to 0). (Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.) #3: CVE-2019-5599: SACK Slowness (FreeBSD 12 using the RACK TCP Stack) Description: It is possible to send a crafted sequence of SACKs which will fragment the RACK send map. An attacker may be able to further exploit the fragmented send map to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection. Workaround #1: Apply the attached patch (“split_limit.patch”) and set the net.inet.tcp.rack.split_limit sysctl to a reasonable value to limit the size of the SACK table. Workaround #2: Temporarily disable the RACK TCP stack. (Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.) #4: CVE-2019-11479: Excess Resource Consumption Due to Low MSS Values (all Linux versions) Description: An attacker can force the Linux kernel to segment its responses into multiple TCP segments, each of which contains only 8 bytes of data. This drastically increases the bandwidth required to deliver the same amount of data. Further, it consumes additional resources (CPU and NIC processing power). This attack requires continued effort from the attacker and the impacts will end shortly after the attacker stops sending traffic. Fix: Two attached patches (“PATCH_net_3_4.patch” and “PATCH_net_4_4.patch”) add a sysctl which enforces a minimum MSS, set by the net.ipv4.tcp_min_snd_mss sysctl. This lets an administrator enforce a minimum MSS appropriate for their applications. Workaround: Block connections with a low MSS using one of the attached filters. (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the net.ipv4.tcp_mtu_probing sysctl is set to 0, which appears to be the default value for that sysctl). Note: Good system and application coding and configuration practices (limiting write buffers to the necessary level, monitoring connection memory consumption via SO_MEMINFO, and aggressively closing misbehaving connections) can help to limit the impact of attacks against these kinds of vulnerabilities. An advisory has been published at https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md Acknowledgments: Originally reported by Jonathan Looney. We thank Eric Dumazet for providing Linux fixes and support. We thank Bruce Curtis for providing the Linux filters. We thank Jonathan Lemon and Alexey Kodanev for helping to improve the Linux patches. We gratefully acknowledge the assistance of Tyler Hicks in testing fixes, refining the information about vulnerable versions, and providing assistance during the disclosure process. Regards, Netflix Information Security
SUSE-SU-2019:1529-1: An update that solves 14 vulnerabilities and has 130 fixes is now available. Category: security (important) Bug References: 1012382,1050242,1051510,1053043,1055186,1056787,1058115,1063638,1064802,1065600,1065729,1066129,1068546,1071995,1075020,1082387,1083647,1085535,1099658,1103992,1104353,1104427,1106011,1106284,1108193,1108838,1108937,1110946,1111696,1112063,1113722,1114427,1115688,1117158,1117561,1118139,1119843,1120091,1120423,1120566,1120843,1120902,1122776,1123454,1123663,1124503,1124839,1126356,1127616,1128052,1128904,1128979,1129138,1129273,1129497,1129693,1129770,1130579,1130699,1130972,1131326,1131451,1131488,1131565,1131673,1132044,1133176,1133188,1133190,1133320,1133612,1133616,1134160,1134162,1134199,1134200,1134201,1134202,1134203,1134204,1134205,1134354,1134393,1134459,1134460,1134461,1134537,1134597,1134651,1134671,1134760,1134806,1134810,1134813,1134848,1134936,1135006,1135007,1135008,1135056,1135100,1135120,1135278,1135281,1135309,1135312,1135314,1135315,1135316,1135320,1135323,1135330,1135492,1135542,1135556,1135603,1135642,1135661,1135758,1136206,1136424,1136428,1136430,1136432,1136434,1136435,1136438,1136439,1136477,1136478,1136573,1136586,1136881,1136935,1136990,1137151,1137152,1137153,1137162,1137372,1137444,1137586,1137739,1137752 CVE References: CVE-2018-7191,CVE-2019-10124,CVE-2019-11085,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11486,CVE-2019-11487,CVE-2019-11815,CVE-2019-11833,CVE-2019-11884,CVE-2019-12382,CVE-2019-3846,CVE-2019-5489 Sources used: SUSE Linux Enterprise Module for Live Patching 15 (src): kernel-default-4.12.14-150.22.1, kernel-livepatch-SLE15_Update_11-1-1.5.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1530-1: An update that solves 14 vulnerabilities and has 132 fixes is now available. Category: security (important) Bug References: 1012382,1050242,1051510,1053043,1056787,1058115,1063638,1064802,1065600,1065729,1066129,1068546,1071995,1075020,1082387,1083647,1085535,1099658,1103992,1104353,1104427,1106011,1106284,1108838,1110946,1111696,1112063,1113722,1114427,1114893,1115688,1117158,1117561,1118139,1119843,1120091,1120423,1120566,1120843,1120902,1122776,1123454,1123663,1124503,1124839,1126356,1127616,1128052,1128904,1128905,1128979,1129138,1129497,1129693,1129770,1129848,1129857,1130409,1130699,1130972,1131451,1131488,1131565,1131673,1132044,1132894,1133176,1133188,1133190,1133320,1133612,1133616,1134160,1134162,1134199,1134200,1134201,1134202,1134203,1134204,1134205,1134354,1134393,1134459,1134460,1134461,1134537,1134591,1134597,1134607,1134651,1134671,1134760,1134806,1134810,1134813,1134848,1134936,1135006,1135007,1135008,1135056,1135100,1135120,1135278,1135281,1135309,1135312,1135314,1135315,1135316,1135320,1135323,1135330,1135492,1135542,1135556,1135603,1135642,1135661,1135758,1136206,1136424,1136428,1136430,1136432,1136434,1136435,1136438,1136439,1136477,1136478,1136573,1136586,1136881,1136935,1136990,1137151,1137152,1137153,1137162,1137372,1137444,1137586,1137739,1137752 CVE References: CVE-2018-7191,CVE-2019-10124,CVE-2019-11085,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11486,CVE-2019-11487,CVE-2019-11815,CVE-2019-11833,CVE-2019-11884,CVE-2019-12382,CVE-2019-3846,CVE-2019-5489 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP4 (src): kernel-default-4.12.14-95.19.1 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): kernel-docs-4.12.14-95.19.1, kernel-obs-build-4.12.14-95.19.1 SUSE Linux Enterprise Server 12-SP4 (src): kernel-default-4.12.14-95.19.1, kernel-source-4.12.14-95.19.1, kernel-syms-4.12.14-95.19.1 SUSE Linux Enterprise High Availability 12-SP4 (src): kernel-default-4.12.14-95.19.1 SUSE Linux Enterprise Desktop 12-SP4 (src): kernel-default-4.12.14-95.19.1, kernel-source-4.12.14-95.19.1, kernel-syms-4.12.14-95.19.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1529-1: An update that solves 14 vulnerabilities and has 130 fixes is now available. Category: security (important) Bug References: 1012382,1050242,1051510,1053043,1055186,1056787,1058115,1063638,1064802,1065600,1065729,1066129,1068546,1071995,1075020,1082387,1083647,1085535,1099658,1103992,1104353,1104427,1106011,1106284,1108193,1108838,1108937,1110946,1111696,1112063,1113722,1114427,1115688,1117158,1117561,1118139,1119843,1120091,1120423,1120566,1120843,1120902,1122776,1123454,1123663,1124503,1124839,1126356,1127616,1128052,1128904,1128979,1129138,1129273,1129497,1129693,1129770,1130579,1130699,1130972,1131326,1131451,1131488,1131565,1131673,1132044,1133176,1133188,1133190,1133320,1133612,1133616,1134160,1134162,1134199,1134200,1134201,1134202,1134203,1134204,1134205,1134354,1134393,1134459,1134460,1134461,1134537,1134597,1134651,1134671,1134760,1134806,1134810,1134813,1134848,1134936,1135006,1135007,1135008,1135056,1135100,1135120,1135278,1135281,1135309,1135312,1135314,1135315,1135316,1135320,1135323,1135330,1135492,1135542,1135556,1135603,1135642,1135661,1135758,1136206,1136424,1136428,1136430,1136432,1136434,1136435,1136438,1136439,1136477,1136478,1136573,1136586,1136881,1136935,1136990,1137151,1137152,1137153,1137162,1137372,1137444,1137586,1137739,1137752 CVE References: CVE-2018-7191,CVE-2019-10124,CVE-2019-11085,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11486,CVE-2019-11487,CVE-2019-11815,CVE-2019-11833,CVE-2019-11884,CVE-2019-12382,CVE-2019-3846,CVE-2019-5489 Sources used: SUSE Linux Enterprise Workstation Extension 15 (src): kernel-default-4.12.14-150.22.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): kernel-default-4.12.14-150.22.1, kernel-docs-4.12.14-150.22.1, kernel-obs-qa-4.12.14-150.22.1 SUSE Linux Enterprise Module for Live Patching 15 (src): kernel-default-4.12.14-150.22.1, kernel-livepatch-SLE15_Update_11-1-1.5.1 SUSE Linux Enterprise Module for Legacy Software 15 (src): kernel-default-4.12.14-150.22.1 SUSE Linux Enterprise Module for Development Tools 15 (src): kernel-docs-4.12.14-150.22.1, kernel-obs-build-4.12.14-150.22.1, kernel-source-4.12.14-150.22.1, kernel-syms-4.12.14-150.22.1, kernel-vanilla-4.12.14-150.22.1 SUSE Linux Enterprise Module for Basesystem 15 (src): kernel-default-4.12.14-150.22.1, kernel-source-4.12.14-150.22.1, kernel-zfcpdump-4.12.14-150.22.1 SUSE Linux Enterprise High Availability 15 (src): kernel-default-4.12.14-150.22.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1530-1: An update that solves 14 vulnerabilities and has 132 fixes is now available. Category: security (important) Bug References: 1012382,1050242,1051510,1053043,1056787,1058115,1063638,1064802,1065600,1065729,1066129,1068546,1071995,1075020,1082387,1083647,1085535,1099658,1103992,1104353,1104427,1106011,1106284,1108838,1110946,1111696,1112063,1113722,1114427,1114893,1115688,1117158,1117561,1118139,1119843,1120091,1120423,1120566,1120843,1120902,1122776,1123454,1123663,1124503,1124839,1126356,1127616,1128052,1128904,1128905,1128979,1129138,1129497,1129693,1129770,1129848,1129857,1130409,1130699,1130972,1131451,1131488,1131565,1131673,1132044,1132894,1133176,1133188,1133190,1133320,1133612,1133616,1134160,1134162,1134199,1134200,1134201,1134202,1134203,1134204,1134205,1134354,1134393,1134459,1134460,1134461,1134537,1134591,1134597,1134607,1134651,1134671,1134760,1134806,1134810,1134813,1134848,1134936,1135006,1135007,1135008,1135056,1135100,1135120,1135278,1135281,1135309,1135312,1135314,1135315,1135316,1135320,1135323,1135330,1135492,1135542,1135556,1135603,1135642,1135661,1135758,1136206,1136424,1136428,1136430,1136432,1136434,1136435,1136438,1136439,1136477,1136478,1136573,1136586,1136881,1136935,1136990,1137151,1137152,1137153,1137162,1137372,1137444,1137586,1137739,1137752 CVE References: CVE-2018-7191,CVE-2019-10124,CVE-2019-11085,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11486,CVE-2019-11487,CVE-2019-11815,CVE-2019-11833,CVE-2019-11884,CVE-2019-12382,CVE-2019-3846,CVE-2019-5489 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP4 (src): kernel-default-4.12.14-95.19.1 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): kernel-docs-4.12.14-95.19.1, kernel-obs-build-4.12.14-95.19.1 SUSE Linux Enterprise Server 12-SP4 (src): kernel-default-4.12.14-95.19.1, kernel-source-4.12.14-95.19.1, kernel-syms-4.12.14-95.19.1 SUSE Linux Enterprise Live Patching 12-SP4 (src): kgraft-patch-SLE12-SP4_Update_5-1-6.3.1 SUSE Linux Enterprise High Availability 12-SP4 (src): kernel-default-4.12.14-95.19.1 SUSE Linux Enterprise Desktop 12-SP4 (src): kernel-default-4.12.14-95.19.1, kernel-source-4.12.14-95.19.1, kernel-syms-4.12.14-95.19.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1532-1: An update that solves 13 vulnerabilities and has 73 fixes is now available. Category: security (important) Bug References: 1005778,1005780,1005781,1012382,1019695,1019696,1022604,1063638,1065600,1085535,1085539,1090888,1099658,1100132,1106110,1106284,1106929,1108293,1108838,1110785,1110946,1112063,1112178,1116803,1117562,1119086,1120642,1120843,1120902,1122776,1126040,1126356,1128052,1129138,1129770,1130972,1131107,1131488,1131565,1132212,1132472,1133188,1133874,1134160,1134162,1134338,1134537,1134564,1134565,1134566,1134651,1134760,1134806,1134813,1134848,1135013,1135014,1135015,1135100,1135120,1135281,1135603,1135642,1135661,1135878,1136424,1136438,1136448,1136449,1136451,1136452,1136455,1136458,1136539,1136573,1136575,1136586,1136590,1136623,1136810,1136935,1136990,1137142,1137162,1137586,843419 CVE References: CVE-2018-17972,CVE-2018-7191,CVE-2019-11190,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11486,CVE-2019-11815,CVE-2019-11833,CVE-2019-11884,CVE-2019-12382,CVE-2019-3846,CVE-2019-5489 Sources used: SUSE Linux Enterprise Live Patching 12-SP3 (src): kgraft-patch-SLE12-SP3_Update_26-1-4.3.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1536-1: An update that solves 13 vulnerabilities and has 132 fixes is now available. Category: security (important) Bug References: 1012382,1050242,1051510,1053043,1056787,1058115,1063638,1064802,1065600,1065729,1066129,1068546,1071995,1075020,1082387,1083647,1085535,1099658,1103992,1104353,1104427,1106011,1106284,1108838,1110946,1111696,1112063,1113722,1114427,1114893,1115688,1117158,1117561,1118139,1119843,1120091,1120423,1120566,1120843,1120902,1122776,1123454,1123663,1124503,1124839,1126356,1127616,1128052,1128904,1128905,1128979,1129138,1129497,1129693,1129770,1129848,1129857,1130409,1130972,1131451,1131488,1131565,1131673,1132044,1132894,1133176,1133188,1133190,1133320,1133612,1133616,1134160,1134162,1134199,1134200,1134201,1134202,1134203,1134204,1134205,1134354,1134393,1134459,1134460,1134461,1134537,1134591,1134597,1134607,1134651,1134671,1134760,1134806,1134810,1134813,1134848,1134936,1135006,1135007,1135008,1135056,1135100,1135120,1135278,1135281,1135309,1135312,1135314,1135315,1135316,1135320,1135323,1135330,1135492,1135542,1135556,1135603,1135642,1135661,1135758,1136206,1136424,1136428,1136430,1136432,1136434,1136435,1136438,1136439,1136477,1136478,1136573,1136586,1136881,1136935,1136990,1137151,1137152,1137153,1137162,1137372,1137444,1137586,1137739,1137752 CVE References: CVE-2018-7191,CVE-2019-10124,CVE-2019-11085,CVE-2019-11477,CVE-2019-11479,CVE-2019-11486,CVE-2019-11487,CVE-2019-11815,CVE-2019-11833,CVE-2019-11884,CVE-2019-12382,CVE-2019-3846,CVE-2019-5489 Sources used: SUSE Linux Enterprise Server 12-SP4 (src): kernel-azure-4.12.14-6.15.2, kernel-source-azure-4.12.14-6.15.2, kernel-syms-azure-4.12.14-6.15.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1533-1: An update that solves 9 vulnerabilities and has 7 fixes is now available. Category: security (important) Bug References: 1104367,1110785,1113769,1120843,1120885,1125580,1125931,1131543,1131587,1132374,1132472,1134848,1135281,1136424,1136446,1137586 CVE References: CVE-2018-17972,CVE-2019-11190,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11833,CVE-2019-11884,CVE-2019-3846,CVE-2019-5489 Sources used: SUSE Linux Enterprise Server for SAP 12-SP1 (src): kernel-default-3.12.74-60.64.115.1, kernel-source-3.12.74-60.64.115.1, kernel-syms-3.12.74-60.64.115.1, kernel-xen-3.12.74-60.64.115.1, kgraft-patch-SLE12-SP1_Update_34-1-2.5.1 SUSE Linux Enterprise Server 12-SP1-LTSS (src): kernel-default-3.12.74-60.64.115.1, kernel-source-3.12.74-60.64.115.1, kernel-syms-3.12.74-60.64.115.1, kernel-xen-3.12.74-60.64.115.1, kgraft-patch-SLE12-SP1_Update_34-1-2.5.1 SUSE Linux Enterprise Module for Public Cloud 12 (src): kernel-ec2-3.12.74-60.64.115.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1532-1: An update that solves 13 vulnerabilities and has 73 fixes is now available. Category: security (important) Bug References: 1005778,1005780,1005781,1012382,1019695,1019696,1022604,1063638,1065600,1085535,1085539,1090888,1099658,1100132,1106110,1106284,1106929,1108293,1108838,1110785,1110946,1112063,1112178,1116803,1117562,1119086,1120642,1120843,1120902,1122776,1126040,1126356,1128052,1129138,1129770,1130972,1131107,1131488,1131565,1132212,1132472,1133188,1133874,1134160,1134162,1134338,1134537,1134564,1134565,1134566,1134651,1134760,1134806,1134813,1134848,1135013,1135014,1135015,1135100,1135120,1135281,1135603,1135642,1135661,1135878,1136424,1136438,1136448,1136449,1136451,1136452,1136455,1136458,1136539,1136573,1136575,1136586,1136590,1136623,1136810,1136935,1136990,1137142,1137162,1137586,843419 CVE References: CVE-2018-17972,CVE-2018-7191,CVE-2019-11190,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11486,CVE-2019-11815,CVE-2019-11833,CVE-2019-11884,CVE-2019-12382,CVE-2019-3846,CVE-2019-5489 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP3 (src): kernel-default-4.4.180-94.97.1 SUSE Linux Enterprise Software Development Kit 12-SP3 (src): kernel-docs-4.4.180-94.97.1, kernel-obs-build-4.4.180-94.97.1 SUSE Linux Enterprise Server 12-SP3 (src): kernel-default-4.4.180-94.97.1, kernel-source-4.4.180-94.97.1, kernel-syms-4.4.180-94.97.1 SUSE Linux Enterprise Live Patching 12-SP3 (src): kgraft-patch-SLE12-SP3_Update_26-1-4.3.3 SUSE Linux Enterprise High Availability 12-SP3 (src): kernel-default-4.4.180-94.97.1 SUSE Linux Enterprise Desktop 12-SP3 (src): kernel-default-4.4.180-94.97.1, kernel-source-4.4.180-94.97.1, kernel-syms-4.4.180-94.97.1 SUSE CaaS Platform ALL (src): kernel-default-4.4.180-94.97.1 SUSE CaaS Platform 3.0 (src): kernel-default-4.4.180-94.97.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1527-1: An update that solves 14 vulnerabilities and has 81 fixes is now available. Category: security (important) Bug References: 1005778,1005780,1005781,1012382,1019695,1019696,1022604,1053043,1063638,1065600,1066223,1085535,1085539,1090888,1099658,1100132,1106110,1106284,1106929,1108293,1108838,1110785,1110946,1112063,1112178,1116803,1117562,1119086,1120642,1120843,1120885,1120902,1122776,1125580,1126040,1126356,1128052,1129138,1129770,1130972,1131107,1131488,1131543,1131565,1132212,1132374,1132472,1133188,1133874,1134160,1134162,1134338,1134537,1134564,1134565,1134566,1134651,1134760,1134806,1134813,1134848,1135013,1135014,1135015,1135100,1135120,1135281,1135603,1135642,1135661,1135878,1136424,1136438,1136446,1136448,1136449,1136451,1136452,1136455,1136458,1136539,1136573,1136575,1136586,1136590,1136623,1136810,1136935,1136990,1137142,1137162,1137586,1137739,1137752,843419 CVE References: CVE-2013-4343,CVE-2018-17972,CVE-2018-7191,CVE-2019-11190,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11486,CVE-2019-11815,CVE-2019-11833,CVE-2019-11884,CVE-2019-12382,CVE-2019-3846,CVE-2019-5489 Sources used: SUSE Linux Enterprise Server 12-SP3 (src): kernel-azure-4.4.180-4.31.1, kernel-source-azure-4.4.180-4.31.1, kernel-syms-azure-4.4.180-4.31.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1535-1: An update that solves 14 vulnerabilities and has 131 fixes is now available. Category: security (important) Bug References: 1012382,1050242,1051510,1053043,1055186,1056787,1058115,1061840,1063638,1064802,1065600,1065729,1066129,1068546,1071995,1075020,1082387,1083647,1085535,1099658,1103992,1104353,1104427,1106011,1106284,1108193,1108838,1108937,1110946,1111696,1112063,1113722,1114427,1115688,1117158,1117561,1118139,1119843,1120091,1120423,1120566,1120843,1120902,1122776,1123454,1123663,1124503,1124839,1126356,1127616,1128052,1128904,1128979,1129138,1129273,1129497,1129693,1129770,1130579,1130699,1130972,1131326,1131451,1131488,1131565,1131673,1132044,1133176,1133188,1133190,1133320,1133612,1133616,1134160,1134162,1134199,1134200,1134201,1134202,1134203,1134204,1134205,1134354,1134393,1134459,1134460,1134461,1134537,1134597,1134651,1134671,1134760,1134806,1134810,1134813,1134848,1134936,1135006,1135007,1135008,1135056,1135100,1135120,1135278,1135281,1135309,1135312,1135314,1135315,1135316,1135320,1135323,1135330,1135492,1135542,1135556,1135603,1135642,1135661,1135758,1136206,1136424,1136428,1136430,1136432,1136434,1136435,1136438,1136439,1136477,1136478,1136573,1136586,1136881,1136935,1136990,1137151,1137152,1137153,1137162,1137372,1137444,1137586,1137739,1137752 CVE References: CVE-2018-7191,CVE-2019-10124,CVE-2019-11085,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11486,CVE-2019-11487,CVE-2019-11815,CVE-2019-11833,CVE-2019-11884,CVE-2019-12382,CVE-2019-3846,CVE-2019-5489 Sources used: SUSE Linux Enterprise Module for Public Cloud 15 (src): kernel-azure-4.12.14-5.30.1, kernel-source-azure-4.12.14-5.30.1, kernel-syms-azure-4.12.14-5.30.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): kernel-azure-4.12.14-5.30.1, kernel-source-azure-4.12.14-5.30.1, kernel-syms-azure-4.12.14-5.30.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1534-1: An update that solves 12 vulnerabilities and has 8 fixes is now available. Category: security (important) Bug References: 1099658,1106284,1110785,1113769,1120843,1120885,1131543,1131565,1132374,1132472,1134537,1134596,1134848,1135281,1135603,1136424,1136446,1136586,1136935,1137586 CVE References: CVE-2018-17972,CVE-2018-7191,CVE-2019-11190,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11815,CVE-2019-11833,CVE-2019-11884,CVE-2019-12382,CVE-2019-3846,CVE-2019-5489 Sources used: SUSE OpenStack Cloud 7 (src): kernel-default-4.4.121-92.114.1, kernel-source-4.4.121-92.114.1, kernel-syms-4.4.121-92.114.1, kgraft-patch-SLE12-SP2_Update_30-1-3.5.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): kernel-default-4.4.121-92.114.1, kernel-source-4.4.121-92.114.1, kernel-syms-4.4.121-92.114.1, kgraft-patch-SLE12-SP2_Update_30-1-3.5.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): kernel-default-4.4.121-92.114.1, kernel-source-4.4.121-92.114.1, kernel-syms-4.4.121-92.114.1, kgraft-patch-SLE12-SP2_Update_30-1-3.5.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): kernel-default-4.4.121-92.114.1, kernel-source-4.4.121-92.114.1, kernel-syms-4.4.121-92.114.1 SUSE Linux Enterprise High Availability 12-SP2 (src): kernel-default-4.4.121-92.114.1 SUSE Enterprise Storage 4 (src): kernel-default-4.4.121-92.114.1, kernel-source-4.4.121-92.114.1, kernel-syms-4.4.121-92.114.1, kgraft-patch-SLE12-SP2_Update_30-1-3.5.1 OpenStack Cloud Magnum Orchestration 7 (src): kernel-default-4.4.121-92.114.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:1570-1: An update that solves 15 vulnerabilities and has 62 fixes is now available. Category: security (important) Bug References: 1005778,1005780,1005781,1012382,1019695,1019696,1022604,1053043,1063638,1065600,1066223,1085535,1085539,1090888,1099658,1100132,1106110,1106284,1106929,1108838,1109137,1112178,1117562,1119086,1120642,1120843,1120902,1125580,1126356,1127155,1128052,1129770,1131107,1131543,1131565,1132374,1132472,1133190,1133874,1134338,1134806,1134813,1135120,1135281,1135603,1135642,1135661,1135878,1136424,1136438,1136448,1136449,1136451,1136452,1136455,1136458,1136539,1136573,1136575,1136586,1136590,1136598,1136623,1136810,1136922,1136935,1136990,1136993,1137142,1137162,1137586,1137739,1137752,1137915,1138291,1138293,1138374 CVE References: CVE-2018-7191,CVE-2019-11190,CVE-2019-11191,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11487,CVE-2019-11833,CVE-2019-12380,CVE-2019-12382,CVE-2019-12456,CVE-2019-12818,CVE-2019-12819,CVE-2019-3846,CVE-2019-5489 Sources used: openSUSE Leap 42.3 (src): kernel-debug-4.4.180-102.1, kernel-default-4.4.180-102.1, kernel-docs-4.4.180-102.1, kernel-obs-build-4.4.180-102.1, kernel-obs-qa-4.4.180-102.1, kernel-source-4.4.180-102.1, kernel-syms-4.4.180-102.1, kernel-vanilla-4.4.180-102.1
openSUSE-SU-2019:1571-1: An update that solves 11 vulnerabilities and has 167 fixes is now available. Category: security (important) Bug References: 1012382,1050242,1051510,1053043,1056787,1058115,1061840,1064802,1065600,1065729,1066129,1068546,1071995,1075020,1082387,1083647,1085535,1093389,1099658,1103992,1104353,1104427,1111666,1111696,1113722,1115688,1117114,1117158,1117561,1118139,1120091,1120423,1120566,1120902,1124503,1126206,1126356,1127616,1128432,1130699,1131673,1133190,1133612,1133616,1134090,1134671,1134730,1134738,1134743,1134806,1134936,1134945,1134946,1134947,1134948,1134949,1134950,1134951,1134952,1134953,1134972,1134974,1134975,1134980,1134981,1134983,1134987,1134989,1134990,1134994,1134995,1134998,1134999,1135018,1135021,1135024,1135026,1135027,1135028,1135029,1135031,1135033,1135034,1135035,1135036,1135037,1135038,1135039,1135041,1135042,1135044,1135045,1135046,1135047,1135049,1135051,1135052,1135053,1135055,1135056,1135058,1135153,1135542,1135556,1135642,1135661,1136188,1136206,1136215,1136345,1136347,1136348,1136353,1136424,1136428,1136430,1136432,1136434,1136435,1136438,1136439,1136456,1136460,1136461,1136469,1136477,1136478,1136498,1136573,1136586,1136598,1136881,1136922,1136935,1136978,1136990,1137151,1137152,1137153,1137162,1137201,1137224,1137232,1137233,1137236,1137372,1137429,1137444,1137586,1137739,1137752,1137995,1137996,1137998,1137999,1138000,1138002,1138003,1138005,1138006,1138007,1138008,1138009,1138010,1138011,1138012,1138013,1138014,1138015,1138016,1138017,1138018,1138019,1138291,1138293,1138336,1138374,1138375 CVE References: CVE-2019-10124,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11487,CVE-2019-12380,CVE-2019-12382,CVE-2019-12456,CVE-2019-12818,CVE-2019-12819,CVE-2019-3846 Sources used: openSUSE Leap 15.1 (src): kernel-debug-4.12.14-lp151.28.7.1, kernel-default-4.12.14-lp151.28.7.1, kernel-docs-4.12.14-lp151.28.7.1, kernel-kvmsmall-4.12.14-lp151.28.7.1, kernel-obs-build-4.12.14-lp151.28.7.1, kernel-obs-qa-4.12.14-lp151.28.7.1, kernel-source-4.12.14-lp151.28.7.1, kernel-syms-4.12.14-lp151.28.7.1, kernel-vanilla-4.12.14-lp151.28.7.1
SUSE-SU-2019:14089-1: An update that solves 9 vulnerabilities and has 9 fixes is now available. Category: security (important) Bug References: 1110785,1113769,1119314,1120326,1120843,1120885,1131295,1131543,1132374,1132472,1132580,1133188,1134102,1134729,1134848,1137586,923908,939260 CVE References: CVE-2014-9710,CVE-2018-17972,CVE-2019-11190,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11486,CVE-2019-11884,CVE-2019-5489 Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): kernel-bigmem-3.0.101-108.95.2, kernel-default-3.0.101-108.95.2, kernel-ec2-3.0.101-108.95.2, kernel-pae-3.0.101-108.95.2, kernel-ppc64-3.0.101-108.95.2, kernel-source-3.0.101-108.95.1, kernel-syms-3.0.101-108.95.1, kernel-trace-3.0.101-108.95.2, kernel-xen-3.0.101-108.95.2 SUSE Linux Enterprise Server 11-EXTRA (src): kernel-default-3.0.101-108.95.2, kernel-pae-3.0.101-108.95.2, kernel-ppc64-3.0.101-108.95.2, kernel-trace-3.0.101-108.95.2, kernel-xen-3.0.101-108.95.2 SUSE Linux Enterprise Debuginfo 11-SP4 (src): kernel-bigmem-3.0.101-108.95.2, kernel-default-3.0.101-108.95.2, kernel-ec2-3.0.101-108.95.2, kernel-pae-3.0.101-108.95.2, kernel-ppc64-3.0.101-108.95.2, kernel-trace-3.0.101-108.95.2, kernel-xen-3.0.101-108.95.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1550-1: An update that solves 28 vulnerabilities and has 318 fixes is now available. Category: security (important) Bug References: 1012382,1050242,1050549,1051510,1052904,1053043,1055117,1055121,1055186,1056787,1058115,1061840,1063638,1064802,1065600,1065729,1066129,1068546,1070872,1071995,1075020,1082387,1082555,1083647,1085535,1085536,1086657,1088804,1093389,1097583,1097584,1097585,1097586,1097587,1097588,1099658,1103186,1103259,1103992,1104353,1104427,1106011,1106284,1108193,1108838,1108937,1110946,1111331,1111666,1111696,1112063,1112128,1112178,1113722,1113956,1114279,1114427,1114542,1114638,1115688,1117114,1117158,1117561,1118139,1119680,1119843,1120091,1120318,1120423,1120566,1120843,1120902,1122767,1122776,1123454,1123663,1124503,1124839,1126206,1126356,1126704,1127175,1127371,1127374,1127616,1128052,1128415,1128544,1128904,1128971,1128979,1129138,1129273,1129497,1129693,1129770,1129845,1130195,1130425,1130527,1130567,1130579,1130699,1130937,1130972,1131326,1131427,1131438,1131451,1131467,1131488,1131530,1131565,1131574,1131587,1131659,1131673,1131847,1131848,1131851,1131900,1131934,1131935,1132044,1132219,1132226,1132227,1132365,1132368,1132369,1132370,1132372,1132373,1132384,1132397,1132402,1132403,1132404,1132405,1132407,1132411,1132412,1132413,1132414,1132426,1132527,1132531,1132555,1132558,1132561,1132562,1132563,1132564,1132570,1132571,1132572,1132589,1132618,1132673,1132681,1132726,1132828,1132894,1132943,1132982,1133005,1133016,1133094,1133095,1133115,1133149,1133176,1133188,1133190,1133320,1133486,1133529,1133547,1133584,1133593,1133612,1133616,1133667,1133668,1133672,1133674,1133675,1133698,1133702,1133731,1133769,1133772,1133774,1133778,1133779,1133780,1133825,1133850,1133851,1133852,1133897,1134090,1134160,1134162,1134199,1134200,1134201,1134202,1134203,1134204,1134205,1134223,1134354,1134393,1134397,1134459,1134460,1134461,1134597,1134600,1134607,1134618,1134651,1134671,1134760,1134806,1134810,1134813,1134848,1134936,1134945,1134946,1134947,1134948,1134949,1134950,1134951,1134952,1134953,1134972,1134974,1134975,1134980,1134981,1134983,1134987,1134989,1134990,1134994,1134995,1134998,1134999,1135006,1135007,1135008,1135018,1135021,1135024,1135026,1135027,1135028,1135029,1135031,1135033,1135034,1135035,1135036,1135037,1135038,1135039,1135041,1135042,1135044,1135045,1135046,1135047,1135049,1135051,1135052,1135053,1135055,1135056,1135058,1135100,1135120,1135278,1135281,1135309,1135312,1135314,1135315,1135316,1135320,1135323,1135330,1135492,1135542,1135556,1135603,1135642,1135661,1135758,1136188,1136206,1136215,1136345,1136347,1136348,1136353,1136424,1136428,1136430,1136432,1136434,1136435,1136438,1136439,1136456,1136460,1136461,1136469,1136477,1136478,1136498,1136573,1136586,1136881,1136935,1136990,1137151,1137152,1137153,1137162,1137201,1137224,1137232,1137233,1137236,1137372,1137429,1137444,1137586,1137739,1137752,1138291,1138293 CVE References: CVE-2017-5753,CVE-2018-12126,CVE-2018-12127,CVE-2018-12130,CVE-2018-16880,CVE-2018-7191,CVE-2019-10124,CVE-2019-11085,CVE-2019-11091,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11486,CVE-2019-11487,CVE-2019-11811,CVE-2019-11815,CVE-2019-11833,CVE-2019-11884,CVE-2019-12382,CVE-2019-12818,CVE-2019-12819,CVE-2019-3846,CVE-2019-3882,CVE-2019-5489,CVE-2019-8564,CVE-2019-9003,CVE-2019-9500,CVE-2019-9503 Sources used: SUSE Linux Enterprise Module for Live Patching 15-SP1 (src): kernel-default-4.12.14-197.4.1, kernel-livepatch-SLE15-SP1_Update_1-1-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:1579-1: An update that solves 15 vulnerabilities and has 115 fixes is now available. Category: security (important) Bug References: 1012382,1050242,1051510,1053043,1056787,1058115,1061840,1063638,1064802,1065600,1065729,1066129,1068546,1071995,1075020,1082387,1083647,1085535,1099658,1103992,1104353,1104427,1106284,1108838,1111696,1113722,1114427,1115688,1117158,1117561,1118139,1120091,1120423,1120566,1120843,1120902,1123454,1123663,1124503,1126356,1127616,1128052,1128432,1128904,1129693,1129770,1130699,1131565,1131673,1133190,1133320,1133612,1133616,1134597,1134671,1134806,1134936,1135056,1135120,1135278,1135281,1135309,1135312,1135314,1135315,1135316,1135320,1135323,1135330,1135492,1135542,1135556,1135603,1135642,1135661,1135758,1136206,1136424,1136428,1136430,1136432,1136434,1136435,1136438,1136439,1136477,1136478,1136573,1136586,1136598,1136881,1136922,1136935,1136990,1137151,1137152,1137153,1137162,1137372,1137429,1137444,1137586,1137739,1137752,1137995,1137996,1137998,1137999,1138000,1138002,1138003,1138005,1138006,1138007,1138008,1138009,1138010,1138011,1138012,1138013,1138014,1138015,1138016,1138017,1138018,1138019,1138291,1138293,1138374,1138375 CVE References: CVE-2018-7191,CVE-2019-10124,CVE-2019-11085,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11487,CVE-2019-11833,CVE-2019-12380,CVE-2019-12382,CVE-2019-12456,CVE-2019-12818,CVE-2019-12819,CVE-2019-3846,CVE-2019-5489 Sources used: openSUSE Leap 15.0 (src): kernel-debug-4.12.14-lp150.12.64.1, kernel-default-4.12.14-lp150.12.64.1, kernel-docs-4.12.14-lp150.12.64.1, kernel-kvmsmall-4.12.14-lp150.12.64.1, kernel-obs-build-4.12.14-lp150.12.64.1, kernel-obs-qa-4.12.14-lp150.12.64.1, kernel-source-4.12.14-lp150.12.64.1, kernel-syms-4.12.14-lp150.12.64.1, kernel-vanilla-4.12.14-lp150.12.64.1
SUSE-SU-2019:1550-1: An update that solves 28 vulnerabilities and has 318 fixes is now available. Category: security (important) Bug References: 1012382,1050242,1050549,1051510,1052904,1053043,1055117,1055121,1055186,1056787,1058115,1061840,1063638,1064802,1065600,1065729,1066129,1068546,1070872,1071995,1075020,1082387,1082555,1083647,1085535,1085536,1086657,1088804,1093389,1097583,1097584,1097585,1097586,1097587,1097588,1099658,1103186,1103259,1103992,1104353,1104427,1106011,1106284,1108193,1108838,1108937,1110946,1111331,1111666,1111696,1112063,1112128,1112178,1113722,1113956,1114279,1114427,1114542,1114638,1115688,1117114,1117158,1117561,1118139,1119680,1119843,1120091,1120318,1120423,1120566,1120843,1120902,1122767,1122776,1123454,1123663,1124503,1124839,1126206,1126356,1126704,1127175,1127371,1127374,1127616,1128052,1128415,1128544,1128904,1128971,1128979,1129138,1129273,1129497,1129693,1129770,1129845,1130195,1130425,1130527,1130567,1130579,1130699,1130937,1130972,1131326,1131427,1131438,1131451,1131467,1131488,1131530,1131565,1131574,1131587,1131659,1131673,1131847,1131848,1131851,1131900,1131934,1131935,1132044,1132219,1132226,1132227,1132365,1132368,1132369,1132370,1132372,1132373,1132384,1132397,1132402,1132403,1132404,1132405,1132407,1132411,1132412,1132413,1132414,1132426,1132527,1132531,1132555,1132558,1132561,1132562,1132563,1132564,1132570,1132571,1132572,1132589,1132618,1132673,1132681,1132726,1132828,1132894,1132943,1132982,1133005,1133016,1133094,1133095,1133115,1133149,1133176,1133188,1133190,1133320,1133486,1133529,1133547,1133584,1133593,1133612,1133616,1133667,1133668,1133672,1133674,1133675,1133698,1133702,1133731,1133769,1133772,1133774,1133778,1133779,1133780,1133825,1133850,1133851,1133852,1133897,1134090,1134160,1134162,1134199,1134200,1134201,1134202,1134203,1134204,1134205,1134223,1134354,1134393,1134397,1134459,1134460,1134461,1134597,1134600,1134607,1134618,1134651,1134671,1134760,1134806,1134810,1134813,1134848,1134936,1134945,1134946,1134947,1134948,1134949,1134950,1134951,1134952,1134953,1134972,1134974,1134975,1134980,1134981,1134983,1134987,1134989,1134990,1134994,1134995,1134998,1134999,1135006,1135007,1135008,1135018,1135021,1135024,1135026,1135027,1135028,1135029,1135031,1135033,1135034,1135035,1135036,1135037,1135038,1135039,1135041,1135042,1135044,1135045,1135046,1135047,1135049,1135051,1135052,1135053,1135055,1135056,1135058,1135100,1135120,1135278,1135281,1135309,1135312,1135314,1135315,1135316,1135320,1135323,1135330,1135492,1135542,1135556,1135603,1135642,1135661,1135758,1136188,1136206,1136215,1136345,1136347,1136348,1136353,1136424,1136428,1136430,1136432,1136434,1136435,1136438,1136439,1136456,1136460,1136461,1136469,1136477,1136478,1136498,1136573,1136586,1136881,1136935,1136990,1137151,1137152,1137153,1137162,1137201,1137224,1137232,1137233,1137236,1137372,1137429,1137444,1137586,1137739,1137752,1138291,1138293 CVE References: CVE-2017-5753,CVE-2018-12126,CVE-2018-12127,CVE-2018-12130,CVE-2018-16880,CVE-2018-7191,CVE-2019-10124,CVE-2019-11085,CVE-2019-11091,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11486,CVE-2019-11487,CVE-2019-11811,CVE-2019-11815,CVE-2019-11833,CVE-2019-11884,CVE-2019-12382,CVE-2019-12818,CVE-2019-12819,CVE-2019-3846,CVE-2019-3882,CVE-2019-5489,CVE-2019-8564,CVE-2019-9003,CVE-2019-9500,CVE-2019-9503 Sources used: SUSE Linux Enterprise Workstation Extension 15-SP1 (src): kernel-default-4.12.14-197.4.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): dtb-aarch64-4.12.14-197.4.1, kernel-debug-4.12.14-197.4.1, kernel-default-4.12.14-197.4.1, kernel-docs-4.12.14-197.4.1, kernel-kvmsmall-4.12.14-197.4.1, kernel-obs-qa-4.12.14-197.4.1, kernel-source-4.12.14-197.4.1, kernel-vanilla-4.12.14-197.4.1, kernel-zfcpdump-4.12.14-197.4.1 SUSE Linux Enterprise Module for Live Patching 15-SP1 (src): kernel-default-4.12.14-197.4.1, kernel-livepatch-SLE15-SP1_Update_1-1-3.3.1 SUSE Linux Enterprise Module for Legacy Software 15-SP1 (src): kernel-default-4.12.14-197.4.1 SUSE Linux Enterprise Module for Development Tools 15-SP1 (src): kernel-docs-4.12.14-197.4.1, kernel-obs-build-4.12.14-197.4.1, kernel-source-4.12.14-197.4.1, kernel-syms-4.12.14-197.4.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): kernel-default-4.12.14-197.4.1, kernel-source-4.12.14-197.4.1, kernel-zfcpdump-4.12.14-197.4.1 SUSE Linux Enterprise High Availability 15-SP1 (src): kernel-default-4.12.14-197.4.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
There is a follow-up patch: https://patchwork.ozlabs.org/patch/1120222/ I'll have to check how serious the problem is.
SUSE-SU-2019:1692-1: An update that solves 9 vulnerabilities and has 7 fixes is now available. Category: security (important) Bug References: 1090078,1110785,1113769,1120843,1120885,1125580,1125931,1131543,1131587,1132374,1132472,1134848,1135281,1136424,1136446,1137586 CVE References: CVE-2018-17972,CVE-2019-11190,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11833,CVE-2019-11884,CVE-2019-3846,CVE-2019-5489 Sources used: SUSE Linux Enterprise Server 12-LTSS (src): kernel-default-3.12.61-52.154.1, kernel-source-3.12.61-52.154.1, kernel-syms-3.12.61-52.154.1, kernel-xen-3.12.61-52.154.1, kgraft-patch-SLE12_Update_40-1-1.5.1 SUSE Linux Enterprise Module for Public Cloud 12 (src): kernel-ec2-3.12.61-52.154.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
(In reply to Michal Kubeček from comment #70) > There is a follow-up patch: > > https://patchwork.ozlabs.org/patch/1120222/ > > I'll have to check how serious the problem is. I think that's the one fixing broken steam games? Anyway, tumbleweed received sack panic fixes only yesterday (staging takes ages nowadays). 5.1.14 with the above fix was submitted today.
(In reply to Jiri Slaby from comment #72) > (In reply to Michal Kubeček from comment #70) > > There is a follow-up patch: > > > > https://patchwork.ozlabs.org/patch/1120222/ > > > > I'll have to check how serious the problem is. > > I think that's the one fixing broken steam games? Yes, I have seen some comments claiming that. But I rather meant to check if it's something that would require an immediate action in the form of SLE or openSUSE updates. The steam games are probably an argument for openSUSE kernel updates; not so much for SLE, though, I guess.
(In reply to Jiri Slaby from comment #72) > (In reply to Michal Kubeček from comment #70) > > There is a follow-up patch: > > > > https://patchwork.ozlabs.org/patch/1120222/ > > > > I'll have to check how serious the problem is. > > I think that's the one fixing broken steam games? > > Anyway, tumbleweed received sack panic fixes only yesterday (staging takes > ages nowadays). 5.1.14 with the above fix was submitted today. If you ever have issues getting kernel security updates into tumbleweed please let us know. The EMU team can work with the openSUSE release team to make sure its in a fast staging or push it through the tumbleweed update channel should all stagings be blocked.
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2019-07-03. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/64308
This is an autogenerated message for OBS integration: This bug (1137586) was mentioned in https://build.opensuse.org/request/show/714223 15.0 / kernel-source
This is an autogenerated message for OBS integration: This bug (1137586) was mentioned in https://build.opensuse.org/request/show/715440 15.1 / kernel-source
SUSE-SU-2019:2069-1: An update that solves 18 vulnerabilities and has 157 fixes is now available. Category: security (important) Bug References: 1051510,1055117,1071995,1083647,1083710,1088047,1094555,1098633,1103990,1103991,1103992,1104745,1106383,1109837,1111666,1112374,1114279,1114685,1119113,1119222,1119532,1120423,1123080,1125703,1127034,1127315,1127611,1128432,1128902,1129770,1130836,1132390,1133021,1133401,1133738,1134090,1134097,1134390,1134395,1134399,1134730,1134738,1135153,1135296,1135335,1135556,1135642,1135897,1136156,1136157,1136161,1136217,1136264,1136271,1136333,1136342,1136343,1136345,1136348,1136460,1136461,1136462,1136467,1137103,1137194,1137224,1137366,1137429,1137458,1137534,1137535,1137584,1137586,1137609,1137625,1137728,1137811,1137827,1137884,1137985,1138263,1138291,1138293,1138336,1138374,1138375,1138589,1138681,1138719,1138732,1138874,1138879,1139358,1139619,1139712,1139751,1139771,1139865,1140133,1140139,1140228,1140322,1140328,1140405,1140424,1140428,1140454,1140463,1140559,1140575,1140577,1140637,1140652,1140658,1140676,1140715,1140719,1140726,1140727,1140728,1140814,1140887,1140888,1140889,1140891,1140893,1140903,1140945,1140948,1140954,1140955,1140956,1140957,1140958,1140959,1140960,1140961,1140962,1140964,1140971,1140972,1140992,1141312,1141401,1141402,1141452,1141453,1141454,1141478,1141558,1142023,1142052,1142083,1142112,1142115,1142119,1142220,1142221,1142265,1142350,1142351,1142354,1142359,1142450,1142623,1142673,1142701,1142868,1143003,1143105,1143185,1143189,1143191,1143209,1143507 CVE References: CVE-2018-16871,CVE-2018-20836,CVE-2018-20855,CVE-2019-10638,CVE-2019-10639,CVE-2019-1125,CVE-2019-11478,CVE-2019-11599,CVE-2019-11810,CVE-2019-12614,CVE-2019-12817,CVE-2019-12818,CVE-2019-12819,CVE-2019-13233,CVE-2019-13631,CVE-2019-13648,CVE-2019-14283,CVE-2019-14284 Sources used: SUSE Linux Enterprise Module for Public Cloud 15-SP1 (src): kernel-azure-4.12.14-8.13.1, kernel-source-azure-4.12.14-8.13.1, kernel-syms-azure-4.12.14-8.13.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
This is an autogenerated message for OBS integration: This bug (1137586) was mentioned in https://build.opensuse.org/request/show/721464 15.1 / kernel-source
This is an autogenerated message for OBS integration: This bug (1137586) was mentioned in https://build.opensuse.org/request/show/721484 15.0 / kernel-source
This is an autogenerated message for OBS integration: This bug (1137586) was mentioned in https://build.opensuse.org/request/show/731541 15.0 / kernel-source
This is an autogenerated message for OBS integration: This bug (1137586) was mentioned in https://build.opensuse.org/request/show/732033 15.1 / kernel-source
SUSE-SU-2019:2430-1: An update that solves 45 vulnerabilities and has 474 fixes is now available. Category: security (important) Bug References: 1050242,1050549,1051510,1052904,1053043,1055117,1055121,1055186,1056787,1058115,1061840,1064802,1065600,1065729,1066129,1070872,1071995,1075020,1082387,1082555,1083647,1083710,1085535,1085536,1088047,1088804,1093389,1094555,1096003,1098633,1099658,1102247,1103186,1103259,1103990,1103991,1103992,1104745,1106011,1106284,1106383,1106751,1108193,1108838,1108937,1109837,1110946,1111331,1111666,1111696,1112063,1112128,1112178,1112374,1113722,1113956,1114279,1114427,1114542,1114638,1114685,1115688,1117114,1117158,1117561,1118139,1119113,1119222,1119532,1119680,1120091,1120318,1120423,1120566,1120843,1120902,1122767,1122776,1123080,1123454,1123663,1124503,1124839,1125703,1126206,1126356,1126704,1127034,1127175,1127315,1127371,1127374,1127611,1127616,1128052,1128415,1128432,1128544,1128902,1128904,1128971,1128979,1129138,1129273,1129693,1129770,1129845,1130195,1130425,1130527,1130567,1130579,1130699,1130836,1130937,1130972,1131326,1131427,1131438,1131451,1131467,1131488,1131530,1131565,1131574,1131587,1131645,1131659,1131673,1131847,1131848,1131851,1131900,1131934,1131935,1132044,1132219,1132226,1132227,1132365,1132368,1132369,1132370,1132372,1132373,1132384,1132390,1132397,1132402,1132403,1132404,1132405,1132407,1132411,1132412,1132413,1132414,1132426,1132527,1132531,1132555,1132558,1132561,1132562,1132563,1132564,1132570,1132571,1132572,1132589,1132618,1132673,1132681,1132726,1132828,1132894,1132943,1132982,1133005,1133016,1133021,1133094,1133095,1133115,1133149,1133176,1133188,1133190,1133311,1133320,1133401,1133486,1133529,1133547,1133584,1133593,1133612,1133616,1133667,1133668,1133672,1133674,1133675,1133698,1133702,1133731,1133738,1133769,1133772,1133774,1133778,1133779,1133780,1133825,1133850,1133851,1133852,1133897,1134090,1134097,1134160,1134162,1134199,1134200,1134201,1134202,1134203,1134204,1134205,1134223,1134303,1134354,1134390,1134393,1134395,1134397,1134399,1134459,1134460,1134461,1134597,1134600,1134607,1134618,1134651,1134671,1134730,1134738,1134743,1134760,1134806,1134810,1134813,1134848,1134936,1134945,1134946,1134947,1134948,1134949,1134950,1134951,1134952,1134953,1134972,1134974,1134975,1134980,1134981,1134983,1134987,1134989,1134990,1134994,1134995,1134998,1134999,1135006,1135007,1135008,1135018,1135021,1135024,1135026,1135027,1135028,1135029,1135031,1135033,1135034,1135035,1135036,1135037,1135038,1135039,1135041,1135042,1135044,1135045,1135046,1135047,1135049,1135051,1135052,1135053,1135055,1135056,1135058,1135100,1135120,1135153,1135278,1135281,1135296,1135309,1135312,1135314,1135315,1135316,1135320,1135323,1135330,1135335,1135492,1135542,1135556,1135603,1135642,1135661,1135758,1135897,1136156,1136157,1136161,1136188,1136206,1136215,1136217,1136264,1136271,1136333,1136342,1136343,1136345,1136347,1136348,1136353,1136424,1136428,1136430,1136432,1136434,1136435,1136438,1136439,1136456,1136460,1136461,1136462,1136467,1136469,1136477,1136478,1136498,1136573,1136586,1136598,1136881,1136922,1136935,1136978,1136990,1137103,1137151,1137152,1137153,1137162,1137194,1137201,1137224,1137232,1137233,1137236,1137366,1137372,1137429,1137444,1137458,1137534,1137535,1137584,1137586,1137609,1137625,1137728,1137739,1137752,1137811,1137827,1137884,1137985,1137995,1137996,1137998,1137999,1138000,1138002,1138003,1138005,1138006,1138007,1138008,1138009,1138010,1138011,1138012,1138013,1138014,1138015,1138016,1138017,1138018,1138019,1138263,1138291,1138293,1138336,1138374,1138375,1138589,1138681,1138719,1138732,1138874,1138879,1139358,1139619,1139712,1139751,1139771,1139865,1140133,1140139,1140228,1140322,1140328,1140405,1140424,1140428,1140454,1140463,1140559,1140575,1140577,1140637,1140652,1140658,1140676,1140715,1140719,1140726,1140727,1140728,1140814,1140887,1140888,1140889,1140891,1140893,1140903,1140945,1140948,1140954,1140955,1140956,1140957,1140958,1140959,1140960,1140961,1140962,1140964,1140971,1140972,1140992,1141312,1141401,1141402,1141452,1141453,1141454,1141478,1141558,1142023,1142052,1142083,1142112,1142115,1142119,1142220,1142221,1142254,1142350,1142351,1142354,1142359,1142450,1142623,1142673,1142701,1142868,1143003,1143045,1143105,1143185,1143189,1143191,1143209,1143507 CVE References: CVE-2017-5753,CVE-2018-12126,CVE-2018-12127,CVE-2018-12130,CVE-2018-16871,CVE-2018-16880,CVE-2018-20836,CVE-2018-20855,CVE-2018-7191,CVE-2019-10124,CVE-2019-10638,CVE-2019-10639,CVE-2019-11085,CVE-2019-11091,CVE-2019-1125,CVE-2019-11477,CVE-2019-11478,CVE-2019-11479,CVE-2019-11486,CVE-2019-11487,CVE-2019-11599,CVE-2019-11810,CVE-2019-11811,CVE-2019-11815,CVE-2019-11833,CVE-2019-11884,CVE-2019-12380,CVE-2019-12382,CVE-2019-12456,CVE-2019-12614,CVE-2019-12817,CVE-2019-12818,CVE-2019-12819,CVE-2019-13233,CVE-2019-13631,CVE-2019-13648,CVE-2019-14283,CVE-2019-14284,CVE-2019-3846,CVE-2019-3882,CVE-2019-5489,CVE-2019-8564,CVE-2019-9003,CVE-2019-9500,CVE-2019-9503 Sources used: SUSE Linux Enterprise Module for Realtime 15-SP1 (src): kernel-rt-4.12.14-14.8.1, kernel-rt_debug-4.12.14-14.8.1, kernel-source-rt-4.12.14-14.8.1, kernel-syms-rt-4.12.14-14.8.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): kernel-rt-4.12.14-14.8.1, kernel-rt_debug-4.12.14-14.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2450-1: An update that solves 21 vulnerabilities and has 160 fixes is now available. Category: security (important) Bug References: 1012382,1051510,1053043,1055117,1061840,1065600,1065729,1068032,1071995,1083647,1083710,1088047,1094555,1098633,1102247,1106383,1106751,1109137,1111666,11123080,1112824,1113722,1114279,1115688,1117158,1118139,1119222,1120423,1120566,1124167,1124503,1127034,1127155,1127315,1128432,1128902,1128910,1129770,1130972,1132154,1132390,1133021,1133401,1133738,1134097,1134303,1134390,1134393,1134395,1134399,1134671,1135296,1135335,1135556,1135642,1135661,1136157,1136424,1136598,1136811,1136896,1136922,1136935,1136990,1137103,1137162,1137194,1137366,1137372,1137429,1137444,1137458,1137534,1137535,1137584,1137586,1137609,1137625,1137728,1137739,1137752,1137811,1137827,1137884,1137995,1137996,1137998,1137999,1138000,1138002,1138003,1138005,1138006,1138007,1138008,1138009,1138010,1138011,1138012,1138013,1138014,1138015,1138016,1138017,1138018,1138019,1138291,1138293,1138374,1138375,1138589,1138719,1139358,1139751,1139771,1139782,1139865,1140133,1140139,1140322,1140328,1140405,1140424,1140428,1140575,1140577,1140637,1140652,1140658,1140715,1140719,1140726,1140727,1140728,1140814,1140887,1140888,1140889,1140891,1140893,1140903,1140945,1140954,1140955,1140956,1140957,1140958,1140959,1140960,1140961,1140962,1140964,1140971,1140972,1140992,1141401,1141402,1141452,1141453,1141454,1141478,1141488,1142023,1142112,1142220,1142221,1142265,1142350,1142351,1142354,1142359,1142450,1142701,1142868,1143003,1143045,1143105,1143185,1143189,1143191,1143507 CVE References: CVE-2018-16871,CVE-2018-20836,CVE-2018-20855,CVE-2019-10126,CVE-2019-10638,CVE-2019-10639,CVE-2019-1125,CVE-2019-11477,CVE-2019-11478,CVE-2019-11599,CVE-2019-11810,CVE-2019-12380,CVE-2019-12456,CVE-2019-12614,CVE-2019-12818,CVE-2019-12819,CVE-2019-13631,CVE-2019-13648,CVE-2019-14283,CVE-2019-14284,CVE-2019-3846 Sources used: SUSE Linux Enterprise Real Time Extension 12-SP4 (src): kernel-rt-4.12.14-8.3.1, kernel-rt_debug-4.12.14-8.3.1, kernel-source-rt-4.12.14-8.3.1, kernel-syms-rt-4.12.14-8.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2658-1: An update that solves 45 vulnerabilities and has 270 fixes is now available. Category: security (important) Bug References: 1047238,1050911,1051510,1054914,1055117,1056686,1060662,1061840,1061843,1064597,1064701,1065600,1065729,1066369,1071009,1071306,1071995,1078248,1082555,1082635,1085030,1085536,1085539,1086103,1087092,1090734,1091171,1093205,1102097,1103990,1104353,1104427,1104745,1104902,1104967,1106061,1106284,1106434,1108382,1109158,1109837,1111666,1112178,1112374,1112894,1112899,1112902,1112903,1112905,1112906,1112907,1113722,1113994,1114279,1114542,1118689,1119086,1119113,1120046,1120876,1120902,1123034,1123105,1123959,1124370,1127988,1129424,1129519,1129664,1131107,1131281,1131304,1131489,1131565,1132686,1133021,1134291,1134476,1134881,1134882,1135219,1135642,1135897,1135990,1136039,1136261,1136346,1136349,1136352,1136496,1136498,1136502,1136682,1137069,1137322,1137323,1137586,1137865,1137884,1137959,1137982,1138099,1138100,1138539,1139020,1139021,1139101,1139500,1140012,1140155,1140426,1140487,1141013,1141340,1141450,1141543,1141554,1142019,1142076,1142109,1142117,1142118,1142119,1142496,1142541,1142635,1142685,1142701,1142857,1143300,1143331,1143466,1143706,1143738,1143765,1143841,1143843,1143962,1144123,1144333,1144375,1144474,1144518,1144582,1144718,1144813,1144880,1144886,1144912,1144920,1144979,1145010,1145018,1145051,1145059,1145134,1145189,1145235,1145256,1145300,1145302,1145357,1145388,1145389,1145390,1145391,1145392,1145393,1145394,1145395,1145396,1145397,1145408,1145409,1145446,1145661,1145678,1145687,1145920,1145922,1145934,1145937,1145940,1145941,1145942,1145946,1146042,1146074,1146084,1146141,1146163,1146215,1146285,1146346,1146351,1146352,1146361,1146368,1146376,1146378,1146381,1146391,1146399,1146413,1146425,1146512,1146514,1146516,1146519,1146524,1146526,1146529,1146531,1146540,1146543,1146547,1146550,1146575,1146589,1146664,1146678,1146938,1148031,1148032,1148033,1148034,1148035,1148093,1148133,1148192,1148196,1148198,1148202,1148219,1148297,1148303,1148308,1148363,1148379,1148394,1148527,1148570,1148574,1148616,1148617,1148619,1148698,1148712,1148859,1148868,1149053,1149083,1149104,1149105,1149106,1149197,1149214,1149224,1149313,1149325,1149376,1149413,1149418,1149424,1149446,1149522,1149527,1149539,1149552,1149555,1149591,1149602,1149612,1149626,1149651,1149652,1149713,1149940,1149976,1150025,1150033,1150112,1150305,1150381,1150423,1150562,1150727,1150846,1150860,1150861,1150933,1151067,1151192,1151350,1151610,1151661,1151662,1151667,1151680,1151891,1151955,1152024,1152025,1152026,1152161,1152187,1152243,1152325,1152457,1152460,1152466,1152525,1152972,1152974,1152975 CVE References: CVE-2017-18551,CVE-2017-18595,CVE-2018-20976,CVE-2018-21008,CVE-2019-10207,CVE-2019-11477,CVE-2019-14814,CVE-2019-14815,CVE-2019-14816,CVE-2019-14821,CVE-2019-14835,CVE-2019-15030,CVE-2019-15031,CVE-2019-15090,CVE-2019-15098,CVE-2019-15099,CVE-2019-15117,CVE-2019-15118,CVE-2019-15211,CVE-2019-15212,CVE-2019-15214,CVE-2019-15215,CVE-2019-15216,CVE-2019-15217,CVE-2019-15218,CVE-2019-15219,CVE-2019-15220,CVE-2019-15221,CVE-2019-15222,CVE-2019-15239,CVE-2019-15290,CVE-2019-15291,CVE-2019-15292,CVE-2019-15538,CVE-2019-15666,CVE-2019-15902,CVE-2019-15917,CVE-2019-15919,CVE-2019-15920,CVE-2019-15921,CVE-2019-15924,CVE-2019-15926,CVE-2019-15927,CVE-2019-9456,CVE-2019-9506 Sources used: SUSE Linux Enterprise Module for Public Cloud 15-SP1 (src): kernel-azure-4.12.14-8.16.1, kernel-source-azure-4.12.14-8.16.1, kernel-syms-azure-4.12.14-8.16.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2756-1: An update that solves 44 vulnerabilities and has 368 fixes is now available. Category: security (important) Bug References: 1012382,1047238,1050911,1051510,1053043,1054914,1055117,1056686,1060662,1061840,1061843,1064597,1064701,1065600,1065729,1066369,1071009,1071306,1071995,1078248,1082555,1083647,1083710,1085030,1085536,1085539,1086103,1087092,1088047,1090734,1091171,1093205,1094555,1098633,1102097,1102247,1104902,1104967,1106061,1106284,1106383,1106434,1106751,1108382,1109137,1109158,1111666,1112178,1112894,1112899,1112902,1112903,1112905,1112906,1112907,1113722,1114279,1114542,1115688,1117158,1118139,1118689,1119086,1119222,1119532,1120423,1120566,1120876,1120902,1120937,1123034,1123080,1123105,1123959,1124167,1124370,1124503,1127034,1127155,1127315,1127988,1128432,1128902,1128910,1129424,1129519,1129664,1129770,1130972,1131107,1131281,1131304,1131565,1132154,1132390,1132686,1133021,1133401,1134097,1134291,1134303,1134390,1134671,1134881,1134882,1135219,1135296,1135335,1135556,1135642,1135661,1135897,1136157,1136261,1136811,1136896,1136935,1136990,1137069,1137162,1137221,1137366,1137372,1137429,1137444,1137458,1137534,1137535,1137584,1137586,1137609,1137625,1137728,1137739,1137752,1137811,1137827,1137865,1137884,1137959,1137995,1137996,1137998,1137999,1138000,1138002,1138003,1138005,1138006,1138007,1138008,1138009,1138010,1138011,1138012,1138013,1138014,1138015,1138016,1138017,1138018,1138019,1138374,1138375,1138539,1138589,1138719,1139020,1139021,1139101,1139500,1139771,1139782,1139865,1140012,1140133,1140139,1140155,1140322,1140328,1140405,1140424,1140426,1140428,1140487,1140637,1140652,1140658,1140715,1140719,1140726,1140727,1140728,1140814,1140887,1140888,1140889,1140891,1140893,1140903,1140945,1140948,1140954,1140955,1140956,1140957,1140958,1140959,1140960,1140961,1140962,1140964,1140971,1140972,1140992,1141013,1141401,1141402,1141450,1141452,1141453,1141454,1141478,1141543,1141554,1142019,1142076,1142109,1142112,1142117,1142118,1142119,1142129,1142220,1142221,1142350,1142351,1142354,1142359,1142450,1142496,1142541,1142635,1142685,1142701,1142857,1142868,1143003,1143105,1143185,1143300,1143466,1143507,1143765,1143841,1143843,1144123,1144333,1144474,1144518,1144718,1144813,1144880,1144886,1144912,1144920,1144979,1145010,1145024,1145051,1145059,1145189,1145235,1145300,1145302,1145388,1145389,1145390,1145391,1145392,1145393,1145394,1145395,1145396,1145397,1145408,1145409,1145661,1145678,1145687,1145920,1145922,1145934,1145937,1145940,1145941,1145942,1146042,1146074,1146084,1146163,1146285,1146346,1146351,1146352,1146361,1146376,1146378,1146381,1146391,1146399,1146413,1146425,1146512,1146514,1146516,1146519,1146524,1146526,1146529,1146531,1146540,1146543,1146547,1146550,1146575,1146589,1146664,1146678,1146938,1148031,1148032,1148033,1148034,1148035,1148093,1148133,1148192,1148196,1148198,1148202,1148303,1148363,1148379,1148394,1148527,1148574,1148616,1148617,1148619,1148698,1148712,1148859,1148868,1149053,1149083,1149104,1149105,1149106,1149197,1149214,1149224,1149313,1149325,1149376,1149413,1149418,1149424,1149446,1149522,1149527,1149539,1149552,1149555,1149591,1149602,1149612,1149626,1149651,1149652,1149713,1149940,1149959,1149963,1149976,1150025,1150033,1150112,1150381,1150423,1150562,1150727,1150860,1150861,1150933,1151350,1151610,1151667,1151671,1151891,1151955,1152024,1152025,1152026,1152161,1152325,1152457,1152460,1152466,1152972,1152974,1152975 CVE References: CVE-2017-18551,CVE-2017-18595,CVE-2018-20976,CVE-2018-21008,CVE-2019-10207,CVE-2019-11479,CVE-2019-14814,CVE-2019-14815,CVE-2019-14816,CVE-2019-14821,CVE-2019-14835,CVE-2019-15030,CVE-2019-15031,CVE-2019-15090,CVE-2019-15098,CVE-2019-15117,CVE-2019-15118,CVE-2019-15211,CVE-2019-15212,CVE-2019-15214,CVE-2019-15215,CVE-2019-15216,CVE-2019-15217,CVE-2019-15218,CVE-2019-15219,CVE-2019-15220,CVE-2019-15221,CVE-2019-15222,CVE-2019-15239,CVE-2019-15290,CVE-2019-15291,CVE-2019-15292,CVE-2019-15538,CVE-2019-15666,CVE-2019-15902,CVE-2019-15917,CVE-2019-15919,CVE-2019-15920,CVE-2019-15921,CVE-2019-15924,CVE-2019-15926,CVE-2019-15927,CVE-2019-9456,CVE-2019-9506 Sources used: SUSE Linux Enterprise Real Time Extension 12-SP4 (src): kernel-rt-4.12.14-8.6.1, kernel-rt_debug-4.12.14-8.6.1, kernel-source-rt-4.12.14-8.6.1, kernel-syms-rt-4.12.14-8.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2950-1: An update that solves 40 vulnerabilities and has 9 fixes is now available. Category: security (important) Bug References: 1117665,1123959,1137586,1137865,1137944,1139073,1139751,1142857,1144903,1145477,1145922,1146042,1146163,1146285,1146361,1146378,1146391,1146413,1146425,1146512,1146514,1146516,1146519,1146524,1146526,1146529,1146540,1146543,1146547,1146584,1146612,1147122,1148938,1149376,1149522,1149527,1149555,1150025,1150112,1150452,1150457,1150465,1151347,1151350,1152782,1152788,1153119,1155671,999278 CVE References: CVE-2016-10906,CVE-2017-18509,CVE-2017-18551,CVE-2017-18595,CVE-2018-12207,CVE-2018-20976,CVE-2019-10207,CVE-2019-10220,CVE-2019-11135,CVE-2019-11477,CVE-2019-14814,CVE-2019-14815,CVE-2019-14816,CVE-2019-14821,CVE-2019-14835,CVE-2019-15098,CVE-2019-15118,CVE-2019-15212,CVE-2019-15215,CVE-2019-15216,CVE-2019-15217,CVE-2019-15218,CVE-2019-15219,CVE-2019-15220,CVE-2019-15221,CVE-2019-15290,CVE-2019-15291,CVE-2019-15505,CVE-2019-15807,CVE-2019-15902,CVE-2019-15926,CVE-2019-15927,CVE-2019-16232,CVE-2019-16233,CVE-2019-16234,CVE-2019-16413,CVE-2019-17055,CVE-2019-17056,CVE-2019-9456,CVE-2019-9506 Sources used: SUSE Linux Enterprise Server for SAP 12-SP1 (src): kernel-default-3.12.74-60.64.124.1, kernel-source-3.12.74-60.64.124.1, kernel-syms-3.12.74-60.64.124.1, kernel-xen-3.12.74-60.64.124.1, kgraft-patch-SLE12-SP1_Update_37-1-2.3.1 SUSE Linux Enterprise Server 12-SP1-LTSS (src): kernel-default-3.12.74-60.64.124.1, kernel-source-3.12.74-60.64.124.1, kernel-syms-3.12.74-60.64.124.1, kernel-xen-3.12.74-60.64.124.1, kgraft-patch-SLE12-SP1_Update_37-1-2.3.1 SUSE Linux Enterprise Module for Public Cloud 12 (src): kernel-ec2-3.12.74-60.64.124.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Question from SAP: when following https://www.suse.com/de-de/security/cve/CVE-2019-11477/ it notes to follow https://www.suse.com/support/kb/doc/?id=7023997 to overcome a kernel regression introduced with the fix. And this KB finally points to https://www.suse.com/support/kb/doc/?id=000019472 It is somehow unclear if the patch in SP2 - 4.4.121-92.117 from https://www.suse.com/support/kb/doc/?id=000019500 is fixing the problem or the tcp_min_snd_mss parameter still needs to be applied in addition. from comment#52 ##### Fix: Two attached patches (“PATCH_net_3_4.patch” and “PATCH_net_4_4.patch”) add a sysctl which enforces a minimum MSS, set by the net.ipv4.tcp_min_snd_mss sysctl. This lets an administrator enforce a minimum MSS appropriate for their applications. ##### I assume the sysctl setting from net.ipv4.tcp_min_snd_mss = 400 still needs to be applied after patching the kernel? thx
So the main issues (SACK Panic, SACK Slowness) are fixed by patches. The resource consumption issue (issue 3) due to "very small mss" is fixed by: - a patch that provides the actual net.ipv4.tcp_min_snd_mss sysctl - and it needs to be set to a higher value , e.g. 400. (default seems to be 48) Note that also your firewalls would need to pass these kinds of packets, they could install firewall blocking it. In real life these attacks have not been observed to our knowledge.
Thanks a lot Marcus
i think we addressed everything
Yes you can close the bsc. thx for your support