Security update for the Linux Kernel (Live Patch 31 for SLE 12 SP2)

Announcement ID:	SUSE-SU-2019:2604-1
Rating:	important
References:	bsc#1151021
Cross-References:	CVE-2019-14835
CVSS scores:	CVE-2019-14835 ( SUSE ): 7.8 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2019-14835 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-14835 ( NVD ): 7.2 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP1 LTSS 12-SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2 SUSE Linux Enterprise Server 12 SP2 LTSS 12-SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2

An update that solves one vulnerability can now be installed.

Description:

This update for the Linux Kernel 4.4.121-92_117 fixes one issue.

The following security issue was fixed:

• CVE-2019-14835: A buffer overflow flaw was found in the way vhost functionality, that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host (bsc#1151021).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Server for SAP Applications 12 SP2
  zypper in -t patch SUSE-SLE-SAP-12-SP2-2019-2604=1 SUSE-SLE-SAP-12-SP2-2019-2605=1 SUSE-SLE-SAP-12-SP2-2019-2613=1 SUSE-SLE-SAP-12-SP2-2019-2614=1 SUSE-SLE-SAP-12-SP2-2019-2615=1 SUSE-SLE-SAP-12-SP2-2019-2594=1 SUSE-SLE-SAP-12-SP2-2019-2593=1
• SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-ESPOS-2019-2604=1 SUSE-SLE-SERVER-12-SP2-ESPOS-2019-2605=1 SUSE-SLE-SERVER-12-SP2-ESPOS-2019-2613=1 SUSE-SLE-SERVER-12-SP2-ESPOS-2019-2614=1 SUSE-SLE-SERVER-12-SP2-ESPOS-2019-2615=1 SUSE-SLE-SERVER-12-SP2-ESPOS-2019-2594=1 SUSE-SLE-SERVER-12-SP2-ESPOS-2019-2593=1
• SUSE Linux Enterprise Server 12 SP2 LTSS 12-SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2019-2593=1 SUSE-SLE-SERVER-12-SP2-2019-2604=1 SUSE-SLE-SERVER-12-SP2-2019-2605=1 SUSE-SLE-SERVER-12-SP2-2019-2613=1 SUSE-SLE-SERVER-12-SP2-2019-2614=1 SUSE-SLE-SERVER-12-SP2-2019-2615=1 SUSE-SLE-SERVER-12-SP2-2019-2594=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1
  zypper in -t patch SUSE-SLE-SAP-12-SP1-2019-2597=1 SUSE-SLE-SAP-12-SP1-2019-2598=1 SUSE-SLE-SAP-12-SP1-2019-2595=1 SUSE-SLE-SAP-12-SP1-2019-2596=1 SUSE-SLE-SAP-12-SP1-2019-2592=1
• SUSE Linux Enterprise Server 12 SP1 LTSS 12-SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2019-2597=1 SUSE-SLE-SERVER-12-SP1-2019-2598=1 SUSE-SLE-SERVER-12-SP1-2019-2595=1 SUSE-SLE-SERVER-12-SP1-2019-2596=1 SUSE-SLE-SERVER-12-SP1-2019-2592=1

Package List:

• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (ppc64le x86_64)
  • kgraft-patch-4_4_121-92_109-default-5-2.1
  • kgraft-patch-4_4_121-92_98-default-7-2.1
  • kgraft-patch-4_4_121-92_104-default-5-2.1
  • kgraft-patch-4_4_121-92_117-default-3-2.1
  • kgraft-patch-4_4_121-92_114-default-4-2.1
  • kgraft-patch-4_4_121-92_101-default-5-2.1
  • kgraft-patch-4_4_121-92_95-default-8-2.1
• SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2 (x86_64)
  • kgraft-patch-4_4_121-92_109-default-5-2.1
  • kgraft-patch-4_4_121-92_98-default-7-2.1
  • kgraft-patch-4_4_121-92_104-default-5-2.1
  • kgraft-patch-4_4_121-92_117-default-3-2.1
  • kgraft-patch-4_4_121-92_114-default-4-2.1
  • kgraft-patch-4_4_121-92_101-default-5-2.1
  • kgraft-patch-4_4_121-92_95-default-8-2.1
• SUSE Linux Enterprise Server 12 SP2 LTSS 12-SP2 (ppc64le x86_64)
  • kgraft-patch-4_4_121-92_109-default-5-2.1
  • kgraft-patch-4_4_121-92_98-default-7-2.1
  • kgraft-patch-4_4_121-92_104-default-5-2.1
  • kgraft-patch-4_4_121-92_117-default-3-2.1
  • kgraft-patch-4_4_121-92_114-default-4-2.1
  • kgraft-patch-4_4_121-92_101-default-5-2.1
  • kgraft-patch-4_4_121-92_95-default-8-2.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1 (x86_64)
  • kgraft-patch-3_12_74-60_64_107-default-9-2.1
  • kgraft-patch-3_12_74-60_64_121-xen-2-2.1
  • kgraft-patch-3_12_74-60_64_115-default-4-2.1
  • kgraft-patch-3_12_74-60_64_110-xen-5-2.1
  • kgraft-patch-3_12_74-60_64_118-default-2-2.1
  • kgraft-patch-3_12_74-60_64_107-xen-9-2.1
  • kgraft-patch-3_12_74-60_64_121-default-2-2.1
  • kgraft-patch-3_12_74-60_64_110-default-5-2.1
  • kgraft-patch-3_12_74-60_64_118-xen-2-2.1
  • kgraft-patch-3_12_74-60_64_115-xen-4-2.1
• SUSE Linux Enterprise Server 12 SP1 LTSS 12-SP1 (x86_64)
  • kgraft-patch-3_12_74-60_64_107-default-9-2.1
  • kgraft-patch-3_12_74-60_64_121-xen-2-2.1
  • kgraft-patch-3_12_74-60_64_115-default-4-2.1
  • kgraft-patch-3_12_74-60_64_110-xen-5-2.1
  • kgraft-patch-3_12_74-60_64_118-default-2-2.1
  • kgraft-patch-3_12_74-60_64_107-xen-9-2.1
  • kgraft-patch-3_12_74-60_64_121-default-2-2.1
  • kgraft-patch-3_12_74-60_64_110-default-5-2.1
  • kgraft-patch-3_12_74-60_64_118-xen-2-2.1
  • kgraft-patch-3_12_74-60_64_115-xen-4-2.1

References:

• https://www.suse.com/security/cve/CVE-2019-14835.html
• https://bugzilla.suse.com/show_bug.cgi?id=1151021