This update for ucode-intel fixes the following issues :

Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466)

This update contains security mitigations for :

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).

CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to mitigate the Vector Register and L1D Eviction Sampling aka 'CacheOutAttack' attacks. (bsc#1156353)

Microcode Table :

Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New

---- new platforms ----------------------------------------

---- updated platforms ------------------------------------ HSW C0 6-3c-3/32 00000027->00000028 Core Gen4 BDW-U/Y E0/F0 6-3d-4/c0 0000002e->0000002f Core Gen5 HSW-U C0/D0 6-45-1/72 00000025->00000026 Core Gen4 HSW-H C0 6-46-1/32 0000001b->0000001c Core Gen4 BDW-H/E3 E0/G0 6-47-1/22 00000021->00000022 Core Gen5 SKL-U/Y D0 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKL-U23e K1 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKX-SP B1 6-55-3/97 01000151->01000157 Xeon Scalable SKX-SP H0/M0/U0 6-55-4/b7 02000065->02006906 Xeon Scalable SKX-D M1 6-55-4/b7 02000065->02006906 Xeon D-21xx CLX-SP B0 6-55-6/bf 0400002c->04002f01 Xeon Scalable Gen2 CLX-SP B1 6-55-7/bf 0500002c->04002f01 Xeon Scalable Gen2 SKL-H/S R0/N0 6-5e-3/36 000000d6->000000dc Core Gen6; Xeon E3 v5 AML-Y22 H0 6-8e-9/10 000000ca->000000d6 Core Gen8 Mobile KBL-U/Y H0 6-8e-9/c0 000000ca->000000d6 Core Gen7 Mobile CFL-U43e D0 6-8e-a/c0 000000ca->000000d6 Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000ca->000000d6 Core Gen8 Mobile AML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile CML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile WHL-U V0 6-8e-c/94 000000ca->000000d6 Core Gen8 Mobile KBL-G/H/S/E3 B0 6-9e-9/2a 000000ca->000000d6 Core Gen7; Xeon E3 v6 CFL-H/S/E3 U0 6-9e-a/22 000000ca->000000d6 Core Gen8 Desktop, Mobile, Xeon E CFL-S B0 6-9e-b/02 000000ca->000000d6 Core Gen8 CFL-H/S P0 6-9e-c/22 000000ca->000000d6 Core Gen9 CFL-H R0 6-9e-d/22 000000ca->000000d6 Core Gen9 Mobile

Also contains the Intel CPU Microcode update to 20200520 :

Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New

---- new platforms ----------------------------------------

---- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061f->00000621 Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000718->0000071a Xeon E3/E5, Core X

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2433 advisory.

  - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)

  - hw: Vector Register Data Sampling (CVE-2020-0548)

  - hw: L1D Cache Eviction Sampling (CVE-2020-0549)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2679 advisory.

  - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)

  - hw: Vector Register Data Sampling (CVE-2020-0548)

  - hw: L1D Cache Eviction Sampling (CVE-2020-0549)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2707 advisory.

  - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)

  - hw: Vector Register Data Sampling (CVE-2020-0548)

  - hw: L1D Cache Eviction Sampling (CVE-2020-0549)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2706 advisory.

  - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)

  - hw: Vector Register Data Sampling (CVE-2020-0548)

  - hw: L1D Cache Eviction Sampling (CVE-2020-0549)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3176 advisory.

  - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)

  - hw: Vector Register Data Sampling (CVE-2020-0548)

  - hw: L1D Cache Eviction Sampling (CVE-2020-0549)

  - hw: Information disclosure issue in Intel SGX via RAPL interface (CVE-2020-8695)

  - hw: Vector Register Leakage-Active (CVE-2020-8696)

  - hw: Fast forward store predictor (CVE-2020-8698)

  - hw: vt-d related privilege escalation (CVE-2020-24489)

  - hw: improper isolation of shared resources in some Intel Processors (CVE-2020-24511)

  - hw: observable timing discrepancy in some Intel Processors (CVE-2020-24512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3317 advisory.

  - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)

  - hw: Vector Register Data Sampling (CVE-2020-0548)

  - hw: L1D Cache Eviction Sampling (CVE-2020-0549)

  - hw: Information disclosure issue in Intel SGX via RAPL interface (CVE-2020-8695)

  - hw: Vector Register Leakage-Active (CVE-2020-8696)

  - hw: Fast forward store predictor (CVE-2020-8698)

  - hw: vt-d related privilege escalation (CVE-2020-24489)

  - hw: improper isolation of shared resources in some Intel Processors (CVE-2020-24511)

  - hw: observable timing discrepancy in some Intel Processors (CVE-2020-24512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3322 advisory.

  - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)

  - hw: Vector Register Data Sampling (CVE-2020-0548)

  - hw: L1D Cache Eviction Sampling (CVE-2020-0549)

  - hw: Information disclosure issue in Intel SGX via RAPL interface (CVE-2020-8695)

  - hw: Vector Register Leakage-Active (CVE-2020-8696)

  - hw: Fast forward store predictor (CVE-2020-8698)

  - hw: vt-d related privilege escalation (CVE-2020-24489)

  - hw: improper isolation of shared resources in some Intel Processors (CVE-2020-24511)

  - hw: observable timing discrepancy in some Intel Processors (CVE-2020-24512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 15 kernel was updated receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).

CVE-2020-9383: Fixed an out-of-bounds read due to improper error condition check of FDC index (bsc#1165111).

CVE-2020-8992: Fixed an issue which could have allowed attackers to cause a soft lockup via a crafted journal size (bsc#1164069).

CVE-2020-8834: Fixed a stack corruption which could have lead to kernel panic (bsc#1168276).

CVE-2020-8649: Fixed a use-after-free in the vgacon_invert_region function in drivers/video/console/vgacon.c (bsc#1162931).

CVE-2020-8648: Fixed a use-after-free in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (bsc#1162928).

CVE-2020-8647: Fixed a use-after-free in the vc_do_resize function in drivers/tty/vt/vt.c (bsc#1162929).

CVE-2020-8428: Fixed a use-after-free which could have allowed local users to cause a denial of service (bsc#1162109).

CVE-2020-7053: Fixed a use-after-free in the i915_ppgtt_close function in drivers/gpu/drm/i915/i915_gem_gtt.c (bsc#1160966).

CVE-2020-2732: Fixed an issue affecting Intel CPUs where an L2 guest may trick the L0 hypervisor into accessing sensitive L1 resources (bsc#1163971).

CVE-2020-13143: Fixed an out-of-bounds read in gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c (bsc#1171982).

CVE-2020-12769: Fixed an issue which could have allowed attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one (bsc#1171983).

CVE-2020-12657: An a use-after-free in block/bfq-iosched.c (bsc#1171205).

CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).

CVE-2020-12655: Fixed an issue which could have allowed attackers to trigger a sync of excessive duration via an XFS v5 image with crafted metadata (bsc#1171217).

CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).

CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).

CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).

CVE-2020-12464: Fixed a use-after-free due to a transfer without a reference (bsc#1170901).

CVE-2020-12114: Fixed a pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).

CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).

CVE-2020-11609: Fixed a NULL pointer dereference due to improper handling of descriptors (bsc#1168854).

CVE-2020-11608: Fixed a NULL pointer dereferences via a crafted USB (bsc#1168829).

CVE-2020-11494: Fixed an issue which could have allowed attackers to read uninitialized can_frame data (bsc#1168424).

CVE-2020-10942: Fixed a kernel stack corruption via crafted system calls (bsc#1167629).

CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).

CVE-2020-10751: Fixed an improper implementation in SELinux LSM hook where it was assumed that an skb would only contain a single netlink message (bsc#1171189).

CVE-2020-10732: Fixed kernel data leak in userspace coredumps due to uninitialized data (bsc#1171220).

CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).

CVE-2020-10711: Fixed a NULL pointer dereference in SELinux subsystem which could have allowed a remote network user to crash the kernel resulting in a denial of service (bsc#1171191).

CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).

CVE-2019-9458: Fixed a use after free due to a race condition which could have led to privilege escalation of privilege (bsc#1168295).

CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bsc#1170345).

CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bsc#1120386).

CVE-2019-20812: Fixed an issue in prb_calc_retire_blk_tmo() which could have resulted in a denial of service (bsc#1172453).

CVE-2019-20810: Fixed a memory leak in due to not calling of snd_card_free (bsc#1172458).

CVE-2019-20096: Fixed a memory leak in __feat_register_sp() in net/dccp/feat.c, which could have caused denial of service (bsc#1159908).

CVE-2019-20095: Fixed an improper error-handling cases that did not free allocated hostcmd memory which was causing memory leak (bsc#1159909).

CVE-2019-20054: Fixed a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links (bsc#1159910).

CVE-2019-19966: Fixed a use-after-free in cpia2_exit() which could have caused denial of service (bsc#1159841).

CVE-2019-19965: Fixed a NULL pointer dereference, due to mishandling of port disconnection during discovery (bsc#1159911).

CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).

CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bsc#1159285).

CVE-2019-19462: Fixed an issue which could have allowed local user to cause denial of service (bsc#1158265).

CVE-2019-19447: Fixed a user after free via a crafted ext4 filesystem image (bsc#1158819).

CVE-2019-19319: Fixed a user after free when a large old_size value is used in a memset call (bsc#1158021).

CVE-2019-19318: Fixed a use after free via a crafted btrfs image (bsc#1158026).

CVE-2019-19054: Fixed a memory leak in the cx23888_ir_probe() which could have allowed attackers to cause a denial of service (bsc#1161518).

CVE-2019-19045: Fixed a memory leak in which could have allowed attackers to cause a denial of service (bsc#1161522).

CVE-2019-19036: Fixed a NULL pointer dereference in btrfs_root_node (bsc#1157692).

CVE-2019-16994: Fixed a memory leak which might have caused denial of service (bsc#1161523).

CVE-2019-14897: Fixed a stack overflow in Marvell Wifi Driver (bsc#1157155).

CVE-2019-14896: Fixed a heap overflow in Marvell Wifi Driver (bsc#1157157).

CVE-2019-14615: Fixed an improper control flow in certain data structures which could have led to information disclosure (bsc#1160195).

CVE-2018-1000199: Fixed a potential local code execution via ptrace (bsc#1089895).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14521-1 advisory.

  - Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2020-0543)

  - An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before     5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the     privileges of the QEMU process on the host. (CVE-2020-14364)

  - An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS     denial of service or possibly gain privileges because of insufficient cache write-back under VT-d. When     page tables are shared between IOMMU and CPU, changes to them require flushing of both TLBs. Furthermore,     IOMMUs may be non-coherent, and hence prior to flushing IOMMU TLBs, a CPU cache also needs writing back to     memory after changes were made. Such writing back of cached data was missing in particular when splitting     large page mappings into smaller granularity ones. A malicious guest may be able to retain read/write DMA     access to frames returned to Xen's free pool, and later reused for another purpose. Host crashes (leading     to a Denial of Service) and privilege escalation cannot be ruled out. Xen versions from at least 3.2     onwards are affected. Only x86 Intel systems are affected. x86 AMD as well as Arm systems are not     affected. Only x86 HVM guests using hardware assisted paging (HAP), having a passed through PCI device     assigned, and having page table sharing enabled can leverage the vulnerability. Note that page table     sharing will be enabled (by default) only if Xen considers IOMMU and CPU large page size support     compatible. (CVE-2020-15565)

  - An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a     denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested     paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on     the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the     hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an     unprivileged guest user might be able to cause denial of service, data corruption, or privilege     escalation. Only systems using Intel CPUs are vulnerable. Systems using AMD CPUs, and Arm systems, are not     vulnerable. Only systems using nested paging (hap, aka nested paging, aka in this case Intel EPT) are     vulnerable. Only HVM and PVH guests can exploit the vulnerability. The presence and scope of the     vulnerability depends on the precise optimisations performed by the compiler used to build Xen. If the     compiler generates (a) a single 64-bit write, or (b) a series of read-modify-write operations in the same     order as the source code, the hypervisor is not vulnerable. For example, in one test build using GCC 8.3     with normal settings, the compiler generated multiple (unlocked) read-modify-write operations in source-     code order, which did not constitute a vulnerability. We have not been able to survey compilers;
    consequently we cannot say which compiler(s) might produce vulnerable code (with which code-generation     options). The source code clearly violates the C rules, and thus should be considered vulnerable.
    (CVE-2020-15567)

  - An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data.
    Code paths in Xen's MSI handling have been identified that act on unsanitized values read back from device     hardware registers. While devices strictly compliant with PCI specifications shouldn't be able to affect     these registers, experience shows that it's very common for devices to have out-of-spec backdoor     operations that can affect the result of these reads. A not fully trusted guest may be able to crash Xen,     leading to a Denial of Service (DoS) for the entire system. Privilege escalation and information leaks     cannot be excluded. All versions of Xen supporting PCI passthrough are affected. Only x86 systems are     vulnerable. Arm systems are not vulnerable. Only guests with passed through PCI devices may be able to     leverage the vulnerability. Only systems passing through devices with out-of-spec (backdoor)     functionality can cause issues. Experience shows that such out-of-spec functionality is common; unless you     have reason to believe that your device does not have such functionality, it's better to assume that it     does. (CVE-2020-25595)

  - An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via     SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's     sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. This causes the     guest kernel to observe a kernel-privilege #GP fault (typically fatal) rather than a user-privilege #GP     fault (usually converted into SIGSEGV/etc.). Malicious or buggy userspace can crash the guest kernel,     resulting in a VM Denial of Service. All versions of Xen from 3.2 onwards are vulnerable. Only x86 systems     are vulnerable. ARM platforms are not vulnerable. Only x86 systems that support the SYSENTER instruction     in 64bit mode are vulnerable. This is believed to be Intel, Centaur, and Shanghai CPUs. AMD and Hygon CPUs     are not believed to be vulnerable. Only x86 PV guests can exploit the vulnerability. x86 PVH / HVM guests     cannot exploit the vulnerability. (CVE-2020-25596)

  - An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid     event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that     an event channel, once valid, will not become invalid over the life time of a guest. However, operations     like the resetting of all event channels may involve decreasing one of the bounds checked when determining     validity. This may lead to bug checks triggering, crashing the host. An unprivileged guest may be able to     crash Xen, leading to a Denial of Service (DoS) for the entire system. All Xen versions from 4.4 onwards     are vulnerable. Xen versions 4.3 and earlier are not vulnerable. Only systems with untrusted guests     permitted to create more than the default number of event channels are vulnerable. This number depends on     the architecture and type of guest. For 32-bit x86 PV guests, this is 1023; for 64-bit x86 PV guests, and     for all ARM guests, this number is 4095. Systems where untrusted guests are limited to fewer than this     number are not vulnerable. Note that xl and libxl limit max_event_channels to 1023 by default, so systems     using exclusively xl, libvirt+libxl, or their own toolstack based on libxl, and not explicitly setting     max_event_channels, are not vulnerable. (CVE-2020-25597)

  - An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86     domains. The so called 2-level event channel model imposes different limits on the number of usable event     channels for 32-bit x86 domains vs 64-bit or Arm (either bitness) ones. 32-bit x86 domains can use only     1023 channels, due to limited space in their shared (between guest and Xen) information structure, whereas     all other domains can use up to 4095 in this model. The recording of the respective limit during domain     initialization, however, has occurred at a time where domains are still deemed to be 64-bit ones, prior to     actually honoring respective domain properties. At the point domains get recognized as 32-bit ones, the     limit didn't get updated accordingly. Due to this misbehavior in Xen, 32-bit domains (including Domain 0)     servicing other domains may observe event channel allocations to succeed when they should really fail.
    Subsequent use of such event channels would then possibly lead to corruption of other parts of the shared     info structure. An unprivileged guest may cause another domain, in particular Domain 0, to misbehave. This     may lead to a Denial of Service (DoS) for the entire system. All Xen versions from 4.4 onwards are     vulnerable. Xen versions 4.3 and earlier are not vulnerable. Only x86 32-bit domains servicing other     domains are vulnerable. Arm systems, as well as x86 64-bit domains, are not vulnerable. (CVE-2020-25600)

  - An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchn_reset() /     evtchn_destroy(). In particular, the FIFO event channel model allows guests to have a large number of     event channels active at a time. Closing all of these (when resetting all event channels or when cleaning     up after the guest) may take extended periods of time. So far, there was no arrangement for preemption at     suitable intervals, allowing a CPU to spend an almost unbounded amount of time in the processing of these     operations. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the     entire system. All Xen versions are vulnerable in principle. Whether versions 4.3 and older are vulnerable     depends on underlying hardware characteristics. (CVE-2020-25601)

  - An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating     an event channel. Event channels control structures can be accessed lockless as long as the port is     considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to     prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a     hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot     be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend     on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the     vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not     been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code     (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm     systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU     vendor. x86 systems are only vulnerable if a compiler performs re-ordering. (CVE-2020-25603)

  - An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86     HVM vCPUs. When migrating timers of x86 HVM guests between its vCPUs, the locking model used allows for a     second vCPU of the same guest (also operating on the timers) to release a lock that it didn't acquire. The     most likely effect of the issue is a hang or crash of the hypervisor, i.e., a Denial of Service (DoS). All     versions of Xen are affected. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only x86     HVM guests can leverage the vulnerability. x86 PV and PVH cannot leverage the vulnerability. Only guests     with more than one vCPU can exploit the vulnerability. (CVE-2020-25604)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).

CVE-2020-13143: Fixed an out-of-bounds read in gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c (bsc#1171982).

CVE-2020-12769: Fixed an issue which could have allowed attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one (bsc#1171983).

CVE-2020-12768: Fixed a memory leak in svm_cpu_uninit in arch/x86/kvm/svm.c (bsc#1171736).

CVE-2020-12659: Fixed an out-of-bounds write (by a user with the CAP_NET_ADMIN capability) due to improper headroom validation (bsc#1171214).

CVE-2020-12657: An a use-after-free in block/bfq-iosched.c (bsc#1171205).

CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).

CVE-2020-12655: Fixed an issue which could have allowed attackers to trigger a sync of excessive duration via an XFS v5 image with crafted metadata (bsc#1171217).

CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).

CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).

CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).

CVE-2020-12464: Fixed a use-after-free due to a transfer without a reference (bsc#1170901).

CVE-2020-12114: Fixed a pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).

CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).

CVE-2020-10751: Fixed an improper implementation in SELinux LSM hook where it was assumed that an skb would only contain a single netlink message (bsc#1171189).

CVE-2020-10732: Fixed kernel data leak in userspace coredumps due to uninitialized data (bsc#1171220).

CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).

CVE-2020-10711: Fixed a NULL pointer dereference in SELinux subsystem which could have allowed a remote network user to crash the kernel resulting in a denial of service (bsc#1171191).

CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).

CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bsc#1170345).

CVE-2019-20812: Fixed an issue in prb_calc_retire_blk_tmo() which could have resulted in a denial of service (bsc#1172453).

CVE-2019-20806: Fixed a NULL pointer dereference which may had lead to denial of service (bsc#1172199).

CVE-2019-19462: Fixed an issue which could have allowed local user to cause denial of service (bsc#1158265).

CVE-2018-1000199: Fixed a potential local code execution via ptrace (bsc#1089895).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).

CVE-2020-13143: Fixed an out-of-bounds read in gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c (bsc#1171982).

CVE-2020-12769: Fixed an issue which could have allowed attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one (bsc#1171983).

CVE-2020-12768: Fixed a memory leak in svm_cpu_uninit in arch/x86/kvm/svm.c (bsc#1171736).

CVE-2020-12657: An a use-after-free in block/bfq-iosched.c (bsc#1171205).

CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).

CVE-2020-12655: Fixed an issue which could have allowed attackers to trigger a sync of excessive duration via an XFS v5 image with crafted metadata (bsc#1171217).

CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).

CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).

CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).

CVE-2020-12464: Fixed a use-after-free due to a transfer without a reference (bsc#1170901).

CVE-2020-12114: Fixed a pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).

CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).

CVE-2020-10751: Fixed an improper implementation in SELinux LSM hook where it was assumed that an skb would only contain a single netlink message (bsc#1171189).

CVE-2020-10732: Fixed kernel data leak in userspace coredumps due to uninitialized data (bsc#1171220).

CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).

CVE-2020-10711: Fixed a NULL pointer dereference in SELinux subsystem which could have allowed a remote network user to crash the kernel resulting in a denial of service (bsc#1171191).

CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).

CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bsc#1170345).

CVE-2019-20812: Fixed an issue in prb_calc_retire_blk_tmo() which could have resulted in a denial of service (bsc#1172453).

CVE-2019-20806: Fixed a NULL pointer dereference which may had lead to denial of service (bsc#1172199).

CVE-2019-19462: Fixed an issue which could have allowed local user to cause denial of service (bsc#1158265).

CVE-2018-1000199: Fixed a potential local code execution via ptrace (bsc#1089895).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
137610	SUSE SLES12 Security Update : ucode-intel (SUSE-SU-2020:1595-1)	Nessus	SuSE Local Security Checks	6/18/2020	3/6/2024	medium
137273	RHEL 6 : microcode_ctl (RHSA-2020:2433)	Nessus	Red Hat Local Security Checks	6/9/2020	4/28/2024	medium
143005	RHEL 7 : microcode_ctl (RHSA-2020:2679)	Nessus	Red Hat Local Security Checks	11/18/2020	4/28/2024	medium
143027	RHEL 6 : microcode_ctl (RHSA-2020:2707)	Nessus	Red Hat Local Security Checks	11/18/2020	4/28/2024	medium
137751	RHEL 6 : microcode_ctl (RHSA-2020:2706)	Nessus	Red Hat Local Security Checks	6/23/2020	4/28/2024	medium
152627	RHEL 8 : microcode_ctl (RHSA-2021:3176)	Nessus	Red Hat Local Security Checks	8/17/2021	4/28/2024	high
152926	RHEL 7 : microcode_ctl (RHSA-2021:3317)	Nessus	Red Hat Local Security Checks	8/31/2021	4/28/2024	high
152955	RHEL 7 : microcode_ctl (RHSA-2021:3322)	Nessus	Red Hat Local Security Checks	9/1/2021	4/28/2024	high
138272	SUSE SLES15 Security Update : kernel (SUSE-SU-2020:1663-1)	Nessus	SuSE Local Security Checks	7/9/2020	3/1/2024	critical
150542	SUSE SLES11 Security Update : xen (SUSE-SU-2020:14521-1)	Nessus	SuSE Local Security Checks	6/10/2021	5/9/2022	high
137608	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1587-1)	Nessus	SuSE Local Security Checks	6/18/2020	3/6/2024	high
137616	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1603-1)	Nessus	SuSE Local Security Checks	6/18/2020	3/6/2024	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

high

high

high

critical

high

high

high