- openSUSE Security

[opensuse-security] How to correctly configure mitigation of CVE-2018-3646 'Foreshadow-NG (VMM)' on Xen Dom0 host?
by PGNet Dev 15 Apr '19

15 Apr '19

Following along at CVE-2018-3646 Common Vulnerabilities and Exposures https://www.suse.com/security/cve/CVE-2018-3646/ & Security Vulnerability: Spectre Variant 4 (Speculative Store Bypass) aka CVE-2018-3639. https://www.suse.com/support/kb/doc/?id=7022937 piecing together a number of other posts, and noting https://lists.opensuse.org/opensuse-security-announce/2018-12/msg00073.html An update that solves 9 vulnerabilities and has four fixes is now available. This update for xen fixes the following issues: Update to Xen 4.10.2 bug fix release (bsc#1027519). ... - CVE-2018-3646: Mitigations for VMM aspects of L1 Terminal Fault (XSA-273) (bsc#1091107) which references, Bug 1091107 - VUL-0: CVE-2018-3646: xen: L1 Terminal Fault -VMM (XSA-273) https://bugzilla.suse.com/show_bug.cgi?id=1091107 ==> Status: RESOLVED FIXED on uname -rm 5.0.7-lp150.5.g012b5f1-default x86_64 lsb_release -rd Description: openSUSE Leap 15.0 Release: 15.0 grep "model name" /proc/cpuinfo | head -n 1 model name : Intel(R) Xeon(R) CPU E3-1220 v3 @ 3.10GHz booting a Xen Dom0 host, dmesg | grep -i "xen version" [ 1.188399] Xen version: 4.12.0_09-lp150.640 (preserve-AD) In my grub cfg, GRUB_CMDLINE_LINUX_XEN_REPLACE="... spectre_v2=retpoline,generic spec_store_bypass_disable=on ..." GRUB_CMDLINE_XEN="... spec-ctrl=ssbd,l1d-flush=true pv-l1tf=dom0=true,domu=true smt=true ucode=scan ..." Updating microcode in Xen environments https://www.suse.com/support/kb/doc/?id=7022546 after grub re-config & mkinitrd, then reboot, per Updating microcode in Xen environments https://www.suse.com/support/kb/doc/?id=7022546 verifying, egrep "family|model|stepping" /proc/cpuinfo -m 4 cpu family : 6 model : 60 model name : Intel(R) Xeon(R) CPU E3-1220 v3 @ 3.10GHz stepping : 3 in hex, [cpu family]-[model]-[stepping] === 06-3C-03 rpm -qa | grep -i ucode-intel ucode-intel-20190312-lp150.3.1.x86_64 rpm -ql ucode-intel | grep -i 06-3C-03 /lib/firmware/intel-ucode/06-3c-03 lsinitrd /boot/initrd-5.0.7-lp150.5.g012b5f1-default Image: /boot/initrd-5.0.7-lp150.5.g012b5f1-default: 18M ======================================================================== Early CPIO image ======================================================================== drwxr-xr-x 3 root root 0 Apr 14 20:15 . -rw-r--r-- 1 root root 2 Apr 14 20:15 early_cpio drwxr-xr-x 3 root root 0 Apr 14 20:15 kernel drwxr-xr-x 3 root root 0 Apr 14 20:15 kernel/x86 drwxr-xr-x 2 root root 0 Apr 14 20:15 kernel/x86/microcode -rw-r--r-- 1 root root 23552 Apr 14 20:15 kernel/x86/microcode/GenuineIntel.bin ======================================================================== Version: dracut-044-lp150.14.27.1 grep -m1 microcode /proc/cpuinfo microcode : 0x25 in serial log (XEN) [00000027c847dc37] Xen version 4.12.0_09-lp150.640 (abuild(a)suse.de) (gcc (SUSE Linux) 8.3.1 20190305 [gcc-8-branch revi sion 269383]) debug=n Thu Apr 11 22:29:39 UTC 2019 (XEN) [00000027cb3e1267] Latest ChangeSet: (XEN) [00000027cbff3231] Bootloader: EFI (XEN) [00000027ccb72e3d] Command line: dom0_mem=4016M,max:4096M bootscrub=false dom0_max_vcpus=4 spec-ctrl=ssbd,l1d-flush=true pv-l1tf=dom0=true,domu=true smt=true com1=115200,8n1,pci console=com1,vga console_timestamps console_to_ring conring_size=64 sched=credit2 reboot=acpi ucode=scan log_buf_len=16M loglvl=warning guest_loglvl=none/warning noreboot=false iommu=verbose ... (XEN) [00000028c099c50b] Speculative mitigation facilities: (XEN) [00000028c19f6e50] Hardware features: IBRS/IBPB STIBP L1D_FLUSH SSBD (XEN) [00000028c2f57689] Compiled-in support: INDIRECT_THUNK SHADOW_PAGING (XEN) [00000028c445abaf] Xen settings: BTI-Thunk RETPOLINE, SPEC_CTRL: IBRS- SSBD+, Other: IBPB L1D_FLUSH (XEN) [00000028c61da08b] L1TF: believed vulnerable, maxphysaddr L1D 46, CPUID 39, Safe address 8000000000 (XEN) [00000028c7f67494] Support for HVM VMs: MSR_SPEC_CTRL RSB EAGER_FPU (XEN) [00000028c94630dc] Support for PV VMs: MSR_SPEC_CTRL RSB EAGER_FPU (XEN) [00000028ca92b21c] XPTI (64-bit PV only): Dom0 enabled, DomU enabled (with PCID) (XEN) [00000028cc1cfa07] PV L1TF shadowing: Dom0 enabled, DomU enabled then, cd /sys/devices/system/cpu/vulnerabilities/ for f in $(ls); do echo -e "\n$f"; cat $f; done l1tf Mitigation: PTE Inversion meltdown Unknown (XEN PV detected, hypervisor mitigation required) spec_store_bypass Mitigation: Speculative Store Bypass disabled spectre_v1 Mitigation: __user pointer sanitization spectre_v2 Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling BUT, checking with spectre-meltdown-checker.sh still returns "STATUS: VULNERABLE", ... CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault' * Information from the /sys interface: * This system is a host running an hypervisor: YES * Mitigation 1 (KVM) * EPT is disabled: N/A (the kvm_intel module is not loaded) * Mitigation 2 * L1D flush is supported by kernel: YES (found flush_l1d in kernel image) * L1D flush enabled: UNKNOWN (unrecognized mode) * Hardware-backed L1D flush supported: NO (flush will be done in software, this is slower) * Hyper-Threading (SMT) is enabled: YES > STATUS: VULNERABLE (disable EPT or enabled L1D flushing to mitigate the vulnerability) ... Since I'm on Xen, 'Mitigation 1' isn't an option. Two things catch my attention: (1) L1D flush enabled: UNKNOWN (unrecognized mode) Not sure yet why I'm seeing UNKNOWN here, & (2) Hardware-backed L1D flush supported: NO even though (XEN) [00000028c19f6e50] Hardware features: IBRS/IBPB STIBP L1D_FLUSH SSBD ^^^^^^^^^ What's missing in my config to mitigate/remove the CVE-2018-3646 vulnerability? -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 2

[opensuse-security] YARA disabled in ClamAV for licensing reasons?
by Martin Herkt 09 Mar '19

09 Mar '19

I wanted to use YARA rules with ClamAV on my openSUSE boxes, but I see it has been disabled for “licensing reasons,” with the details hidden in bsc#1101654, which is not publicly accessible. Which licensing reasons are these? Other distributions do not seem to disable this feature.

1 0

[opensuse-security] Re: [security-announce] Change in announcements posted on opensuse-security-announce
by Carlos E. R. 29 May '18

29 May '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Content-ID: <alpine.LSU.2.21.1805282302350.13021(a)Telcontar.valinor> El 2018-05-14 a las 21:44 +0200, Marcus Meissner escribió: > Hi folks, > > Up to now this list has also received SUSE Linux Enterprise announcements, > largely due to historic reasons. > > As openSUSE and SUSE Linux Enterprise are different and the number of > SUSE Linux Enterprise announcements is quite high at times, we will no > longer be posting Enterprise announcements here. ... Thank you! :-) I see SLE posting still being made to [security-announce]. Do you want report on those? Examples: [security-announce] openSUSE-SU-2018:1359-1: important: Security update for Mozilla Thunderbird [security-announce] openSUSE-SU-2018:1392-1: moderate: Security update for enigmail [security-announce] openSUSE-SU-2018:1437-1: important: Security update for Chromium [security-announce] openSUSE-SU-2018:1451-1: moderate: Security update for enigmail - -- Saludos Carlos E. R. (desde openSUSE 42.3 x86_64 "Malachite" en Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iEYEARECAAYFAlsMbt4ACgkQtTMYHG2NR9WqwwCcDk1ETJaZUbVqKqZ6zpyS6phs VZoAoI/YrfJGqYdrDRQw2ZX6abEbTKAQ =sbDY -----END PGP SIGNATURE-----

2 1

[opensuse-security] The list needs to be split
by James Rome 11 May '18

11 May '18

There are so many versions of OpenSUSE now that most of the announcements do not apply to anyone. Can't we split the list so we only get announcements for the version we have? -- James A. Rome http://jamesrome.net -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] ***UNCHECKED*** clamav remote code injection
by Florian Gleixner 27 Jan '18

27 Jan '18

Hi, there are reports from email service providers, that there are attempts to exploit clamav using prepared pdf documents in mails. See (in german): https://www.heise.de/security/meldung/Jetzt-patchen-Angriffe-auf-Viren-Scan… I hope, the opensuse security team will release a update for clamav soon.

2 1

[opensuse-security] Security issue with Docker / namespaces?
by Jean-Christophe Baptiste 24 Jan '18

24 Jan '18

Hi guys, I am afraid of a security issue with Docker. Sorry but I have no other machines to test for now, so it might be a local issue only. I realized that today when running an Ubuntu container : % docker run -ti --rm --hostname=ubuntu --net=host ubuntu /bin/bash It runs a bash shell inside the Ubuntu container. But, from within the container (screenshot attached): % apt update # should fail, not finding the command % zypper refresh # unexpectedly, it would work and refresh the host repos! Of course, this is absolutely abnormal and I am still evaluating the exact impact. I can tell that the issue was not here one week ago (I have been a quite intensive Docker user for around 2 years). So I am not sure what is causing this behavior. Looking forward to reading some feedbacks. Best regards, -- Jean-Christophe

1 2

[opensuse-security] Antw: [security-announce] SUSE-SU-2017:2791-1: important: Security update for Linux Kernel Live Patch 21 for SLE 12 SP1
by Ulrich Windl 23 Oct '17

23 Oct '17

>>> <opensuse-security(a)opensuse.org> schrieb am 20.10.2017 um 03:07 in Nachricht <20171020010740.0C339FC69(a)maintenance.suse.de>: > SUSE Security Update: Security update for Linux Kernel Live Patch 21 for SLE > 12 SP1 I wonder: Shouldn't the subject be like "[security-announce] SUSE-SU-2017:2791-1: important: Security update (Linux Kernel Live Patch 21 for SLE 12 SP1)"? Or is it actually a security update for the kernel live patch? Regards, Ulrich > ____________________________________________________________________________ > __ > > Announcement ID: SUSE-SU-2017:2791-1 > Rating: important > References: #1038564 #1042892 #1045327 #1052311 #1052368 > > Cross-References: CVE-2017-1000112 CVE-2017-15274 CVE-2017-8890 > CVE-2017-9242 > Affected Products: > SUSE Linux Enterprise Server for SAP 12-SP1 > SUSE Linux Enterprise Server 12-SP1-LTSS > ____________________________________________________________________________ > __ > > An update that solves four vulnerabilities and has one > errata is now available. > > Description: > > This update for the Linux Kernel 3.12.74-60_64_60 fixes several issues. > > The following security bugs were fixed: > > - CVE-2017-15274: security/keys/keyctl.c in the Linux kernel did not > consider the case of a NULL payload in conjunction with a nonzero > length > value, which allowed local users to cause a denial of service (NULL > pointer dereference and OOPS) via a crafted add_key or keyctl system > call (bsc#1045327). > - CVE-2017-1000112: Updated patch for this issue to be in sync with the > other livepatches. Description of the issue: Prevent race condition in > net-packet code that could have been exploited by unprivileged users to > gain root access (bsc#1052368, bsc#1052311). > - CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c > was too late in checking whether an overwrite of an skb data structure > may occur, which allowed local users to cause a denial of service > (system crash) via crafted system calls (bsc#1042892). > - CVE-2017-8890: The inet_csk_clone_lock function in > net/ipv4/inet_connection_sock.c allowed attackers to cause a denial of > service (double free) or possibly have unspecified other impact by > leveraging use of the accept system call (bsc#1038564). > > > Patch Instructions: > > To install this SUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - SUSE Linux Enterprise Server for SAP 12-SP1: > > zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1732=1 > > - SUSE Linux Enterprise Server 12-SP1-LTSS: > > zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1732=1 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): > > kgraft-patch-3_12_74-60_64_60-default-2-4.1 > kgraft-patch-3_12_74-60_64_60-xen-2-4.1 > > - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): > > kgraft-patch-3_12_74-60_64_60-default-2-4.1 > kgraft-patch-3_12_74-60_64_60-xen-2-4.1 > > > References: > > https://www.suse.com/security/cve/CVE-2017-1000112.html > https://www.suse.com/security/cve/CVE-2017-15274.html > https://www.suse.com/security/cve/CVE-2017-8890.html > https://www.suse.com/security/cve/CVE-2017-9242.html > https://bugzilla.suse.com/1038564 > https://bugzilla.suse.com/1042892 > https://bugzilla.suse.com/1045327 > https://bugzilla.suse.com/1052311 > https://bugzilla.suse.com/1052368 > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 1

[opensuse-security] Will Cliqz affect Firefox versions in openSUSE?
by 686f6c6d 11 Oct '17

11 Oct '17

Greetings, I just read a (german) article[0] and official (german) Mozilla blog post[1] saying that starting next week, a small percentage of (german?) Firefox downloads will contain the "Cliqz" add-on, which is controversial, to say the least. There's already a bug report to remove it[2]. Will this in any way affect openSUSE? If so, are there plans to keep the add-on out of the openSUSE version of Firefox? [0]: https://www.heise.de/newsticker/meldung/Firefox-Testlauf-fuer-neue-Empfehlu… [1]: https://blog.mozilla.org/press-de/2017/10/06/ein-neues-cliqz-experiment-in-… [2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1406647 -- Kind regards Christopher 'm4z' Holm / 686f6c6d "We must respect the other fellow's religion, but only in the sense and to the extent that we respect his theory that his wife is beautiful and his children smart." --H. L. Mencken -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 1

[opensuse-security] dnsmasq vulnerability?
by Administrator 05 Oct '17

05 Oct '17

Hi Is ipcop vulnerable to any of this: https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.h… # dnsmasq -v Dnsmasq version 2.72 Copyright (c) 2000-2014 Simon Kelley Compile time options: IPv6 GNU-getopt no-DBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP no-conntrack ipset auth no-DNSSEC loop-detect Yours David -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 1

[opensuse-security] Build Service key
by linux maillist 04 Oct '17

04 Oct '17

Hello, I think the buildservice(a)opensuse.org key ( 0x6B9D6523) can be regarded a very important key. Thus, I wonder why is it not signed by the SUSE security team? It is signed by Marcus Meissner, which is fine, but shouldn´t such an important key be signed as well by the security team or at least by the openSUSE project signing key? IMHO that would grant a stronger chain of trust for that key..... -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

5 4