suse-su-2018:1926-1
Vulnerability from csaf_suse
Published
2018-07-11 13:55
Modified
2018-07-11 13:55
Summary
Security update for ucode-intel

Notes

Title of the patch
Security update for ucode-intel
Description of the patch
This update for ucode-intel fixes the following issues: The microcode bundles was updated to the 20180703 release For the listed CPU chipsets this fixes CVE-2018-3640 (Spectre v3a) and helps mitigating CVE-2018-3639 (Spectre v4) (bsc#1100147 bsc#1087082 bsc#1087083). More information on: https://downloadcenter.intel.com/download/27945/Linux-Processor-Microcode-Data-File Following chipsets are fixed in this round: Model Stepping F-MO-S/PI Old->New ---- updated platforms ------------------------------------ SNB-EP C1 6-2d-6/6d 0000061c->0000061d Xeon E5 SNB-EP C2 6-2d-7/6d 00000713->00000714 Xeon E5 IVT C0 6-3e-4/ed 0000042c->0000042d Xeon E5 v2; Core i7-4960X/4930K/4820K IVT D1 6-3e-7/ed 00000713->00000714 Xeon E5 v2 HSX-E/EP/4S C0 6-3f-2/6f 0000003c->0000003d Xeon E5 v3 HSX-EX E0 6-3f-4/80 00000011->00000012 Xeon E7 v3 SKX-SP/D/W/X H0 6-55-4/b7 02000043->0200004d Xeon Bronze 31xx, Silver 41xx, Gold 51xx/61xx Platinum 81xx, D/W-21xx; Core i9-7xxxX BDX-DE A1 6-56-5/10 0e000009->0e00000a Xeon D-15x3N BDX-ML B/M/R0 6-4f-1/ef 0b00002c->0b00002e Xeon E5/E7 v4; Core i7-69xx/68xx
Patchnames
SUSE-SLE-Module-Basesystem-15-2018-1299
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for ucode-intel",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update for ucode-intel fixes the following issues:\n\nThe microcode bundles was updated to the 20180703 release\n\nFor the listed CPU chipsets this fixes CVE-2018-3640 (Spectre v3a)\nand helps mitigating CVE-2018-3639 (Spectre v4)  (bsc#1100147 bsc#1087082 bsc#1087083).\n\nMore information on:\n  https://downloadcenter.intel.com/download/27945/Linux-Processor-Microcode-Data-File\n\nFollowing chipsets are fixed in this round:\n\nModel        Stepping F-MO-S/PI      Old-\u003eNew\n\n---- updated platforms ------------------------------------\n\nSNB-EP       C1       6-2d-6/6d 0000061c-\u003e0000061d Xeon E5\nSNB-EP       C2       6-2d-7/6d 00000713-\u003e00000714 Xeon E5\nIVT          C0       6-3e-4/ed 0000042c-\u003e0000042d Xeon E5 v2; Core i7-4960X/4930K/4820K\nIVT          D1       6-3e-7/ed 00000713-\u003e00000714 Xeon E5 v2\nHSX-E/EP/4S  C0       6-3f-2/6f 0000003c-\u003e0000003d Xeon E5 v3\nHSX-EX       E0       6-3f-4/80 00000011-\u003e00000012 Xeon E7 v3\nSKX-SP/D/W/X H0       6-55-4/b7 02000043-\u003e0200004d Xeon Bronze 31xx, Silver 41xx, Gold 51xx/61xx Platinum 81xx, D/W-21xx; Core i9-7xxxX\nBDX-DE       A1       6-56-5/10 0e000009-\u003e0e00000a Xeon D-15x3N\nBDX-ML       B/M/R0   6-4f-1/ef 0b00002c-\u003e0b00002e Xeon E5/E7 v4; Core i7-69xx/68xx\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Module-Basesystem-15-2018-1299",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_1926-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2018:1926-1",
        "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181926-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2018:1926-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-July/004256.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1087082",
        "url": "https://bugzilla.suse.com/1087082"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1087083",
        "url": "https://bugzilla.suse.com/1087083"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1100147",
        "url": "https://bugzilla.suse.com/1100147"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-3639 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-3639/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-3640 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-3640/"
      }
    ],
    "title": "Security update for ucode-intel",
    "tracking": {
      "current_release_date": "2018-07-11T13:55:21Z",
      "generator": {
        "date": "2018-07-11T13:55:21Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2018:1926-1",
      "initial_release_date": "2018-07-11T13:55:21Z",
      "revision_history": [
        {
          "date": "2018-07-11T13:55:21Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ucode-intel-20180703-3.3.1.x86_64",
                "product": {
                  "name": "ucode-intel-20180703-3.3.1.x86_64",
                  "product_id": "ucode-intel-20180703-3.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ucode-intel-20180703-3.3.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15:ucode-intel-20180703-3.3.1.x86_64"
        },
        "product_reference": "ucode-intel-20180703-3.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-3639",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-3639"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15:ucode-intel-20180703-3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-3639",
          "url": "https://www.suse.com/security/cve/CVE-2018-3639"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1074701 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1074701"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1085235 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1085235"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1085308 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1085308"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1087078 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1087078"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1087082 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1087082"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1092631 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1092631"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1092885 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1092885"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1094912 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1094912"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1098813 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1098813"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1100394 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1100394"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1102640 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1102640"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1105412 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1105412"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1111963 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1111963"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172781 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1172781"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172782 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1172782"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172783 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1172783"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1173489 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1173489"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1178658"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201877 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1201877"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215674 for CVE-2018-3639",
          "url": "https://bugzilla.suse.com/1215674"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15:ucode-intel-20180703-3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15:ucode-intel-20180703-3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-07-11T13:55:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-3639"
    },
    {
      "cve": "CVE-2018-3640",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-3640"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis, aka Rogue System Register Read (RSRE), Variant 3a.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15:ucode-intel-20180703-3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-3640",
          "url": "https://www.suse.com/security/cve/CVE-2018-3640"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1074701 for CVE-2018-3640",
          "url": "https://bugzilla.suse.com/1074701"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1087078 for CVE-2018-3640",
          "url": "https://bugzilla.suse.com/1087078"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1087083 for CVE-2018-3640",
          "url": "https://bugzilla.suse.com/1087083"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1094912 for CVE-2018-3640",
          "url": "https://bugzilla.suse.com/1094912"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1098813 for CVE-2018-3640",
          "url": "https://bugzilla.suse.com/1098813"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1100394 for CVE-2018-3640",
          "url": "https://bugzilla.suse.com/1100394"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1115893 for CVE-2018-3640",
          "url": "https://bugzilla.suse.com/1115893"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1175912 for CVE-2018-3640",
          "url": "https://bugzilla.suse.com/1175912"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201877 for CVE-2018-3640",
          "url": "https://bugzilla.suse.com/1201877"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15:ucode-intel-20180703-3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15:ucode-intel-20180703-3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-07-11T13:55:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-3640"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.