Security update for the Linux Kernel (Live Patch 35 for SLE 12 SP3) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:3196-1 Final 1 1 2021-09-23T09:27:25Z current 2021-09-23T09:27:25Z 2021-09-23T09:27:25Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 35 for SLE 12 SP3) This update for the Linux Kernel 4.4.180-94_130 fixes several issues. The following security issues were fixed: - CVE-2021-3653: Fixed missing validation of the KVM `int_ctl` VMCB field that would have allowed a malicious L1 guest to enable AVIC support for the L2 guest (bsc#1189420). - CVE-2021-38198: Fixed KVM MMU to use the correct inherited permissions to get shadow page (bsc#1189278). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-3196,SUSE-SLE-SAP-12-SP3-2021-3195,SUSE-SLE-SAP-12-SP3-2021-3196,SUSE-SLE-SAP-12-SP3-2021-3197,SUSE-SLE-SAP-12-SP3-2021-3198,SUSE-SLE-SAP-12-SP3-2021-3199,SUSE-SLE-SAP-12-SP3-2021-3200,SUSE-SLE-SERVER-12-SP3-2021-3195,SUSE-SLE-SERVER-12-SP3-2021-3196,SUSE-SLE-SERVER-12-SP3-2021-3197,SUSE-SLE-SERVER-12-SP3-2021-3198,SUSE-SLE-SERVER-12-SP3-2021-3199,SUSE-SLE-SERVER-12-SP3-2021-3200 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20213196-1/ Link for SUSE-SU-2021:3196-1 https://lists.suse.com/pipermail/sle-security-updates/2021-September/009497.html E-Mail link for SUSE-SU-2021:3196-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1189278 SUSE Bug 1189278 https://bugzilla.suse.com/1189420 SUSE Bug 1189420 https://www.suse.com/security/cve/CVE-2021-3653/ SUSE CVE CVE-2021-3653 page https://www.suse.com/security/cve/CVE-2021-38198/ SUSE CVE CVE-2021-38198 page SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP3 kgraft-patch-4_4_180-94_147-default-3-2.2 kgraft-patch-4_4_180-94_135-default-12-2.3 kgraft-patch-4_4_180-94_144-default-6-2.2 kgraft-patch-4_4_180-94_141-default-9-2.2 kgraft-patch-4_4_180-94_138-default-10-2.2 kgraft-patch-4_4_180-94_130-default-14-2.3 kgraft-patch-4_4_180-94_135-default-12-2.3 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS kgraft-patch-4_4_180-94_147-default-3-2.2 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS kgraft-patch-4_4_180-94_144-default-6-2.2 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS kgraft-patch-4_4_180-94_141-default-9-2.2 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS kgraft-patch-4_4_180-94_138-default-10-2.2 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS kgraft-patch-4_4_180-94_130-default-14-2.3 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS kgraft-patch-4_4_180-94_135-default-12-2.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 kgraft-patch-4_4_180-94_147-default-3-2.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 kgraft-patch-4_4_180-94_144-default-6-2.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 kgraft-patch-4_4_180-94_141-default-9-2.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 kgraft-patch-4_4_180-94_138-default-10-2.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 kgraft-patch-4_4_180-94_130-default-14-2.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7. CVE-2021-3653 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_130-default-14-2.3 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_135-default-12-2.3 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_138-default-10-2.2 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_141-default-9-2.2 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_144-default-6-2.2 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_147-default-3-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_130-default-14-2.3 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_135-default-12-2.3 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_138-default-10-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_141-default-9-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_144-default-6-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_147-default-3-2.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213196-1/ https://www.suse.com/security/cve/CVE-2021-3653.html CVE-2021-3653 https://bugzilla.suse.com/1189399 SUSE Bug 1189399 https://bugzilla.suse.com/1189420 SUSE Bug 1189420 https://bugzilla.suse.com/1196914 SUSE Bug 1196914 arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault. CVE-2021-38198 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_130-default-14-2.3 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_135-default-12-2.3 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_138-default-10-2.2 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_141-default-9-2.2 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_144-default-6-2.2 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_147-default-3-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_130-default-14-2.3 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_135-default-12-2.3 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_138-default-10-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_141-default-9-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_144-default-6-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_147-default-3-2.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213196-1/ https://www.suse.com/security/cve/CVE-2021-38198.html CVE-2021-38198 https://bugzilla.suse.com/1189262 SUSE Bug 1189262 https://bugzilla.suse.com/1189278 SUSE Bug 1189278 https://bugzilla.suse.com/1196914 SUSE Bug 1196914