Security update for microcode_ctl

Announcement ID: SUSE-SU-2018:2076-1
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2018-3639 ( SUSE ): 4.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
  • CVE-2018-3639 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  • CVE-2018-3639 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  • CVE-2018-3640 ( SUSE ): 4.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
  • CVE-2018-3640 ( NVD ): 5.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected Products:
  • SLES for SAP Applications 11-SP4
  • SUSE Linux Enterprise Point of Service 11 SP3
  • SUSE Linux Enterprise Server 11 SP3 LTSS 11-SP3
  • SUSE Linux Enterprise Server 11 SP4

An update that solves two vulnerabilities and has one security fix can now be installed.

Description:

This update for microcode_ctl fixes the following issues:

The Intel CPU Microcode bundle was updated to the 20180703 release

For the listed CPU chipsets this fixes CVE-2018-3640 (Spectre v3a) and helps mitigating CVE-2018-3639 (Spectre v4) (bsc#1100147 bsc#1087082 bsc#1087083)

More details can be found on:

https://downloadcenter.intel.com/download/27945/Linux-Processor-Microcode-Data-File

Following chipsets are fixed in this round:

Model Stepping F-MO-S/PI Old->New ---- updated platforms ------------------------------------ SNB-EP C1 6-2d-6/6d 0000061c->0000061d Xeon E5 SNB-EP C2 6-2d-7/6d 00000713->00000714 Xeon E5 IVT C0 6-3e-4/ed 0000042c->0000042d Xeon E5 v2; Core i7-4960X/4930K/4820K IVT D1 6-3e-7/ed 00000713->00000714 Xeon E5 v2 HSX-E/EP/4S C0 6-3f-2/6f 0000003c->0000003d Xeon E5 v3 HSX-EX E0 6-3f-4/80 00000011->00000012 Xeon E7 v3 SKX-SP/D/W/X H0 6-55-4/b7 02000043->0200004d Xeon Bronze 31xx, Silver 41xx, Gold 51xx/61xx Platinum 81xx, D/W-21xx; Core i9-7xxxX BDX-DE A1 6-56-5/10 0e000009->0e00000a Xeon D-15x3N BDX-ML B/M/R0 6-4f-1/ef 0b00002c->0b00002e Xeon E5/E7 v4; Core i7-69xx/68xx

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Point of Service 11 SP3
    zypper in -t patch sleposp3-microcode_ctl-13704=1
  • SUSE Linux Enterprise Server 11 SP3 LTSS 11-SP3
    zypper in -t patch slessp3-microcode_ctl-13704=1
  • SUSE Linux Enterprise Server 11 SP4
    zypper in -t patch slessp4-microcode_ctl-13704=1
  • SLES for SAP Applications 11-SP4
    zypper in -t patch slessp4-microcode_ctl-13704=1

Package List:

  • SUSE Linux Enterprise Point of Service 11 SP3 (i586)
    • microcode_ctl-1.17-102.83.24.1
  • SUSE Linux Enterprise Server 11 SP3 LTSS 11-SP3 (x86_64 i586)
    • microcode_ctl-1.17-102.83.24.1
  • SUSE Linux Enterprise Server 11 SP4 (x86_64 i586)
    • microcode_ctl-1.17-102.83.24.1
  • SLES for SAP Applications 11-SP4 (x86_64)
    • microcode_ctl-1.17-102.83.24.1

References: