An update for kernel is now available for openEuler-20.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2023-1143 Final 1.0 1.0 2023-03-04 Initial 2023-03-04 2023-03-04 openEuler SA Tool V1.0 2023-03-04 kernel security update An update for kernel is now available for openEuler-20.03-LTS-SP3. The Linux Kernel, the operating system core itself. Security Fix(es): The Linux kernel does not correctly mitigate SMT attacks, as discovered through a strange pattern in the kernel API using STIBP as a mitigation[1 <https://docs.kernel.org/userspace-api/spec_ctrl.html>], leaving the process exposed for a short period of time after a syscall. The kernel also does not issue an IBPB immediately during the syscall. The ib_prctl_set [2 <https://elixir.bootlin.com/linux/v5.15.56/source/arch/x86/kernel/cpu/bugs.c#L1467>]function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update [3 <https://elixir.bootlin.com/linux/v5.15.56/source/arch/x86/kernel/process.c#L557>], but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall. The behavior is only corrected after a reschedule of the task happens. Furthermore, the kernel entrance (due to the syscall itself), does not issue an IBPB in the default scenarios (i.e., when the kernel protects itself via retpoline or eIBRS).(CVE-2023-0045) REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified..(CVE-2021-33639) An update for kernel is now available for openEuler-20.03-LTS-SP3. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium kernel https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1143 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0045 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2021-33639 https://nvd.nist.gov/vuln/detail/CVE-2023-0045 https://nvd.nist.gov/vuln/detail/CVE-2021-33639 openEuler-20.03-LTS-SP3 kernel-debuginfo-4.19.90-2302.5.0.0190.oe1.aarch64.rpm python2-perf-debuginfo-4.19.90-2302.5.0.0190.oe1.aarch64.rpm kernel-tools-4.19.90-2302.5.0.0190.oe1.aarch64.rpm kernel-source-4.19.90-2302.5.0.0190.oe1.aarch64.rpm python2-perf-4.19.90-2302.5.0.0190.oe1.aarch64.rpm kernel-debugsource-4.19.90-2302.5.0.0190.oe1.aarch64.rpm bpftool-debuginfo-4.19.90-2302.5.0.0190.oe1.aarch64.rpm perf-4.19.90-2302.5.0.0190.oe1.aarch64.rpm bpftool-4.19.90-2302.5.0.0190.oe1.aarch64.rpm python3-perf-debuginfo-4.19.90-2302.5.0.0190.oe1.aarch64.rpm kernel-tools-debuginfo-4.19.90-2302.5.0.0190.oe1.aarch64.rpm perf-debuginfo-4.19.90-2302.5.0.0190.oe1.aarch64.rpm python3-perf-4.19.90-2302.5.0.0190.oe1.aarch64.rpm kernel-tools-devel-4.19.90-2302.5.0.0190.oe1.aarch64.rpm kernel-4.19.90-2302.5.0.0190.oe1.aarch64.rpm kernel-devel-4.19.90-2302.5.0.0190.oe1.aarch64.rpm kernel-4.19.90-2302.5.0.0190.oe1.src.rpm python3-perf-4.19.90-2302.5.0.0190.oe1.x86_64.rpm kernel-4.19.90-2302.5.0.0190.oe1.x86_64.rpm kernel-tools-4.19.90-2302.5.0.0190.oe1.x86_64.rpm python2-perf-debuginfo-4.19.90-2302.5.0.0190.oe1.x86_64.rpm perf-4.19.90-2302.5.0.0190.oe1.x86_64.rpm kernel-debugsource-4.19.90-2302.5.0.0190.oe1.x86_64.rpm perf-debuginfo-4.19.90-2302.5.0.0190.oe1.x86_64.rpm kernel-devel-4.19.90-2302.5.0.0190.oe1.x86_64.rpm python3-perf-debuginfo-4.19.90-2302.5.0.0190.oe1.x86_64.rpm kernel-debuginfo-4.19.90-2302.5.0.0190.oe1.x86_64.rpm bpftool-debuginfo-4.19.90-2302.5.0.0190.oe1.x86_64.rpm python2-perf-4.19.90-2302.5.0.0190.oe1.x86_64.rpm kernel-source-4.19.90-2302.5.0.0190.oe1.x86_64.rpm kernel-tools-devel-4.19.90-2302.5.0.0190.oe1.x86_64.rpm bpftool-4.19.90-2302.5.0.0190.oe1.x86_64.rpm kernel-tools-debuginfo-4.19.90-2302.5.0.0190.oe1.x86_64.rpm The Linux kernel does not correctly mitigate SMT attacks, as discoveredthrough a strange pattern in the kernel API using STIBP as a mitigation[1<https://docs.kernel.org/userspace-api/spec_ctrl.html>], leaving theprocess exposed for a short period of time after a syscall. The kernel alsodoes not issue an IBPB immediately during the syscall.The ib_prctl_set [2<https://elixir.bootlin.com/linux/v5.15.56/source/arch/x86/kernel/cpu/bugs.c#L1467>]functionupdates the Thread Information Flags (TIFs) for the task and updates theSPEC_CTRL MSR on the function __speculation_ctrl_update [3<https://elixir.bootlin.com/linux/v5.15.56/source/arch/x86/kernel/process.c#L557>],but the IBPB is only issued on the next schedule, when the TIF bits arechecked. This leaves the victim vulnerable to values already injected onthe BTB, prior to the prctl syscall.The behavior is only corrected after a reschedule of the task happens.Furthermore, the kernel entrance (due to the syscall itself), does notissue an IBPB in the default scenarios (i.e., when the kernel protectsitself via retpoline or eIBRS). 2023-03-04 CVE-2023-0045 openEuler-20.03-LTS-SP3 Medium 5.1 AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N kernel security update 2023-03-04 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1143 REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified. 2023-03-04 CVE-2021-33639 openEuler-20.03-LTS-SP3 Medium 6.7 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H kernel security update 2023-03-04 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1143