Installed tmb kernel and rebooted.
4.14.116-tmb-desktop-1.mga6
Intel Core i7-4790 (-HT-MCP-)
NVIDIA GM204 [GeForce GTX 970] : nvidia 390.87
Stress tests completed.
Common desktop applications working including virtualbox, mplayer, gimp, LO, thunderbird, image viewers, mplayer.  NFS share mounted and working with vlc playing movies from a server.  Bluetooth audio working, also free-to-air TV.
stellarium and celestia run fine.  All good.  leaving this to run for a while.

CC: (none) => tarazed25

Intel Core i9-7900X (-HT-MCP-)
NVIDIA GP102 [GeForce GTX 1080 Ti] : nvidia 390.87
nvidia304, nvidia340 and nvidia390 modules built during installation.
# drakboot --boot
Smooth reboot to Mate desktop.
4.14.116-tmb-desktop-1.mga6
NFS shares in place.  Everything looking good, ssh, video, sound, common applications.

Intel Core i7-5700HQ (-HT-MCP-)
NVIDIA GM204M [GeForce GTX 965M]
nvidia 410.78 module rebuilt.
Updated grub menu.

4.14.116-tmb-desktop-1.mga6
Networking OK, remote logins, and NFS shares mounted.
Various stress tests completed successfully.
Desktop looks functional. Laptop lid closed and opened - session restored including this open edit.

Advisory, added to svn:


type: security
subject: Updated kernel-tmb packages fixes security vulnerabilities
CVE:
 - CVE-2018-1128
 - CVE-2018-1129
 - CVE-2018-14625
 - CVE-2018-16862
 - CVE-2018-16882
 - CVE-2018-16884
 - CVE-2018-18397
 - CVE-2018-19824
 - CVE-2018-19985
 - CVE-2018-1000026
 - CVE-2019-3701
 - CVE-2019-3819
 - CVE-2019-3882
 - CVE-2019-7308
 - CVE-2019-6974
 - CVE-2019-7221
 - CVE-2019-7222
 - CVE-2019-9213
 - CVE-2019-11486
 - CVE-2019-11599
src:
  6:
   core:
     - kernel-tmb-4.14.116-1.mga6
description: |
  This kernel-tbm update is based on the upstream 4.14.116 and fixes
  atleast the following security issues:

  Cross-hyperthread Spectre v2 mitigation is now provided by the Single
  Thread Indirect Branch Predictors (STIBP) support. Note that STIBP also
  requires the functionality be supported by the Intel microcode in use.

  It was found that cephx authentication protocol did not verify ceph clients
  correctly and was vulnerable to replay attack. Any attacker having access
  to ceph cluster network who is able to sniff packets on network can use
  this vulnerability to authenticate with ceph service and perform actions
  allowed by ceph service (CVE-2018-1128).

  A flaw was found in the way signature calculation was handled by cephx
  authentication protocol. An attacker having access to ceph cluster network
  who is able to alter the message payload was able to bypass signature
  checks done by cephx protocol (CVE-2018-1129).

  A flaw was found in the Linux Kernel where an attacker may be able to have
  an uncontrolled read to kernel-memory from within a vm guest. A race
  condition between connect() and close() function may allow an attacker
  using the AF_VSOCK protocol to gather a 4 byte information leak or possibly
  intercept or corrupt AF_VSOCK messages destined to other clients
  (CVE-2018-14625).

  A security flaw was found in the Linux kernel in a way that the cleancache
  subsystem clears an inode after the final file truncation (removal). The
  new file created with the same inode may contain leftover pages from
  cleancache and the old file data instead of the new one (CVE-2018-16862).

  A use-after-free issue was found in the way the Linux kernel's KVM
  hypervisor processed posted interrupts when nested(=1) virtualization is
  enabled. In nested_get_vmcs12_pages(), in case of an error while
  processing posted interrupt address, it unmaps the 'pi_desc_page' without
  resetting 'pi_desc' descriptor address, which is later used in
  pi_test_and_clear_on(). A guest user/process could use this flaw to crash
  the host kernel resulting in DoS or potentially gain privileged access to
  a system (CVE-2018-16882).

  A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares
  mounted in different network namespaces at the same time can make
  bc_svc_process() use wrong back-channel IDs and cause a use-after-free
  vulnerability. Thus a malicious container user can cause a host kernel
  memory corruption and a system panic. Due to the nature of the flaw,
  privilege escalation cannot be fully ruled out (CVE-2018-16884).

  The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles
  access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing
  local users to write data into holes in a tmpfs file (if the user has
  read-only access to that file, and that file contains holes)
  (CVE-2018-18397).

  In the Linux kernel through 4.19.6, a local user could exploit a
  use-after-free in the ALSA driver by supplying a malicious USB Sound device
  (with zero interfaces) (CVE-2018-19824).

  A flaw was found in the Linux kernel in the function hso_probe() which
  reads if_num value from the USB device (as an u8) and uses it without a
  length check to index an array, resulting in an OOB memory read in
  hso_probe() or hso_get_config_data(). An attacker with a forged USB
  device and physical access to a system (needed to connect such a device)
  can cause a system crash and a denial of service (CVE-2018-19985).

  Linux Linux kernel version at least v4.8 onwards, probably well before
  contains a Insufficient input validation vulnerability in bnx2x network
  card driver that can result in DoS: Network card firmware assertion takes
  card off-line. This attack appear to be exploitable via An attacker on a
  must pass a very large, specially crafted packet to the bnx2x card.
  This can be done from an untrusted guest VM (CVE-2018-1000026)

  An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux
  kernel through 4.19.13. The CAN frame modification rules allow bitwise
  logical operations that can be also applied to the can_dlc field. Because
  of a missing check, the CAN drivers may write arbitrary content beyond
  the data registers in the CAN controller's I/O memory when processing
  can-gw manipulated outgoing frames. This is related to cgw_csum_xor_rel.
  An unprivileged user can trigger a system crash (general protection fault)
  (CVE-2019-3701).

  A flaw was found in the Linux kernel in the function hid_debug_events_read()
  in drivers/hid/hid-debug.c file which may enter an infinite loop with
  certain parameters passed from a userspace. A local privileged user ("root")
  can cause a system lock up and a denial of service (CVE-2019-3819).
  A flaw was found in the Linux kernel's vfio interface implementation that
  permits violation of the user's locked memory limit. If a device is bound
  to a vfio driver, such as vfio-pci, and the local attacker is
  administratively granted ownership of the device, it may cause a system
  memory exhaustion and thus a denial of service (DoS) (CVE-2019-3882).

  In the Linux kernel before 4.20.8, kvm_ioctl_create_device in
  virt/kvm/kvm_main.c mishandles reference counting because of a race
  condition, leading to a use-after-free (CVE-2019-6974).

  A use-after-free vulnerability was found in the way the Linux kernel's KVM
  hypervisor emulates a preemption timer for L2 guests when nested (=1)
  virtualization is enabled. This high resolution timer(hrtimer) runs when
  a L2 guest is active. After VM exit, the sync_vmcs12() timer object is
  stopped. The use-after-free occurs if the timer object is freed before
  calling sync_vmcs12() routine. A guest user/process could use this flaw
  to crash the host kernel resulting in a denial of service or, potentially,
  gain privileged access to a system (CVE-2019-7221).

  An information leakage issue was found in the way Linux kernel's KVM
  hypervisor handled page fault exceptions while emulating instructions
  like VMXON, VMCLEAR, VMPTRLD, and VMWRITE with memory address as an
  operand. It occurs if the operand is a mmio address, as the returned
  exception object holds uninitialized stack memory contents. A guest
  user/process could use this flaw to leak host's stack memory contents
  to a guest (CVE-2019-7222).

  kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable
  out-of-bounds speculation on pointer arithmetic in various cases, including
  cases of different branches with different state or limits to sanitize,
  leading to side-channel attacks (CVE-2019-7308).

  In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks
  a check for the mmap minimum address, which makes it easier for attackers
  to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is
  related to a capability check for the wrong task (CVE-2019-9213).

  The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the
  Linux kernel before 5.0.8 has multiple race conditions (CVE-2019-11486).

  The coredump implementation in the Linux kernel before 5.0.10 does not use
  locking or other mechanisms to prevent vma layout or vma flags changes while
  it runs, which allows local users to obtain sensitive information, cause a
  denial of service, or possibly have unspecified other impact by triggering
  a race condition with mmget_not_zero or get_task_mm calls (CVE-2019-11599).

  It also fixes signal handling issues causing powertop to crash and some
  tracing tools to fail on execve tests.

  Ndiswrapper has been updated to 1.62

  WireGuard has been updated to 0.0.20190406.

  For other uptstream fixes in this update, see the referenced changelogs.
references:
 - https://bugs.mageia.org/show_bug.cgi?id=24774
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.79
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.80
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.81
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.82
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.83
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.84
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.85
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.86
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.87
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.88
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.89
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.90
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.91
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.92
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.93
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.94
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.95
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.96
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.97
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.98
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.99
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.100
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.101
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.102
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.103
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.104
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.105
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.106
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.107
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.108
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.109
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.110
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.111
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.112
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.113
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.114
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.115
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.116

Keywords: (none) => advisory

updating to 4.14.119 to include the Intel MDS Security issue that went public a few hours ago...

SRPMS:
kernel-tmb-4.14.119-1.mga6.src.rpm


i586:
kernel-tmb-desktop-4.14.119-1.mga6-1-1.mga6.i586.rpm
kernel-tmb-desktop-devel-4.14.119-1.mga6-1-1.mga6.i586.rpm
kernel-tmb-desktop-devel-latest-4.14.119-1.mga6.i586.rpm
kernel-tmb-desktop-latest-4.14.119-1.mga6.i586.rpm
kernel-tmb-source-4.14.119-1.mga6-1-1.mga6.noarch.rpm
kernel-tmb-source-latest-4.14.119-1.mga6.noarch.rpm


x86_64:
kernel-tmb-desktop-4.14.119-1.mga6-1-1.mga6.x86_64.rpm
kernel-tmb-desktop-devel-4.14.119-1.mga6-1-1.mga6.x86_64.rpm
kernel-tmb-desktop-devel-latest-4.14.119-1.mga6.x86_64.rpm
kernel-tmb-desktop-latest-4.14.119-1.mga6.x86_64.rpm
kernel-tmb-source-4.14.119-1.mga6-1-1.mga6.noarch.rpm
kernel-tmb-source-latest-4.14.119-1.mga6.noarch.rpm

Summary: Update request: kernel-tmb-4.14.116-1.mga6 => Update request: kernel-tmb-4.14.119-1.mga6

Addendum to advisory:

  This update adds the kernel side mitigations for the Microarchitectural
  Data Sampling (MDS, also called ZombieLoad attack) vulnerabilities in
  Intel processors that can allow attackers to retrieve data being processed
  inside a CPU. To complete the mitigations new microcode is also needed,
  either by installing the microcode-0.20190514-1.mga6 package, or get an
  updated bios / uefi firmware from the motherboard vendor.

  The fixed / mitigated issues are:

  Modern Intel microprocessors implement hardware-level micro-optimizations
  to improve the performance of writing data back to CPU caches. The write
  operation is split into STA (STore Address) and STD (STore Data)
  sub-operations. These sub-operations allow the processor to hand-off
  address generation logic into these sub-operations for optimized writes.
  Both of these sub-operations write to a shared distributed processor
  structure called the 'processor store buffer'. As a result, an
  unprivileged attacker could use this flaw to read private data resident
  within the CPU's processor store buffer. (CVE-2018-12126)

  Microprocessors use a ‘load port’ subcomponent to perform load operations
  from memory or IO. During a load operation, the load port receives data
  from the memory or IO subsystem and then provides the data to the CPU
  registers and operations in the CPU’s pipelines. Stale load operations
  results are stored in the 'load port' table until overwritten by newer
  operations. Certain load-port operations triggered by an attacker can be
  used to reveal data about previous stale requests leaking data back to the
  attacker via a timing side-channel. (CVE-2018-12127)

  A flaw was found in the implementation of the "fill buffer", a mechanism
  used by modern CPUs when a cache-miss is made on L1 CPU cache. If an
  attacker can generate a load operation that would create a page fault,
  the execution will continue speculatively with incorrect data from the
  fill buffer while the data is fetched from higher level caches. This
  response time can be measured to infer data in the fill buffer.
  (CVE-2018-12130)

  Uncacheable memory on some microprocessors utilizing speculative execution
  may allow an authenticated user to potentially enable information disclosure
  via a side channel with local access. (CVE-2019-11091)

references:
- https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html

mga6, x86_64, after microcode update
Intel Core i7-4790 (-HT-MCP-)
NVIDIA GM204 [GeForce GTX 970] : nvidia 390.87

Installed and rebooted.  Removed 2 GB of old kernel modules.
Mate desktop  working as usual.  Ran stress tests.  All good so far.

Replying to comment 7: 
Bluetooth went haywire for a while.  Normally it works out of the box but this time the BT device had to be removed and setup again.  Working now.

mga6, x86_64
Intel Core i9-7900X (-HT-MCP-)
NVIDIA GP102 [GeForce GTX 1080 Ti] : nvidia 390.87

Working desktop.  stress tests ran OK.

Enough tests, flushing it out

Whiteboard: (none) => MGA6-64-OK
Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0171.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED