[Cucumber-linux-security] linux (security update is available)

[Scott C. <sc...@cu...>]

  Update Information

A security update is available for linux for the following versions of
Cucumber Linux:

  * 1.0
  * 1.1

Here are the details from the Cucumber 1.1 changelog:

+----------------+
Tue May 22 18:45:35 EDT 2018
base/linux upgraded from 4.9.101 to 4.9.102 to enable the ability mitigate
	against Spectre Variant 4 (CVE-2018-3639) when Intel releases the
	microcode update. This update DOES NOT PATCH THE VULNERABILITY; rather,
	it enables it to be patched with a microcode update. Mitigating against
	this vulnerability will require using both an updated kernel and updated
	CPU microcode.

	This is a hardware vulnerability in Intel's x86 architecture (both the
	i686 and x86_64 variants) that allows for for an attacker to learn the
	contents of memory that is not supposed to be accessible to him. Intel
	has stated that this vulnerability "may allow unauthorized disclosure of
	information to an attacker with local user access," which means it
	likely does. For more information see:
		https://security.cucumberlinux.com/security/details.php?id=411
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3639
		https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.102
		https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.html
		https://www.intel.com/content/www/us/en/architecture-and-technology/facts-about-side-channel-analysis-and-intel-products.html
		https://software.intel.com/sites/default/files/managed/b9/f9/336983-Intel-Analysis-of-Speculative-Execution-Side-Channels-White-Paper.pdf
kernel/linux-source upgraded from 4.9.101 to 4.9.102
* SECURITY FIX *
+----------------+

------------------------------------------------------------------------


  CLD and CVE Information

This update is associated with the following Cucumber Linux Deficiency
(CLD) and CVE numbers:

  * CLD-411 [CVE-2018-3639]
    (https://security.cucumberlinux.com/security/details.php?id=411)

More information about these CLDs can be found at their respective pages
on the Cucumber Linux Security Advisory Tracker (these are the URLs in
parenthesis above).

------------------------------------------------------------------------


  Installing the Update

The updated package can be installed via Pickle by running the following
commands (as root):

# pickle --update
# pickle

Make sure linux is selected on the update list, and then select Ok.
Pickle will then install the updated package.

If you prefer to download the updated package manually, it can be found
on the mirror at http://mirror.cucumberlinux.com/cucumber/.

------------------------------------------------------------------------
The Cucumber Linux Security Team
cuc...@li...
<mailto:cuc...@li...>
https://www.cucumberlinux.com/security.php