Critical Security Update: s390-tools Now Supports 4K RSA Secure Boot Keys

 

Critical SUSE Linux update introduces 4K RSA secure boot keys for s390-tools, enhancing IBM Z security. Learn installation steps, affected packages, and why enterprises should patch now.

Last Updated: May 21, 2025
Severity: Moderate
Affected Systems:

• openSUSE Leap 15.3

• SUSE Linux Enterprise Micro 5.1/5.2

• SUSE Linux Enterprise Micro for Rancher 5.2

• SUSE Linux Enterprise Server 15 SP3 (Including LTSS)

Why This Update Matters for Enterprise Security

A newly released patch for s390-tools introduces 4K RSA secure boot key support, enhancing cryptographic security for IBM Z and LinuxONE systems. 

This update ensures compliance with modern security standards, reducing risks associated with legacy encryption methods.

Key Benefits of the Update

✔ Stronger Encryption: 4K RSA keys provide enhanced protection against brute-force attacks.

✔ Secure Boot Integrity: Prevents unauthorized firmware modifications.

✔ Compatibility: Maintains backward compatibility with existing systems.

How to Install the Update

Recommended Methods:

• YaST Online Update (GUI)

• zypper patch (CLI)

Product-Specific Commands:

bash

Copy

Download

# openSUSE Leap 15.3  
zypper in -t patch SUSE-2025-1637=1  

# SUSE Linux Enterprise Server 15 SP3 LTSS  
zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2025-1637=1  

# SUSE Linux Enterprise Micro 5.1/5.2  
zypper in -t patch SUSE-SUSE-MicroOS-5.1-2025-1637=1  
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2025-1637=1  

Affected Packages (s390x Architecture)

Package	Version
libekmfweb1	2.15.1-150300.8.35.1
s390-tools	2.15.1-150300.8.35.1
osasnmpd	2.15.1-150300.8.35.1
s390-tools-zdsfs	2.15.1-150300.8.35.1

(Full package list available in the SUSE Security Portal)

Frequently Asked Questions (FAQ)

Q: Is this update mandatory?

A: While rated moderate, applying it is recommended for systems requiring FIPS compliance.

Q: Does this impact performance?

A: Minimal overhead; the security benefits outweigh any minor latency.

Q: Can I revert if issues arise?

A: Yes, using zypper rollback, but this is not advised due to security implications.