Recommended update for xen SUSE Patch security@suse.de SUSE Security Team SUSE-RU-2019:2715-1 Final 1 1 2019-10-18T14:21:34Z current 2019-10-18T14:21:34Z 2019-10-18T14:21:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Recommended update for xen This update for xen to version 4.12.1 fixes the following issues: - Fixed an issue which made Xen crash on AMD ROME based machines (bsc#1135799). - Xenpvnetboot is now ported correctly to Python 3 (bsc#1138563). - Added code to change LIBXL_HOTPLUG_TIMEOUT at runtime (bsc#1120095). The included README has details about the impact of this change - Fixed an issue where the speculative mitigation facilities reported wrong status (bsc#1143563). - Fixed an issue where Xen could not connect socket to /var/run/libvirt/libvirt-sock (bsc#1137471). - Fixed an HPS bug which did not allow to install Windows Server 2016 with 2 CPUs setting or above (bsc#1137717). - Fixed a segmentation fault in Libvrtd during live migration to a VM (bsc#1145774). - LTO is now disabled (bsc#1133296). - Fixed an issue where Xen could not pre-allocate 1 shadow page (bsc#1145240). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-2715,SUSE-SLE-Module-Basesystem-15-SP1-2019-2715,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-2715,SUSE-SLE-Module-Server-Applications-15-SP1-2019-2715 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/-2019-2715/suse-ru-20192715-1/ Link for SUSE-RU-2019:2715-1 https://lists.suse.com/pipermail/sle-updates/2019-October/012780.html E-Mail link for SUSE-RU-2019:2715-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1027519 SUSE Bug 1027519 https://bugzilla.suse.com/1111331 SUSE Bug 1111331 https://bugzilla.suse.com/1120095 SUSE Bug 1120095 https://bugzilla.suse.com/1133296 SUSE Bug 1133296 https://bugzilla.suse.com/1135799 SUSE Bug 1135799 https://bugzilla.suse.com/1137471 SUSE Bug 1137471 https://bugzilla.suse.com/1137717 SUSE Bug 1137717 https://bugzilla.suse.com/1138294 SUSE Bug 1138294 https://bugzilla.suse.com/1138563 SUSE Bug 1138563 https://bugzilla.suse.com/1143563 SUSE Bug 1143563 https://bugzilla.suse.com/1145240 SUSE Bug 1145240 https://bugzilla.suse.com/1145774 SUSE Bug 1145774 https://www.suse.com/security/cve/CVE-2018-12126/ SUSE CVE CVE-2018-12126 page https://www.suse.com/security/cve/CVE-2018-12127/ SUSE CVE CVE-2018-12127 page https://www.suse.com/security/cve/CVE-2018-12130/ SUSE CVE CVE-2018-12130 page https://www.suse.com/security/cve/CVE-2019-11091/ SUSE CVE CVE-2019-11091 page https://www.suse.com/security/cve/CVE-2019-17349/ SUSE CVE CVE-2019-17349 page https://www.suse.com/security/cve/CVE-2019-17350/ SUSE CVE CVE-2019-17350 page SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 xen-4.12.1_02-3.3.1 xen-devel-4.12.1_02-3.3.1 xen-doc-html-4.12.1_02-3.3.1 xen-libs-4.12.1_02-3.3.1 xen-libs-32bit-4.12.1_02-3.3.1 xen-libs-64bit-4.12.1_02-3.3.1 xen-tools-4.12.1_02-3.3.1 xen-tools-domU-4.12.1_02-3.3.1 xen-libs-4.12.1_02-3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 xen-tools-domU-4.12.1_02-3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 xen-4.12.1_02-3.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 xen-devel-4.12.1_02-3.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 xen-tools-4.12.1_02-3.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf CVE-2018-12126 SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-libs-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-tools-domU-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-devel-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-tools-4.12.1_02-3.3.1 important 4.7 AV:L/AC:M/Au:N/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/-2019-2715/suse-ru-20192715-1/ https://www.suse.com/security/cve/CVE-2018-12126.html CVE-2018-12126 https://bugzilla.suse.com/1103186 SUSE Bug 1103186 https://bugzilla.suse.com/1111331 SUSE Bug 1111331 https://bugzilla.suse.com/1132686 SUSE Bug 1132686 https://bugzilla.suse.com/1135409 SUSE Bug 1135409 https://bugzilla.suse.com/1135524 SUSE Bug 1135524 https://bugzilla.suse.com/1137916 SUSE Bug 1137916 https://bugzilla.suse.com/1138534 SUSE Bug 1138534 https://bugzilla.suse.com/1141977 SUSE Bug 1141977 https://bugzilla.suse.com/1149725 SUSE Bug 1149725 https://bugzilla.suse.com/1149726 SUSE Bug 1149726 https://bugzilla.suse.com/1149729 SUSE Bug 1149729 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 https://bugzilla.suse.com/1201877 SUSE Bug 1201877 Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf CVE-2018-12127 SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-libs-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-tools-domU-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-devel-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-tools-4.12.1_02-3.3.1 important 4.7 AV:L/AC:M/Au:N/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/-2019-2715/suse-ru-20192715-1/ https://www.suse.com/security/cve/CVE-2018-12127.html CVE-2018-12127 https://bugzilla.suse.com/1103186 SUSE Bug 1103186 https://bugzilla.suse.com/1111331 SUSE Bug 1111331 https://bugzilla.suse.com/1132686 SUSE Bug 1132686 https://bugzilla.suse.com/1135409 SUSE Bug 1135409 https://bugzilla.suse.com/1138534 SUSE Bug 1138534 https://bugzilla.suse.com/1141977 SUSE Bug 1141977 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 https://bugzilla.suse.com/1201877 SUSE Bug 1201877 Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf CVE-2018-12130 SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-libs-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-tools-domU-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-devel-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-tools-4.12.1_02-3.3.1 important 4.7 AV:L/AC:M/Au:N/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/-2019-2715/suse-ru-20192715-1/ https://www.suse.com/security/cve/CVE-2018-12130.html CVE-2018-12130 https://bugzilla.suse.com/1103186 SUSE Bug 1103186 https://bugzilla.suse.com/1111331 SUSE Bug 1111331 https://bugzilla.suse.com/1132686 SUSE Bug 1132686 https://bugzilla.suse.com/1135409 SUSE Bug 1135409 https://bugzilla.suse.com/1137916 SUSE Bug 1137916 https://bugzilla.suse.com/1138534 SUSE Bug 1138534 https://bugzilla.suse.com/1141977 SUSE Bug 1141977 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 https://bugzilla.suse.com/1201877 SUSE Bug 1201877 Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf CVE-2019-11091 SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-libs-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-tools-domU-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-devel-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-tools-4.12.1_02-3.3.1 important 4.7 AV:L/AC:M/Au:N/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/-2019-2715/suse-ru-20192715-1/ https://www.suse.com/security/cve/CVE-2019-11091.html CVE-2019-11091 https://bugzilla.suse.com/1103186 SUSE Bug 1103186 https://bugzilla.suse.com/1111331 SUSE Bug 1111331 https://bugzilla.suse.com/1132686 SUSE Bug 1132686 https://bugzilla.suse.com/1133319 SUSE Bug 1133319 https://bugzilla.suse.com/1135394 SUSE Bug 1135394 https://bugzilla.suse.com/1138043 SUSE Bug 1138043 https://bugzilla.suse.com/1138534 SUSE Bug 1138534 https://bugzilla.suse.com/1141977 SUSE Bug 1141977 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 https://bugzilla.suse.com/1201877 SUSE Bug 1201877 An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl or StoreExcl operation. CVE-2019-17349 SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-libs-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-tools-domU-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-devel-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-tools-4.12.1_02-3.3.1 important 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/-2019-2715/suse-ru-20192715-1/ https://www.suse.com/security/cve/CVE-2019-17349.html CVE-2019-17349 https://bugzilla.suse.com/1138294 SUSE Bug 1138294 An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a compare-and-exchange operation. CVE-2019-17350 SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-libs-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:xen-tools-domU-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-devel-4.12.1_02-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:xen-tools-4.12.1_02-3.3.1 important 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/-2019-2715/suse-ru-20192715-1/ https://www.suse.com/security/cve/CVE-2019-17350.html CVE-2019-17350 https://bugzilla.suse.com/1138294 SUSE Bug 1138294