Security update for xen SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:3490-1 Final 1 1 2018-10-26T11:09:27Z current 2018-10-26T11:09:27Z 2018-10-26T11:09:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xen This update for xen fixes the following issues: XEN was updated to the Xen 4.9.3 bug fix only release (bsc#1027519) - CVE-2018-17963: qemu_deliver_packet_iov accepted packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. (bsc#1111014) - CVE-2018-15470: oxenstored might not have enforced the configured quota-maxentity. This allowed a malicious or buggy guest to write as many xenstore entries as it wishes, causing unbounded memory usage in oxenstored. This can lead to a system-wide DoS. (XSA-272) (bsc#1103279) - CVE-2018-15469: ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest can still request v2 grant tables; they will simply not be properly set up, resulting in subsequent grant-related hypercalls hitting BUG() checks. An unprivileged guest can cause a BUG() check in the hypervisor, resulting in a denial-of-service (crash). (XSA-268) (bsc#1103275) Note that SUSE does not ship ARM Xen, so we are not affected. - CVE-2018-15468: The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) can lock up the entire host, causing a Denial of Service. (XSA-269) (bsc#1103276) - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis. (XSA-273) (bsc#1091107) Non security issues fixed: - The affinity reporting via 'xl vcpu-list' was broken (bsc#1106263) - Kernel oops in fs/dcache.c called by d_materialise_unique() (bsc#1094508) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP3-2018-2492,SUSE-SLE-SDK-12-SP3-2018-2492,SUSE-SLE-SERVER-12-SP3-2018-2492 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20183490-1/ Link for SUSE-SU-2018:3490-1 https://lists.suse.com/pipermail/sle-security-updates/2018-October/004800.html E-Mail link for SUSE-SU-2018:3490-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1027519 SUSE Bug 1027519 https://bugzilla.suse.com/1078292 SUSE Bug 1078292 https://bugzilla.suse.com/1091107 SUSE Bug 1091107 https://bugzilla.suse.com/1094508 SUSE Bug 1094508 https://bugzilla.suse.com/1103275 SUSE Bug 1103275 https://bugzilla.suse.com/1103276 SUSE Bug 1103276 https://bugzilla.suse.com/1103279 SUSE Bug 1103279 https://bugzilla.suse.com/1106263 SUSE Bug 1106263 https://bugzilla.suse.com/1111014 SUSE Bug 1111014 https://www.suse.com/security/cve/CVE-2018-15468/ SUSE CVE CVE-2018-15468 page https://www.suse.com/security/cve/CVE-2018-15469/ SUSE CVE CVE-2018-15469 page https://www.suse.com/security/cve/CVE-2018-15470/ SUSE CVE CVE-2018-15470 page https://www.suse.com/security/cve/CVE-2018-17963/ SUSE CVE CVE-2018-17963 page https://www.suse.com/security/cve/CVE-2018-3646/ SUSE CVE CVE-2018-3646 page SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 xen-4.9.3_03-3.44.2 xen-libs-4.9.3_03-3.44.2 xen-libs-32bit-4.9.3_03-3.44.2 xen-devel-4.9.3_03-3.44.2 xen-doc-html-4.9.3_03-3.44.2 xen-tools-4.9.3_03-3.44.2 xen-tools-domU-4.9.3_03-3.44.2 xen-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 xen-libs-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 xen-libs-32bit-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 xen-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Server 12 SP3 xen-doc-html-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Server 12 SP3 xen-libs-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Server 12 SP3 xen-libs-32bit-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Server 12 SP3 xen-tools-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Server 12 SP3 xen-tools-domU-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Server 12 SP3 xen-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 xen-doc-html-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 xen-libs-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 xen-libs-32bit-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 xen-tools-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 xen-tools-domU-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 xen-devel-4.9.3_03-3.44.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) can lock up the entire host, causing a Denial of Service. CVE-2018-15468 SUSE Linux Enterprise Desktop 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Desktop 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Desktop 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-doc-html-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-tools-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-tools-domU-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-doc-html-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-tools-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-tools-domU-4.9.3_03-3.44.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xen-devel-4.9.3_03-3.44.2 moderate 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183490-1/ https://www.suse.com/security/cve/CVE-2018-15468.html CVE-2018-15468 https://bugzilla.suse.com/1103276 SUSE Bug 1103276 An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest can still request v2 grant tables; they will simply not be properly set up, resulting in subsequent grant-related hypercalls hitting BUG() checks. An unprivileged guest can cause a BUG() check in the hypervisor, resulting in a denial-of-service (crash). CVE-2018-15469 SUSE Linux Enterprise Desktop 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Desktop 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Desktop 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-doc-html-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-tools-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-tools-domU-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-doc-html-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-tools-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-tools-domU-4.9.3_03-3.44.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xen-devel-4.9.3_03-3.44.2 important 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183490-1/ https://www.suse.com/security/cve/CVE-2018-15469.html CVE-2018-15469 https://bugzilla.suse.com/1103275 SUSE Bug 1103275 An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of evaluation of expressions making up a tuple. As indicated in section 7.7.3 "Operations on data structures" of the OCaml manual, the order of evaluation of subexpressions is not specified. In practice, different implementations behave differently. Thus, oxenstored may not enforce the configured quota-maxentity. This allows a malicious or buggy guest to write as many xenstore entries as it wishes, causing unbounded memory usage in oxenstored. This can lead to a system-wide DoS. CVE-2018-15470 SUSE Linux Enterprise Desktop 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Desktop 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Desktop 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-doc-html-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-tools-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-tools-domU-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-doc-html-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-tools-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-tools-domU-4.9.3_03-3.44.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xen-devel-4.9.3_03-3.44.2 important 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183490-1/ https://www.suse.com/security/cve/CVE-2018-15470.html CVE-2018-15470 https://bugzilla.suse.com/1103279 SUSE Bug 1103279 qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. CVE-2018-17963 SUSE Linux Enterprise Desktop 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Desktop 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Desktop 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-doc-html-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-tools-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-tools-domU-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-doc-html-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-tools-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-tools-domU-4.9.3_03-3.44.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xen-devel-4.9.3_03-3.44.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183490-1/ https://www.suse.com/security/cve/CVE-2018-17963.html CVE-2018-17963 https://bugzilla.suse.com/1111013 SUSE Bug 1111013 https://bugzilla.suse.com/1111014 SUSE Bug 1111014 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis. CVE-2018-3646 SUSE Linux Enterprise Desktop 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Desktop 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Desktop 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-doc-html-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-tools-4.9.3_03-3.44.2 SUSE Linux Enterprise Server 12 SP3:xen-tools-domU-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-doc-html-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-libs-32bit-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-libs-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-tools-4.9.3_03-3.44.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xen-tools-domU-4.9.3_03-3.44.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xen-devel-4.9.3_03-3.44.2 important 4.7 AV:L/AC:M/Au:N/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183490-1/ https://www.suse.com/security/cve/CVE-2018-3646.html CVE-2018-3646 https://bugzilla.suse.com/1087078 SUSE Bug 1087078 https://bugzilla.suse.com/1087081 SUSE Bug 1087081 https://bugzilla.suse.com/1089343 SUSE Bug 1089343 https://bugzilla.suse.com/1091107 SUSE Bug 1091107 https://bugzilla.suse.com/1099306 SUSE Bug 1099306 https://bugzilla.suse.com/1104365 SUSE Bug 1104365 https://bugzilla.suse.com/1104894 SUSE Bug 1104894 https://bugzilla.suse.com/1106548 SUSE Bug 1106548 https://bugzilla.suse.com/1113534 SUSE Bug 1113534 https://bugzilla.suse.com/1136865 SUSE Bug 1136865 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 https://bugzilla.suse.com/1201877 SUSE Bug 1201877