Security update for xen SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:0459-1 Final 1 1 2018-02-16T07:01:35Z current 2018-02-16T07:01:35Z 2018-02-16T07:01:35Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xen This update for xen fixes several issues. These security issues were fixed: - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka 'Spectre' and 'Meltdown' attacks (bsc#1074562, bsc#1068032) - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081) - CVE-2017-17566: Prevent PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page (bsc#1070158). - CVE-2017-17563: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode (bsc#1070159). - CVE-2017-17564: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode (bsc#1070160). - CVE-2017-17565: Prevent PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P (bsc#1070163). - CVE-2018-5683: The vga_draw_text function allowed local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation (bsc#1076116). - CVE-2017-18030: The cirrus_invalidate_region function allowed local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch (bsc#1076180). These non-security issues were fixed: - bsc#1067317: pass cache=writeback|unsafe|directsync to qemu depending on the libxl disk settings - bsc#1051729: Prevent invalid symlinks after install of SLES 12 SP2 - bsc#1035442: Increased the value of LIBXL_DESTROY_TIMEOUT from 10 to 100 seconds. If many domUs shutdown in parallel the backends couldn't keep up - bsc#1027519: Added several upstream patches This update was imported from the SUSE:SLE-12-SP3:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2018-02/msg00033.html E-Mail link for openSUSE-SU-2018:0459-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 xen-4.9.1_08-16.1 xen-devel-4.9.1_08-16.1 xen-doc-html-4.9.1_08-16.1 xen-libs-4.9.1_08-16.1 xen-tools-4.9.1_08-16.1 xen-tools-domU-4.9.1_08-16.1 xen-4.9.1_08-16.1 as a component of openSUSE Leap 42.3 xen-devel-4.9.1_08-16.1 as a component of openSUSE Leap 42.3 xen-doc-html-4.9.1_08-16.1 as a component of openSUSE Leap 42.3 xen-libs-4.9.1_08-16.1 as a component of openSUSE Leap 42.3 xen-tools-4.9.1_08-16.1 as a component of openSUSE Leap 42.3 xen-tools-domU-4.9.1_08-16.1 as a component of openSUSE Leap 42.3 An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking. CVE-2017-15595 openSUSE Leap 42.3:xen-4.9.1_08-16.1 openSUSE Leap 42.3:xen-devel-4.9.1_08-16.1 openSUSE Leap 42.3:xen-doc-html-4.9.1_08-16.1 openSUSE Leap 42.3:xen-libs-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-domU-4.9.1_08-16.1 moderate 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C 8.1 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-02/msg00033.html https://www.suse.com/security/cve/CVE-2017-15595.html CVE-2017-15595 https://bugzilla.suse.com/1061081 SUSE Bug 1061081 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode. CVE-2017-17563 openSUSE Leap 42.3:xen-4.9.1_08-16.1 openSUSE Leap 42.3:xen-devel-4.9.1_08-16.1 openSUSE Leap 42.3:xen-doc-html-4.9.1_08-16.1 openSUSE Leap 42.3:xen-libs-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-domU-4.9.1_08-16.1 moderate 4.9 AV:A/AC:M/Au:S/C:P/I:P/A:P 6.5 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-02/msg00033.html https://www.suse.com/security/cve/CVE-2017-17563.html CVE-2017-17563 https://bugzilla.suse.com/1070159 SUSE Bug 1070159 An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode. CVE-2017-17564 openSUSE Leap 42.3:xen-4.9.1_08-16.1 openSUSE Leap 42.3:xen-devel-4.9.1_08-16.1 openSUSE Leap 42.3:xen-doc-html-4.9.1_08-16.1 openSUSE Leap 42.3:xen-libs-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-domU-4.9.1_08-16.1 moderate 4.9 AV:A/AC:M/Au:S/C:P/I:P/A:P 6.5 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-02/msg00033.html https://www.suse.com/security/cve/CVE-2017-17564.html CVE-2017-17564 https://bugzilla.suse.com/1070160 SUSE Bug 1070160 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P. CVE-2017-17565 openSUSE Leap 42.3:xen-4.9.1_08-16.1 openSUSE Leap 42.3:xen-devel-4.9.1_08-16.1 openSUSE Leap 42.3:xen-doc-html-4.9.1_08-16.1 openSUSE Leap 42.3:xen-libs-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-domU-4.9.1_08-16.1 moderate 2.3 AV:A/AC:M/Au:S/C:N/I:N/A:P 4.1 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-02/msg00033.html https://www.suse.com/security/cve/CVE-2017-17565.html CVE-2017-17565 https://bugzilla.suse.com/1070163 SUSE Bug 1070163 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page. CVE-2017-17566 openSUSE Leap 42.3:xen-4.9.1_08-16.1 openSUSE Leap 42.3:xen-devel-4.9.1_08-16.1 openSUSE Leap 42.3:xen-doc-html-4.9.1_08-16.1 openSUSE Leap 42.3:xen-libs-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-domU-4.9.1_08-16.1 moderate 4.9 AV:A/AC:M/Au:S/C:P/I:P/A:P 6.5 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-02/msg00033.html https://www.suse.com/security/cve/CVE-2017-17566.html CVE-2017-17566 https://bugzilla.suse.com/1070158 SUSE Bug 1070158 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch. CVE-2017-18030 openSUSE Leap 42.3:xen-4.9.1_08-16.1 openSUSE Leap 42.3:xen-devel-4.9.1_08-16.1 openSUSE Leap 42.3:xen-doc-html-4.9.1_08-16.1 openSUSE Leap 42.3:xen-libs-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-domU-4.9.1_08-16.1 low 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P 2.8 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-02/msg00033.html https://www.suse.com/security/cve/CVE-2017-18030.html CVE-2017-18030 https://bugzilla.suse.com/1076179 SUSE Bug 1076179 https://bugzilla.suse.com/1076180 SUSE Bug 1076180 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. CVE-2017-5715 openSUSE Leap 42.3:xen-4.9.1_08-16.1 openSUSE Leap 42.3:xen-devel-4.9.1_08-16.1 openSUSE Leap 42.3:xen-doc-html-4.9.1_08-16.1 openSUSE Leap 42.3:xen-libs-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-domU-4.9.1_08-16.1 important 4.7 AV:L/AC:M/Au:N/C:C/I:N/A:N 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-02/msg00033.html https://www.suse.com/security/cve/CVE-2017-5715.html CVE-2017-5715 https://bugzilla.suse.com/1068032 SUSE Bug 1068032 https://bugzilla.suse.com/1074562 SUSE Bug 1074562 https://bugzilla.suse.com/1074578 SUSE Bug 1074578 https://bugzilla.suse.com/1074701 SUSE Bug 1074701 https://bugzilla.suse.com/1074741 SUSE Bug 1074741 https://bugzilla.suse.com/1074919 SUSE Bug 1074919 https://bugzilla.suse.com/1075006 SUSE Bug 1075006 https://bugzilla.suse.com/1075007 SUSE Bug 1075007 https://bugzilla.suse.com/1075262 SUSE Bug 1075262 https://bugzilla.suse.com/1075419 SUSE Bug 1075419 https://bugzilla.suse.com/1076115 SUSE Bug 1076115 https://bugzilla.suse.com/1076372 SUSE Bug 1076372 https://bugzilla.suse.com/1078353 SUSE Bug 1078353 https://bugzilla.suse.com/1080039 SUSE Bug 1080039 https://bugzilla.suse.com/1087939 SUSE Bug 1087939 https://bugzilla.suse.com/1091815 SUSE Bug 1091815 https://bugzilla.suse.com/1095735 SUSE Bug 1095735 https://bugzilla.suse.com/1102055 SUSE Bug 1102055 https://bugzilla.suse.com/1102517 SUSE Bug 1102517 https://bugzilla.suse.com/1105108 SUSE Bug 1105108 https://bugzilla.suse.com/1126516 SUSE Bug 1126516 https://bugzilla.suse.com/1173489 SUSE Bug 1173489 https://bugzilla.suse.com/1174161 SUSE Bug 1174161 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. CVE-2017-5753 openSUSE Leap 42.3:xen-4.9.1_08-16.1 openSUSE Leap 42.3:xen-devel-4.9.1_08-16.1 openSUSE Leap 42.3:xen-doc-html-4.9.1_08-16.1 openSUSE Leap 42.3:xen-libs-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-domU-4.9.1_08-16.1 important 4.9 AV:L/AC:L/Au:N/C:C/I:N/A:N 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-02/msg00033.html https://www.suse.com/security/cve/CVE-2017-5753.html CVE-2017-5753 https://bugzilla.suse.com/1068032 SUSE Bug 1068032 https://bugzilla.suse.com/1074562 SUSE Bug 1074562 https://bugzilla.suse.com/1074578 SUSE Bug 1074578 https://bugzilla.suse.com/1074701 SUSE Bug 1074701 https://bugzilla.suse.com/1075006 SUSE Bug 1075006 https://bugzilla.suse.com/1075419 SUSE Bug 1075419 https://bugzilla.suse.com/1075748 SUSE Bug 1075748 https://bugzilla.suse.com/1080039 SUSE Bug 1080039 https://bugzilla.suse.com/1087084 SUSE Bug 1087084 https://bugzilla.suse.com/1087939 SUSE Bug 1087939 https://bugzilla.suse.com/1102055 SUSE Bug 1102055 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. CVE-2017-5754 openSUSE Leap 42.3:xen-4.9.1_08-16.1 openSUSE Leap 42.3:xen-devel-4.9.1_08-16.1 openSUSE Leap 42.3:xen-doc-html-4.9.1_08-16.1 openSUSE Leap 42.3:xen-libs-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-domU-4.9.1_08-16.1 important 4.9 AV:L/AC:L/Au:N/C:C/I:N/A:N 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-02/msg00033.html https://www.suse.com/security/cve/CVE-2017-5754.html CVE-2017-5754 https://bugzilla.suse.com/1068032 SUSE Bug 1068032 https://bugzilla.suse.com/1074562 SUSE Bug 1074562 https://bugzilla.suse.com/1074578 SUSE Bug 1074578 https://bugzilla.suse.com/1074701 SUSE Bug 1074701 https://bugzilla.suse.com/1075006 SUSE Bug 1075006 https://bugzilla.suse.com/1075008 SUSE Bug 1075008 https://bugzilla.suse.com/1087939 SUSE Bug 1087939 https://bugzilla.suse.com/1102055 SUSE Bug 1102055 https://bugzilla.suse.com/1115045 SUSE Bug 1115045 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation. CVE-2018-5683 openSUSE Leap 42.3:xen-4.9.1_08-16.1 openSUSE Leap 42.3:xen-devel-4.9.1_08-16.1 openSUSE Leap 42.3:xen-doc-html-4.9.1_08-16.1 openSUSE Leap 42.3:xen-libs-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-4.9.1_08-16.1 openSUSE Leap 42.3:xen-tools-domU-4.9.1_08-16.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-02/msg00033.html https://www.suse.com/security/cve/CVE-2018-5683.html CVE-2018-5683 https://bugzilla.suse.com/1076114 SUSE Bug 1076114 https://bugzilla.suse.com/1076116 SUSE Bug 1076116 https://bugzilla.suse.com/1178658 SUSE Bug 1178658