Security update for xen SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0701-1 Final 1 1 2015-04-01T15:24:09Z current 2015-04-01T15:24:09Z 2015-04-01T15:24:09Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xen Xen was updated 4.4.2_01 to address three security issues and functional bugs. The following vulnerabilities were fixed: - Long latency MMIO mapping operations are not preemptible (XSA-125, CVE-2015-2752, bnc#922705) - Unmediated PCI command register access in qemu (XSA-126, CVE-2015-2756, bnc#922706) - Certain domctl operations may be abused to lock up the host (XSA-127, CVE-2015-2751, bnc#922709) The following non-security bugs were fixed: - xen dmesg contains bogus output in early boot (bnc#923758) - Xentop doesn't display disk statistics for VMs using qdisks (bnc#921842) The following functionality was enabled: - Enable spice support in qemu for x86_64 - Add Qxl vga support The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-162,SUSE-SLE-SDK-12-2015-162,SUSE-SLE-SERVER-12-2015-162 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150701-1/ Link for SUSE-SU-2015:0701-1 https://lists.suse.com/pipermail/sle-security-updates/2015-April/001342.html E-Mail link for SUSE-SU-2015:0701-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/921842 SUSE Bug 921842 https://bugzilla.suse.com/922705 SUSE Bug 922705 https://bugzilla.suse.com/922706 SUSE Bug 922706 https://bugzilla.suse.com/922709 SUSE Bug 922709 https://bugzilla.suse.com/923758 SUSE Bug 923758 https://www.suse.com/security/cve/CVE-2015-2751/ SUSE CVE CVE-2015-2751 page https://www.suse.com/security/cve/CVE-2015-2752/ SUSE CVE CVE-2015-2752 page https://www.suse.com/security/cve/CVE-2015-2756/ SUSE CVE CVE-2015-2756 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Software Development Kit 12 xen-4.4.2_02-15.1 xen-kmp-default-4.4.2_02_k3.12.38_44-15.1 xen-libs-4.4.2_02-15.1 xen-libs-32bit-4.4.2_02-15.1 xen-devel-4.4.2_02-15.1 xen-doc-html-4.4.2_02-15.1 xen-tools-4.4.2_02-15.1 xen-tools-domU-4.4.2_02-15.1 xen-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Desktop 12 xen-kmp-default-4.4.2_02_k3.12.38_44-15.1 as a component of SUSE Linux Enterprise Desktop 12 xen-libs-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Desktop 12 xen-libs-32bit-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Desktop 12 xen-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Server 12 xen-doc-html-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Server 12 xen-kmp-default-4.4.2_02_k3.12.38_44-15.1 as a component of SUSE Linux Enterprise Server 12 xen-libs-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Server 12 xen-libs-32bit-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Server 12 xen-tools-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Server 12 xen-tools-domU-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Server 12 xen-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-doc-html-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-kmp-default-4.4.2_02_k3.12.38_44-15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-libs-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-libs-32bit-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-tools-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-tools-domU-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 xen-devel-4.4.2_02-15.1 as a component of SUSE Linux Enterprise Software Development Kit 12 Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations. CVE-2015-2751 SUSE Linux Enterprise Desktop 12:xen-4.4.2_02-15.1 SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.2_02_k3.12.38_44-15.1 SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.2_02-15.1 SUSE Linux Enterprise Desktop 12:xen-libs-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-doc-html-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.2_02_k3.12.38_44-15.1 SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-libs-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-tools-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.2_02_k3.12.38_44-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.2_02-15.1 SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.2_02-15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150701-1/ https://www.suse.com/security/cve/CVE-2015-2751.html CVE-2015-2751 https://bugzilla.suse.com/922709 SUSE Bug 922709 https://bugzilla.suse.com/950367 SUSE Bug 950367 The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm). CVE-2015-2752 SUSE Linux Enterprise Desktop 12:xen-4.4.2_02-15.1 SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.2_02_k3.12.38_44-15.1 SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.2_02-15.1 SUSE Linux Enterprise Desktop 12:xen-libs-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-doc-html-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.2_02_k3.12.38_44-15.1 SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-libs-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-tools-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.2_02_k3.12.38_44-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.2_02-15.1 SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.2_02-15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150701-1/ https://www.suse.com/security/cve/CVE-2015-2752.html CVE-2015-2752 https://bugzilla.suse.com/922705 SUSE Bug 922705 QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response. CVE-2015-2756 SUSE Linux Enterprise Desktop 12:xen-4.4.2_02-15.1 SUSE Linux Enterprise Desktop 12:xen-kmp-default-4.4.2_02_k3.12.38_44-15.1 SUSE Linux Enterprise Desktop 12:xen-libs-32bit-4.4.2_02-15.1 SUSE Linux Enterprise Desktop 12:xen-libs-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-doc-html-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-kmp-default-4.4.2_02_k3.12.38_44-15.1 SUSE Linux Enterprise Server 12:xen-libs-32bit-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-libs-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-tools-4.4.2_02-15.1 SUSE Linux Enterprise Server 12:xen-tools-domU-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-doc-html-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-kmp-default-4.4.2_02_k3.12.38_44-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-32bit-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-libs-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-4.4.2_02-15.1 SUSE Linux Enterprise Server for SAP Applications 12:xen-tools-domU-4.4.2_02-15.1 SUSE Linux Enterprise Software Development Kit 12:xen-devel-4.4.2_02-15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150701-1/ https://www.suse.com/security/cve/CVE-2015-2756.html CVE-2015-2756 https://bugzilla.suse.com/922706 SUSE Bug 922706