Security update for xen SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:14201-1 Final 1 1 2019-10-25T12:28:21Z current 2019-10-25T12:28:21Z 2019-10-25T12:28:21Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xen This update for xen fixes the following issues: - CVE-2019-15890: Fixed a use-after-free in SLiRP networking implementation of QEMU emulator which could have led to Denial of Service (bsc#1149813). - CVE-2019-12068: Fixed an issue in lsi which could lead to an infinite loop and denial of service (bsc#1146874). - CVE-2019-14378: Fixed a heap buffer overflow in SLiRp networking implementation of QEMU emulator which could have led to execution of arbitrary code with privileges of the QEMU process (bsc#1143797). - CVE-2019-12067: Fixed a null pointer dereference which could have led to denial of service (bsc#1145652). - CVE-2019-12155: Fixed a null pointer dereference in QXL VGA card emulator of QEMU which could have led to denial of service (bsc#1135905). - CVE-2018-20815: Fixed a heap buffer overflow while loading device tree blob (bsc#1130680). - CVE-2017-10806: Fixed a stack buffer overflow in debug logging (bsc#1047675). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleposp3-xen-14201 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-201914201-1/ Link for SUSE-SU-2019:14201-1 https://lists.suse.com/pipermail/sle-security-updates/2019-October/006057.html E-Mail link for SUSE-SU-2019:14201-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1047675 SUSE Bug 1047675 https://bugzilla.suse.com/1126140 SUSE Bug 1126140 https://bugzilla.suse.com/1126141 SUSE Bug 1126141 https://bugzilla.suse.com/1126192 SUSE Bug 1126192 https://bugzilla.suse.com/1126195 SUSE Bug 1126195 https://bugzilla.suse.com/1126196 SUSE Bug 1126196 https://bugzilla.suse.com/1130680 SUSE Bug 1130680 https://bugzilla.suse.com/1135905 SUSE Bug 1135905 https://bugzilla.suse.com/1143797 SUSE Bug 1143797 https://bugzilla.suse.com/1145652 SUSE Bug 1145652 https://bugzilla.suse.com/1146874 SUSE Bug 1146874 https://bugzilla.suse.com/1149813 SUSE Bug 1149813 https://www.suse.com/security/cve/CVE-2017-10806/ SUSE CVE CVE-2017-10806 page https://www.suse.com/security/cve/CVE-2018-20815/ SUSE CVE CVE-2018-20815 page https://www.suse.com/security/cve/CVE-2019-12067/ SUSE CVE CVE-2019-12067 page https://www.suse.com/security/cve/CVE-2019-12068/ SUSE CVE CVE-2019-12068 page https://www.suse.com/security/cve/CVE-2019-12155/ SUSE CVE CVE-2019-12155 page https://www.suse.com/security/cve/CVE-2019-14378/ SUSE CVE CVE-2019-14378 page https://www.suse.com/security/cve/CVE-2019-15890/ SUSE CVE CVE-2019-15890 page https://www.suse.com/security/cve/CVE-2019-17340/ SUSE CVE CVE-2019-17340 page https://www.suse.com/security/cve/CVE-2019-17341/ SUSE CVE CVE-2019-17341 page https://www.suse.com/security/cve/CVE-2019-17342/ SUSE CVE CVE-2019-17342 page https://www.suse.com/security/cve/CVE-2019-17343/ SUSE CVE CVE-2019-17343 page https://www.suse.com/security/cve/CVE-2019-17344/ SUSE CVE CVE-2019-17344 page SUSE Linux Enterprise Point of Sale 11 SP3 xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 xen-libs-4.2.5_21-45.33.1 xen-tools-domU-4.2.5_21-45.33.1 xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 xen-libs-4.2.5_21-45.33.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 xen-tools-domU-4.2.5_21-45.33.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages. CVE-2017-10806 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.33.1 moderate 4 AV:L/AC:H/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914201-1/ https://www.suse.com/security/cve/CVE-2017-10806.html CVE-2017-10806 https://bugzilla.suse.com/1047674 SUSE Bug 1047674 https://bugzilla.suse.com/1047675 SUSE Bug 1047675 In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk. CVE-2018-20815 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.33.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914201-1/ https://www.suse.com/security/cve/CVE-2018-20815.html CVE-2018-20815 https://bugzilla.suse.com/1118900 SUSE Bug 1118900 https://bugzilla.suse.com/1130675 SUSE Bug 1130675 https://bugzilla.suse.com/1130680 SUSE Bug 1130680 https://bugzilla.suse.com/1138043 SUSE Bug 1138043 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is null. CVE-2019-12067 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.33.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914201-1/ https://www.suse.com/security/cve/CVE-2019-12067.html CVE-2019-12067 https://bugzilla.suse.com/1145642 SUSE Bug 1145642 https://bugzilla.suse.com/1145652 SUSE Bug 1145652 In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well. CVE-2019-12068 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.33.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914201-1/ https://www.suse.com/security/cve/CVE-2019-12068.html CVE-2019-12068 https://bugzilla.suse.com/1146873 SUSE Bug 1146873 https://bugzilla.suse.com/1146874 SUSE Bug 1146874 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference. CVE-2019-12155 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.33.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914201-1/ https://www.suse.com/security/cve/CVE-2019-12155.html CVE-2019-12155 https://bugzilla.suse.com/1135902 SUSE Bug 1135902 https://bugzilla.suse.com/1135905 SUSE Bug 1135905 ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment. CVE-2019-14378 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.33.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914201-1/ https://www.suse.com/security/cve/CVE-2019-14378.html CVE-2019-14378 https://bugzilla.suse.com/1143794 SUSE Bug 1143794 https://bugzilla.suse.com/1143797 SUSE Bug 1143797 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. CVE-2019-15890 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.33.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914201-1/ https://www.suse.com/security/cve/CVE-2019-15890.html CVE-2019-15890 https://bugzilla.suse.com/1149811 SUSE Bug 1149811 https://bugzilla.suse.com/1149813 SUSE Bug 1149813 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or gain privileges because grant-table transfer requests are mishandled. CVE-2019-17340 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.33.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914201-1/ https://www.suse.com/security/cve/CVE-2019-17340.html CVE-2019-17340 https://bugzilla.suse.com/1126140 SUSE Bug 1126140 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI device. CVE-2019-17341 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.33.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914201-1/ https://www.suse.com/security/cve/CVE-2019-17341.html CVE-2019-17341 https://bugzilla.suse.com/1126141 SUSE Bug 1126141 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a race condition that arose when XENMEM_exchange was introduced. CVE-2019-17342 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.33.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914201-1/ https://www.suse.com/security/cve/CVE-2019-17342.html CVE-2019-17342 https://bugzilla.suse.com/1126192 SUSE Bug 1126192 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains. CVE-2019-17343 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.33.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914201-1/ https://www.suse.com/security/cve/CVE-2019-17343.html CVE-2019-17343 https://bugzilla.suse.com/1126195 SUSE Bug 1126195 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running operation that exists to support restartability of PTE updates. CVE-2019-17344 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.59-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.33.1 SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.33.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914201-1/ https://www.suse.com/security/cve/CVE-2019-17344.html CVE-2019-17344 https://bugzilla.suse.com/1126196 SUSE Bug 1126196 https://bugzilla.suse.com/1178658 SUSE Bug 1178658