Security update for xen SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:3412-1 Final 1 1 2020-11-19T11:45:04Z current 2020-11-19T11:45:04Z 2020-11-19T11:45:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xen This update for xen fixes the following issues: Security issue fixed: - CVE-2020-28368: Fixed the Intel RAPL sidechannel attack, aka PLATYPUS attack, aka XSA-351 (bsc#1178591). Non-security issues fixed: - Updated to Xen 4.13.2 bug fix release (bsc#1027519). - Fixed a panic during MSI cleanup on AMD hardware (bsc#1027519). - Adjusted help for --max_iters, default is 5 (bsc#1177950). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sles/15.2/virt-launcher:0.38.1-2020-3412,Image SLES15-SP2-Azure-Basic-2020-3412,Image SLES15-SP2-Azure-Standard-2020-3412,Image SLES15-SP2-BYOS-Azure-2020-3412,Image SLES15-SP2-BYOS-EC2-HVM-2020-3412,Image SLES15-SP2-BYOS-GCE-2020-3412,Image SLES15-SP2-CHOST-BYOS-Aliyun-2020-3412,Image SLES15-SP2-CHOST-BYOS-Azure-2020-3412,Image SLES15-SP2-CHOST-BYOS-EC2-2020-3412,Image SLES15-SP2-CHOST-BYOS-GCE-2020-3412,Image SLES15-SP2-EC2-ECS-HVM-2020-3412,Image SLES15-SP2-EC2-HVM-2020-3412,Image SLES15-SP2-GCE-2020-3412,Image SLES15-SP2-HPC-Azure-2020-3412,Image SLES15-SP2-HPC-BYOS-Azure-2020-3412,Image SLES15-SP2-HPC-BYOS-EC2-HVM-2020-3412,Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure-2020-3412,Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM-2020-3412,Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE-2020-3412,Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure-2020-3412,Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM-2020-3412,Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE-2020-3412,Image SLES15-SP2-SAP-Azure-2020-3412,Image SLES15-SP2-SAP-Azure-LI-BYOS-Production-2020-3412,Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production-2020-3412,Image SLES15-SP2-SAP-BYOS-Azure-2020-3412,Image SLES15-SP2-SAP-BYOS-EC2-HVM-2020-3412,Image SLES15-SP2-SAP-BYOS-GCE-2020-3412,Image SLES15-SP2-SAP-EC2-HVM-2020-3412,Image SLES15-SP2-SAP-GCE-2020-3412,SUSE-2020-3412,SUSE-SLE-Module-Basesystem-15-SP2-2020-3412,SUSE-SLE-Module-Server-Applications-15-SP2-2020-3412 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20203412-1/ Link for SUSE-SU-2020:3412-1 https://lists.suse.com/pipermail/sle-security-updates/2020-November/007814.html E-Mail link for SUSE-SU-2020:3412-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1027519 SUSE Bug 1027519 https://bugzilla.suse.com/1177950 SUSE Bug 1177950 https://bugzilla.suse.com/1178591 SUSE Bug 1178591 https://www.suse.com/security/cve/CVE-2020-28368/ SUSE CVE CVE-2020-28368 page Container suse/sles/15.2/virt-launcher:0.38.1 Image SLES15-SP2-Azure-Basic Image SLES15-SP2-Azure-Standard Image SLES15-SP2-BYOS-Azure Image SLES15-SP2-BYOS-EC2-HVM Image SLES15-SP2-BYOS-GCE Image SLES15-SP2-CHOST-BYOS-Aliyun Image SLES15-SP2-CHOST-BYOS-Azure Image SLES15-SP2-CHOST-BYOS-EC2 Image SLES15-SP2-CHOST-BYOS-GCE Image SLES15-SP2-EC2-ECS-HVM Image SLES15-SP2-EC2-HVM Image SLES15-SP2-GCE Image SLES15-SP2-HPC-Azure Image SLES15-SP2-HPC-BYOS-Azure Image SLES15-SP2-HPC-BYOS-EC2-HVM Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE Image SLES15-SP2-SAP-Azure Image SLES15-SP2-SAP-Azure-LI-BYOS-Production Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production Image SLES15-SP2-SAP-BYOS-Azure Image SLES15-SP2-SAP-BYOS-EC2-HVM Image SLES15-SP2-SAP-BYOS-GCE Image SLES15-SP2-SAP-EC2-HVM Image SLES15-SP2-SAP-GCE SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 xen-libs-4.13.2_02-3.16.2 xen-tools-domU-4.13.2_02-3.16.2 xen-4.13.2_02-3.16.2 xen-devel-4.13.2_02-3.16.2 xen-doc-html-4.13.2_02-3.16.2 xen-libs-32bit-4.13.2_02-3.16.2 xen-libs-64bit-4.13.2_02-3.16.2 xen-tools-4.13.2_02-3.16.2 xen-tools-xendomains-wait-disk-4.13.2_02-3.16.2 xen-libs-4.13.2_02-3.16.2 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-Azure-Basic xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-Azure-Standard xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-BYOS-Azure xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-BYOS-EC2-HVM xen-tools-domU-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-BYOS-EC2-HVM xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-BYOS-GCE xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-CHOST-BYOS-Aliyun xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-CHOST-BYOS-Azure xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-CHOST-BYOS-EC2 xen-tools-domU-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-CHOST-BYOS-EC2 xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-CHOST-BYOS-GCE xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-EC2-ECS-HVM xen-tools-domU-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-EC2-ECS-HVM xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-EC2-HVM xen-tools-domU-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-EC2-HVM xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-GCE xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-HPC-Azure xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-HPC-BYOS-Azure xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-HPC-BYOS-EC2-HVM xen-tools-domU-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-HPC-BYOS-EC2-HVM xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM xen-tools-domU-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM xen-tools-domU-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-SAP-Azure xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-SAP-Azure-LI-BYOS-Production xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-SAP-BYOS-Azure xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-SAP-BYOS-EC2-HVM xen-tools-domU-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-SAP-BYOS-EC2-HVM xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-SAP-BYOS-GCE xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-SAP-EC2-HVM xen-tools-domU-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-SAP-EC2-HVM xen-libs-4.13.2_02-3.16.2 as a component of Image SLES15-SP2-SAP-GCE xen-libs-4.13.2_02-3.16.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 xen-tools-domU-4.13.2_02-3.16.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 xen-4.13.2_02-3.16.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 xen-devel-4.13.2_02-3.16.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 xen-tools-4.13.2_02-3.16.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 xen-tools-xendomains-wait-disk-4.13.2_02-3.16.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen. CVE-2020-28368 Container suse/sles/15.2/virt-launcher:0.38.1:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-Azure-Basic:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-Azure-Standard:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-BYOS-Azure:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-BYOS-EC2-HVM:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-BYOS-EC2-HVM:xen-tools-domU-4.13.2_02-3.16.2 Image SLES15-SP2-BYOS-GCE:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-CHOST-BYOS-Aliyun:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-CHOST-BYOS-Azure:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-CHOST-BYOS-EC2:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-CHOST-BYOS-EC2:xen-tools-domU-4.13.2_02-3.16.2 Image SLES15-SP2-CHOST-BYOS-GCE:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-EC2-ECS-HVM:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-EC2-ECS-HVM:xen-tools-domU-4.13.2_02-3.16.2 Image SLES15-SP2-EC2-HVM:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-EC2-HVM:xen-tools-domU-4.13.2_02-3.16.2 Image SLES15-SP2-GCE:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-HPC-Azure:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-HPC-BYOS-Azure:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-HPC-BYOS-EC2-HVM:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-HPC-BYOS-EC2-HVM:xen-tools-domU-4.13.2_02-3.16.2 Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM:xen-tools-domU-4.13.2_02-3.16.2 Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:xen-tools-domU-4.13.2_02-3.16.2 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-SAP-Azure:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-SAP-BYOS-Azure:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-SAP-BYOS-EC2-HVM:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-SAP-BYOS-EC2-HVM:xen-tools-domU-4.13.2_02-3.16.2 Image SLES15-SP2-SAP-BYOS-GCE:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-SAP-EC2-HVM:xen-libs-4.13.2_02-3.16.2 Image SLES15-SP2-SAP-EC2-HVM:xen-tools-domU-4.13.2_02-3.16.2 Image SLES15-SP2-SAP-GCE:xen-libs-4.13.2_02-3.16.2 SUSE Linux Enterprise Module for Basesystem 15 SP2:xen-libs-4.13.2_02-3.16.2 SUSE Linux Enterprise Module for Basesystem 15 SP2:xen-tools-domU-4.13.2_02-3.16.2 SUSE Linux Enterprise Module for Server Applications 15 SP2:xen-4.13.2_02-3.16.2 SUSE Linux Enterprise Module for Server Applications 15 SP2:xen-devel-4.13.2_02-3.16.2 SUSE Linux Enterprise Module for Server Applications 15 SP2:xen-tools-4.13.2_02-3.16.2 SUSE Linux Enterprise Module for Server Applications 15 SP2:xen-tools-xendomains-wait-disk-4.13.2_02-3.16.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203412-1/ https://www.suse.com/security/cve/CVE-2020-28368.html CVE-2020-28368 https://bugzilla.suse.com/1178591 SUSE Bug 1178591 https://bugzilla.suse.com/1178658 SUSE Bug 1178658