Security update for xen SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:3141-1 Final 1 1 2021-09-18T12:37:44Z current 2021-09-18T12:37:44Z 2021-09-18T12:37:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xen This update for xen fixes the following issues: - CVE-2021-28701: Fixed race condition in XENMAPSPACE_grant_table handling (XSA-384) (bsc#1189632). - Upstream bug fixes (bsc#1027519) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP2-BYOS-Azure-2021-3141,Image SLES15-SP2-BYOS-EC2-HVM-2021-3141,Image SLES15-SP2-BYOS-GCE-2021-3141,Image SLES15-SP2-CHOST-BYOS-Aliyun-2021-3141,Image SLES15-SP2-CHOST-BYOS-Azure-2021-3141,Image SLES15-SP2-CHOST-BYOS-EC2-2021-3141,Image SLES15-SP2-CHOST-BYOS-GCE-2021-3141,Image SLES15-SP2-HPC-BYOS-Azure-2021-3141,Image SLES15-SP2-HPC-BYOS-EC2-HVM-2021-3141,Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure-2021-3141,Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM-2021-3141,Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE-2021-3141,Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure-2021-3141,Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM-2021-3141,Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE-2021-3141,Image SLES15-SP2-SAP-Azure-2021-3141,Image SLES15-SP2-SAP-Azure-LI-BYOS-Production-2021-3141,Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production-2021-3141,Image SLES15-SP2-SAP-BYOS-Azure-2021-3141,Image SLES15-SP2-SAP-BYOS-EC2-HVM-2021-3141,Image SLES15-SP2-SAP-BYOS-GCE-2021-3141,Image SLES15-SP2-SAP-EC2-HVM-2021-3141,Image SLES15-SP2-SAP-GCE-2021-3141,SUSE-2021-3141,SUSE-SLE-Module-Basesystem-15-SP2-2021-3141,SUSE-SLE-Module-Server-Applications-15-SP2-2021-3141,SUSE-SUSE-MicroOS-5.0-2021-3141 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20213141-1/ Link for SUSE-SU-2021:3141-1 https://lists.suse.com/pipermail/sle-security-updates/2021-September/009463.html E-Mail link for SUSE-SU-2021:3141-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1027519 SUSE Bug 1027519 https://bugzilla.suse.com/1189632 SUSE Bug 1189632 https://www.suse.com/security/cve/CVE-2021-28701/ SUSE CVE CVE-2021-28701 page Image SLES15-SP2-BYOS-Azure Image SLES15-SP2-BYOS-EC2-HVM Image SLES15-SP2-BYOS-GCE Image SLES15-SP2-CHOST-BYOS-Aliyun Image SLES15-SP2-CHOST-BYOS-Azure Image SLES15-SP2-CHOST-BYOS-EC2 Image SLES15-SP2-CHOST-BYOS-GCE Image SLES15-SP2-HPC-BYOS-Azure Image SLES15-SP2-HPC-BYOS-EC2-HVM Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE Image SLES15-SP2-SAP-Azure Image SLES15-SP2-SAP-Azure-LI-BYOS-Production Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production Image SLES15-SP2-SAP-BYOS-Azure Image SLES15-SP2-SAP-BYOS-EC2-HVM Image SLES15-SP2-SAP-BYOS-GCE Image SLES15-SP2-SAP-EC2-HVM Image SLES15-SP2-SAP-GCE SUSE Linux Enterprise Micro 5.0 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 xen-libs-4.13.3_04-3.37.1 xen-tools-domU-4.13.3_04-3.37.1 xen-4.13.3_04-3.37.1 xen-devel-4.13.3_04-3.37.1 xen-doc-html-4.13.3_04-3.37.1 xen-libs-32bit-4.13.3_04-3.37.1 xen-libs-64bit-4.13.3_04-3.37.1 xen-tools-4.13.3_04-3.37.1 xen-tools-xendomains-wait-disk-4.13.3_04-3.37.1 xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-BYOS-Azure xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-BYOS-EC2-HVM xen-tools-domU-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-BYOS-EC2-HVM xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-BYOS-GCE xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-CHOST-BYOS-Aliyun xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-CHOST-BYOS-Azure xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-CHOST-BYOS-EC2 xen-tools-domU-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-CHOST-BYOS-EC2 xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-CHOST-BYOS-GCE xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-HPC-BYOS-Azure xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-HPC-BYOS-EC2-HVM xen-tools-domU-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-HPC-BYOS-EC2-HVM xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM xen-tools-domU-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM xen-tools-domU-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-SAP-Azure xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-SAP-Azure-LI-BYOS-Production xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-SAP-BYOS-Azure xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-SAP-BYOS-EC2-HVM xen-tools-domU-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-SAP-BYOS-EC2-HVM xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-SAP-BYOS-GCE xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-SAP-EC2-HVM xen-tools-domU-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-SAP-EC2-HVM xen-libs-4.13.3_04-3.37.1 as a component of Image SLES15-SP2-SAP-GCE xen-libs-4.13.3_04-3.37.1 as a component of SUSE Linux Enterprise Micro 5.0 xen-libs-4.13.3_04-3.37.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 xen-tools-domU-4.13.3_04-3.37.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 xen-4.13.3_04-3.37.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 xen-devel-4.13.3_04-3.37.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 xen-tools-4.13.3_04-3.37.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 xen-tools-xendomains-wait-disk-4.13.3_04-3.37.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed. CVE-2021-28701 Image SLES15-SP2-BYOS-Azure:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-BYOS-EC2-HVM:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-BYOS-EC2-HVM:xen-tools-domU-4.13.3_04-3.37.1 Image SLES15-SP2-BYOS-GCE:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-CHOST-BYOS-Aliyun:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-CHOST-BYOS-Azure:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-CHOST-BYOS-EC2:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-CHOST-BYOS-EC2:xen-tools-domU-4.13.3_04-3.37.1 Image SLES15-SP2-CHOST-BYOS-GCE:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-HPC-BYOS-Azure:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-HPC-BYOS-EC2-HVM:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-HPC-BYOS-EC2-HVM:xen-tools-domU-4.13.3_04-3.37.1 Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM:xen-tools-domU-4.13.3_04-3.37.1 Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:xen-tools-domU-4.13.3_04-3.37.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-SAP-Azure:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-SAP-BYOS-Azure:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-SAP-BYOS-EC2-HVM:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-SAP-BYOS-EC2-HVM:xen-tools-domU-4.13.3_04-3.37.1 Image SLES15-SP2-SAP-BYOS-GCE:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-SAP-EC2-HVM:xen-libs-4.13.3_04-3.37.1 Image SLES15-SP2-SAP-EC2-HVM:xen-tools-domU-4.13.3_04-3.37.1 Image SLES15-SP2-SAP-GCE:xen-libs-4.13.3_04-3.37.1 SUSE Linux Enterprise Micro 5.0:xen-libs-4.13.3_04-3.37.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:xen-libs-4.13.3_04-3.37.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:xen-tools-domU-4.13.3_04-3.37.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:xen-4.13.3_04-3.37.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:xen-devel-4.13.3_04-3.37.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:xen-tools-4.13.3_04-3.37.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:xen-tools-xendomains-wait-disk-4.13.3_04-3.37.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213141-1/ https://www.suse.com/security/cve/CVE-2021-28701.html CVE-2021-28701 https://bugzilla.suse.com/1189632 SUSE Bug 1189632