Security update for ovmf SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:1941-1 Final 1 1 2023-04-21T10:00:48Z current 2023-04-21T10:00:48Z 2023-04-21T10:00:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ovmf This update for ovmf fixes the following issues: - CVE-2019-14560: Fixed potential secure boot bypass via an improper check of GetEfiGlobalVariable2 (bsc#1174246). - CVE-2021-38578: Fixed underflow in MdeModulePkg/PiSmmCore SmmEntryPointAdd (bsc#1196741). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-1941,SUSE-OpenStack-Cloud-9-2023-1941,SUSE-OpenStack-Cloud-Crowbar-9-2023-1941,SUSE-SLE-SAP-12-SP4-2023-1941,SUSE-SLE-SERVER-12-SP4-ESPOS-2023-1941,SUSE-SLE-SERVER-12-SP4-LTSS-2023-1941,SUSE-SLE-SERVER-12-SP5-2023-1941 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20231941-1/ Link for SUSE-SU-2023:1941-1 https://lists.suse.com/pipermail/sle-updates/2023-April/028930.html E-Mail link for SUSE-SU-2023:1941-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1174246 SUSE Bug 1174246 https://bugzilla.suse.com/1196741 SUSE Bug 1196741 https://www.suse.com/security/cve/CVE-2019-14560/ SUSE CVE CVE-2019-14560 page https://www.suse.com/security/cve/CVE-2021-38578/ SUSE CVE CVE-2021-38578 page SUSE Linux Enterprise Server 12 SP4-ESPOS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 ovmf-2017+git1510945757.b2662641d5-3.41.2 ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 qemu-ovmf-ia32-2017+git1510945757.b2662641d5-3.41.2 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 qemu-ovmf-x86_64-debug-2017+git1510945757.b2662641d5-3.41.2 qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.41.2 ovmf-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS ovmf-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS ovmf-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server 12 SP5 ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server 12 SP5 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server 12 SP5 qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server 12 SP5 ovmf-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 ovmf-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 ovmf-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE OpenStack Cloud 9 ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE OpenStack Cloud 9 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE OpenStack Cloud 9 ovmf-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE OpenStack Cloud Crowbar 9 ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE OpenStack Cloud Crowbar 9 qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 as a component of SUSE OpenStack Cloud Crowbar 9 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none. CVE-2019-14560 SUSE Linux Enterprise Server 12 SP4-ESPOS:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-ESPOS:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-ESPOS:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-ESPOS:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-LTSS:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-LTSS:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-LTSS:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-LTSS:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP5:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP5:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP5:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP5:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.41.2 SUSE OpenStack Cloud 9:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE OpenStack Cloud 9:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE OpenStack Cloud 9:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 SUSE OpenStack Cloud Crowbar 9:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE OpenStack Cloud Crowbar 9:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE OpenStack Cloud Crowbar 9:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20231941-1/ https://www.suse.com/security/cve/CVE-2019-14560.html CVE-2019-14560 https://bugzilla.suse.com/1174246 SUSE Bug 1174246 Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize. CVE-2021-38578 SUSE Linux Enterprise Server 12 SP4-ESPOS:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-ESPOS:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-ESPOS:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-ESPOS:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-LTSS:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-LTSS:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-LTSS:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP4-LTSS:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP5:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP5:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP5:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server 12 SP5:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:qemu-uefi-aarch64-2017+git1510945757.b2662641d5-3.41.2 SUSE OpenStack Cloud 9:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE OpenStack Cloud 9:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE OpenStack Cloud 9:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 SUSE OpenStack Cloud Crowbar 9:ovmf-2017+git1510945757.b2662641d5-3.41.2 SUSE OpenStack Cloud Crowbar 9:ovmf-tools-2017+git1510945757.b2662641d5-3.41.2 SUSE OpenStack Cloud Crowbar 9:qemu-ovmf-x86_64-2017+git1510945757.b2662641d5-3.41.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20231941-1/ https://www.suse.com/security/cve/CVE-2021-38578.html CVE-2021-38578 https://bugzilla.suse.com/1196741 SUSE Bug 1196741