SUSE-SU-2018:3332-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2018/suse-su-20183332-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:3332-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2018:3332-1

Related

Published

2018-10-23T13:14:17Z

Modified

2018-10-23T13:14:17Z

Summary

Security update for xen

Details

This update for xen fixes the following issues:

CVE-2018-17963: qemudeliverpacketiov accepted packet sizes greater than INTMAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. (bsc#1111014)
CVE-2018-15468: The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) could have locked up the entire host, causing a Denial of Service. (XSA-269) (bsc#1103276)

Non security issues fixed:

Kernel oops in fs/dcache.c called by dmaterialiseunique() (bsc#1094508)

References

Affected packages

SUSE:OpenStack Cloud 7 / xen

Package

Name: xen
Purl: purl:rpm/suse/xen&distro=SUSE%20OpenStack%20Cloud%207

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.7.6_05-43.42.1

Ecosystem specific

{
    "binaries": [
        {
            "xen-libs": "4.7.6_05-43.42.1",
            "xen-doc-html": "4.7.6_05-43.42.1",
            "xen-libs-32bit": "4.7.6_05-43.42.1",
            "xen-tools": "4.7.6_05-43.42.1",
            "xen-tools-domU": "4.7.6_05-43.42.1",
            "xen": "4.7.6_05-43.42.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP2 / xen

Package

Name: xen
Purl: purl:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.7.6_05-43.42.1

Ecosystem specific

{
    "binaries": [
        {
            "xen-libs": "4.7.6_05-43.42.1",
            "xen-doc-html": "4.7.6_05-43.42.1",
            "xen-libs-32bit": "4.7.6_05-43.42.1",
            "xen-tools": "4.7.6_05-43.42.1",
            "xen-tools-domU": "4.7.6_05-43.42.1",
            "xen": "4.7.6_05-43.42.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP2-LTSS / xen

Package

Name: xen
Purl: purl:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.7.6_05-43.42.1

Ecosystem specific

{
    "binaries": [
        {
            "xen-libs": "4.7.6_05-43.42.1",
            "xen-doc-html": "4.7.6_05-43.42.1",
            "xen-libs-32bit": "4.7.6_05-43.42.1",
            "xen-tools": "4.7.6_05-43.42.1",
            "xen-tools-domU": "4.7.6_05-43.42.1",
            "xen": "4.7.6_05-43.42.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP2-BCL / xen

Package

Name: xen
Purl: purl:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.7.6_05-43.42.1

Ecosystem specific

{
    "binaries": [
        {
            "xen-libs": "4.7.6_05-43.42.1",
            "xen-doc-html": "4.7.6_05-43.42.1",
            "xen-libs-32bit": "4.7.6_05-43.42.1",
            "xen-tools": "4.7.6_05-43.42.1",
            "xen-tools-domU": "4.7.6_05-43.42.1",
            "xen": "4.7.6_05-43.42.1"
        }
    ]
}

SUSE:Enterprise Storage 4 / xen

Package

Name: xen
Purl: purl:rpm/suse/xen&distro=SUSE%20Enterprise%20Storage%204

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.7.6_05-43.42.1

Ecosystem specific

{
    "binaries": [
        {
            "xen-libs": "4.7.6_05-43.42.1",
            "xen-doc-html": "4.7.6_05-43.42.1",
            "xen-libs-32bit": "4.7.6_05-43.42.1",
            "xen-tools": "4.7.6_05-43.42.1",
            "xen-tools-domU": "4.7.6_05-43.42.1",
            "xen": "4.7.6_05-43.42.1"
        }
    ]
}