Security update for xen
Announcement ID: | SUSE-SU-2021:2922-1 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves 11 vulnerabilities and has nine security fixes can now be installed.
Description:
This update for xen fixes the following issues:
Update to Xen 4.13.3 general bug fix release (bsc#1027519).
Security issues fixed:
- CVE-2021-28693: xen/arm: Boot modules are not scrubbed (bsc#1186428)
- CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling (bsc#1186429)
- CVE-2021-0089: xen: Speculative Code Store Bypass (bsc#1186433)
- CVE-2021-28690: xen: x86: TSX Async Abort protections not restored after S3 (bsc#1186434)
- CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373).
- CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation (XSA-379)(bsc#1189376).
- CVE-2021-28698: long running loops in grant table handling (XSA-380)(bsc#1189378).
- CVE-2021-28699: inadequate grant-v2 status frames array bounds check (XSA-382)(bsc#1189380).
- CVE-2021-28700: No memory limit for dom0less domUs (XSA-383)(bsc#1189381).
Other issues fixed:
- Fixed "Panic on CPU 0: IO-APIC + timer doesn't work!" (bsc#1180491)
- Fixed an issue with xencommons, where file format expecations by fillup did not allign (bsc#1185682)
- Fixed shell macro expansion in the spec file, so that ExecStart= in xendomains-wait-disks.service is created correctly (bsc#1183877)
- Upstream bug fixes (bsc#1027519)
- Fixed Xen SLES11SP4 guest hangs on cluster (bsc#1188050).
- xl monitoring process exits during xl save -p|-c keep the monitoring process running to cleanup the domU during shutdown (bsc#1176189).
- Dom0 hangs when pinning CPUs for dom0 with HVM guest (bsc#1179246).
- Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882).
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
Basesystem Module 15-SP2
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP2-2021-2922=1
-
Server Applications Module 15-SP2
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP2-2021-2922=1
-
SUSE Linux Enterprise Micro 5.0
zypper in -t patch SUSE-SUSE-MicroOS-5.0-2021-2922=1
Package List:
-
Basesystem Module 15-SP2 (x86_64)
- xen-libs-4.13.3_02-3.34.1
- xen-tools-domU-debuginfo-4.13.3_02-3.34.1
- xen-debugsource-4.13.3_02-3.34.1
- xen-libs-debuginfo-4.13.3_02-3.34.1
- xen-tools-domU-4.13.3_02-3.34.1
-
Server Applications Module 15-SP2 (x86_64)
- xen-4.13.3_02-3.34.1
- xen-tools-debuginfo-4.13.3_02-3.34.1
- xen-tools-4.13.3_02-3.34.1
- xen-devel-4.13.3_02-3.34.1
- xen-debugsource-4.13.3_02-3.34.1
-
Server Applications Module 15-SP2 (noarch)
- xen-tools-xendomains-wait-disk-4.13.3_02-3.34.1
-
SUSE Linux Enterprise Micro 5.0 (x86_64)
- xen-debugsource-4.13.3_02-3.34.1
- xen-libs-debuginfo-4.13.3_02-3.34.1
- xen-libs-4.13.3_02-3.34.1
References:
- https://www.suse.com/security/cve/CVE-2021-0089.html
- https://www.suse.com/security/cve/CVE-2021-28690.html
- https://www.suse.com/security/cve/CVE-2021-28692.html
- https://www.suse.com/security/cve/CVE-2021-28693.html
- https://www.suse.com/security/cve/CVE-2021-28694.html
- https://www.suse.com/security/cve/CVE-2021-28695.html
- https://www.suse.com/security/cve/CVE-2021-28696.html
- https://www.suse.com/security/cve/CVE-2021-28697.html
- https://www.suse.com/security/cve/CVE-2021-28698.html
- https://www.suse.com/security/cve/CVE-2021-28699.html
- https://www.suse.com/security/cve/CVE-2021-28700.html
- https://bugzilla.suse.com/show_bug.cgi?id=1027519
- https://bugzilla.suse.com/show_bug.cgi?id=1137251
- https://bugzilla.suse.com/show_bug.cgi?id=1176189
- https://bugzilla.suse.com/show_bug.cgi?id=1179148
- https://bugzilla.suse.com/show_bug.cgi?id=1179246
- https://bugzilla.suse.com/show_bug.cgi?id=1180491
- https://bugzilla.suse.com/show_bug.cgi?id=1181989
- https://bugzilla.suse.com/show_bug.cgi?id=1183877
- https://bugzilla.suse.com/show_bug.cgi?id=1185682
- https://bugzilla.suse.com/show_bug.cgi?id=1186428
- https://bugzilla.suse.com/show_bug.cgi?id=1186429
- https://bugzilla.suse.com/show_bug.cgi?id=1186433
- https://bugzilla.suse.com/show_bug.cgi?id=1186434
- https://bugzilla.suse.com/show_bug.cgi?id=1188050
- https://bugzilla.suse.com/show_bug.cgi?id=1189373
- https://bugzilla.suse.com/show_bug.cgi?id=1189376
- https://bugzilla.suse.com/show_bug.cgi?id=1189378
- https://bugzilla.suse.com/show_bug.cgi?id=1189380
- https://bugzilla.suse.com/show_bug.cgi?id=1189381
- https://bugzilla.suse.com/show_bug.cgi?id=1189882