Security update for xen

Announcement ID:	SUSE-SU-2020:1138-1
Rating:	important
References:	bsc#1027519 bsc#1155200 bsc#1160932 bsc#1161181 bsc#1167152 bsc#1168140 bsc#1168142 bsc#1168143 bsc#1169392
Cross-References:	CVE-2020-11739 CVE-2020-11740 CVE-2020-11741 CVE-2020-11742 CVE-2020-11743 CVE-2020-7211
CVSS scores:	CVE-2020-11739 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2020-11740 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-11741 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2020-11742 ( SUSE ): 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CVE-2020-11742 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-11743 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-7211 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-7211 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products:	SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP4

An update that solves six vulnerabilities and has three security fixes can now be installed.

Description:

This update for xen fixes the following issues:

Security issues fixed:

• CVE-2020-11742: Bad continuation handling in GNTTABOP_copy (bsc#1169392).
• CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues (bsc#1168140).
• CVE-2020-11739: Missing memory barriers in read-write unlock paths (bsc#1168142).
• CVE-2020-11743: Bad error path in GNTTABOP_map_grant (bsc#1168143).
• CVE-2020-7211: Fixed potential directory traversal using relative paths via tftp server on Windows host (bsc#1161181).
• arm: a CPU may speculate past the ERET instruction (bsc#1160932).

Non-security issues fixed:

• Xenstored Crashed during VM install (bsc#1167152)
• DomU hang: soft lockup CPU #0 stuck under high load (bsc#1165206, bsc#1134506)
• Update API compatibility versions, fixes issues for libvirt. (bsc#1167007, bsc#1157490)
• aacraid blocks xen commands (bsc#1155200)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Software Development Kit 12 SP4
  zypper in -t patch SUSE-SLE-SDK-12-SP4-2020-1138=1
• SUSE Linux Enterprise High Performance Computing 12 SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-2020-1138=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-2020-1138=1
• SUSE Linux Enterprise Server 12 SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-2020-1138=1

Package List:

• SUSE Linux Enterprise Software Development Kit 12 SP4 (aarch64 x86_64)
  • xen-devel-4.11.3_04-2.23.1
  • xen-debugsource-4.11.3_04-2.23.1
• SUSE Linux Enterprise High Performance Computing 12 SP4 (x86_64)
  • xen-tools-domU-debuginfo-4.11.3_04-2.23.1
  • xen-libs-32bit-4.11.3_04-2.23.1
  • xen-libs-debuginfo-32bit-4.11.3_04-2.23.1
  • xen-libs-4.11.3_04-2.23.1
  • xen-doc-html-4.11.3_04-2.23.1
  • xen-libs-debuginfo-4.11.3_04-2.23.1
  • xen-tools-debuginfo-4.11.3_04-2.23.1
  • xen-debugsource-4.11.3_04-2.23.1
  • xen-4.11.3_04-2.23.1
  • xen-tools-4.11.3_04-2.23.1
  • xen-tools-domU-4.11.3_04-2.23.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4 (x86_64)
  • xen-tools-domU-debuginfo-4.11.3_04-2.23.1
  • xen-libs-32bit-4.11.3_04-2.23.1
  • xen-libs-debuginfo-32bit-4.11.3_04-2.23.1
  • xen-libs-4.11.3_04-2.23.1
  • xen-doc-html-4.11.3_04-2.23.1
  • xen-libs-debuginfo-4.11.3_04-2.23.1
  • xen-tools-debuginfo-4.11.3_04-2.23.1
  • xen-debugsource-4.11.3_04-2.23.1
  • xen-4.11.3_04-2.23.1
  • xen-tools-4.11.3_04-2.23.1
  • xen-tools-domU-4.11.3_04-2.23.1
• SUSE Linux Enterprise Server 12 SP4 (x86_64)
  • xen-tools-domU-debuginfo-4.11.3_04-2.23.1
  • xen-libs-32bit-4.11.3_04-2.23.1
  • xen-libs-debuginfo-32bit-4.11.3_04-2.23.1
  • xen-libs-4.11.3_04-2.23.1
  • xen-doc-html-4.11.3_04-2.23.1
  • xen-libs-debuginfo-4.11.3_04-2.23.1
  • xen-tools-debuginfo-4.11.3_04-2.23.1
  • xen-debugsource-4.11.3_04-2.23.1
  • xen-4.11.3_04-2.23.1
  • xen-tools-4.11.3_04-2.23.1
  • xen-tools-domU-4.11.3_04-2.23.1

References:

• https://www.suse.com/security/cve/CVE-2020-11739.html
• https://www.suse.com/security/cve/CVE-2020-11740.html
• https://www.suse.com/security/cve/CVE-2020-11741.html
• https://www.suse.com/security/cve/CVE-2020-11742.html
• https://www.suse.com/security/cve/CVE-2020-11743.html
• https://www.suse.com/security/cve/CVE-2020-7211.html
• https://bugzilla.suse.com/show_bug.cgi?id=1027519
• https://bugzilla.suse.com/show_bug.cgi?id=1155200
• https://bugzilla.suse.com/show_bug.cgi?id=1160932
• https://bugzilla.suse.com/show_bug.cgi?id=1161181
• https://bugzilla.suse.com/show_bug.cgi?id=1167152
• https://bugzilla.suse.com/show_bug.cgi?id=1168140
• https://bugzilla.suse.com/show_bug.cgi?id=1168142
• https://bugzilla.suse.com/show_bug.cgi?id=1168143
• https://bugzilla.suse.com/show_bug.cgi?id=1169392