Security update for xen

Announcement ID:	SUSE-SU-2020:0334-1
Rating:	important
References:	bsc#1152497 bsc#1154448 bsc#1154456 bsc#1154458 bsc#1154461 bsc#1155945 bsc#1157888 bsc#1158003 bsc#1158004 bsc#1158005 bsc#1158006 bsc#1158007 bsc#1161181
Cross-References:	CVE-2018-12207 CVE-2019-11135 CVE-2019-18420 CVE-2019-18421 CVE-2019-18424 CVE-2019-18425 CVE-2019-19577 CVE-2019-19578 CVE-2019-19579 CVE-2019-19580 CVE-2019-19581 CVE-2019-19583 CVE-2020-7211
CVSS scores:	CVE-2018-12207 ( SUSE ): 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2018-12207 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2019-11135 ( SUSE ): 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2019-11135 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2019-18420 ( SUSE ): 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2019-18420 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2019-18421 ( SUSE ): 8.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2019-18421 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-18424 ( SUSE ): 7.6 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2019-18424 ( NVD ): 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-18425 ( SUSE ): 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-18425 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-19577 ( SUSE ): 7.2 CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2019-19577 ( NVD ): 7.2 CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2019-19578 ( SUSE ): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2019-19578 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2019-19579 ( SUSE ): 6.9 CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2019-19579 ( NVD ): 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-19580 ( NVD ): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2019-19581 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2019-19583 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-7211 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-7211 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Point of Service Image Server 12 12-SP2 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2 SUSE Linux Enterprise Server 12 SP2 LTSS 12-SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE OpenStack Cloud 7

An update that solves 13 vulnerabilities can now be installed.

Description:

This update for xen fixes the following issues:

• CVE-2020-7211: potential directory traversal using relative paths via tftp server on Windows host (bsc#1161181).
• CVE-2019-19579: Device quarantine for alternate pci assignment methods (bsc#1157888).
• CVE-2019-19581: find_next_bit() issues (bsc#1158003).
• CVE-2019-19583: VMentry failure with debug exceptions and blocked states (bsc#1158004).
• CVE-2019-19578: Linear pagetable use / entry miscounts (bsc#1158005).
• CVE-2019-19580: Further issues with restartable PV type change operations (bsc#1158006).
• CVE-2019-19577: dynamic height for the IOMMU pagetables (bsc#1158007).
• CVE-2019-18420: VCPUOP_initialise DoS (bsc#1154448).
• CVE-2019-18425: missing descriptor table limit checking in x86 PV emulation (bsc#1154456).
• CVE-2019-18421: Issues with restartable PV type change operations (bsc#1154458).
• CVE-2019-18424: passed through PCI devices may corrupt host memory after deassignment (bsc#1154461).
• CVE-2018-12207: Machine Check Error Avoidance on Page Size Change (aka IFU issue) (bsc#1155945).
• CVE-2019-11135: TSX Asynchronous Abort (TAA) issue (bsc#1152497).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE OpenStack Cloud 7
  zypper in -t patch SUSE-OpenStack-Cloud-7-2020-334=1
• SUSE Linux Enterprise Point of Service Image Server 12 12-SP2
  zypper in -t patch SUSE-SLE-POS-12-SP2-CLIENT-2020-334=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2
  zypper in -t patch SUSE-SLE-SAP-12-SP2-2020-334=1
• SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2020-334=1
• SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-ESPOS-2020-334=1
• SUSE Linux Enterprise Server 12 SP2 LTSS 12-SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2020-334=1

Package List:

• SUSE OpenStack Cloud 7 (x86_64)
  • xen-debugsource-4.7.6_06-43.59.1
  • xen-tools-4.7.6_06-43.59.1
  • xen-4.7.6_06-43.59.1
  • xen-libs-debuginfo-4.7.6_06-43.59.1
  • xen-tools-domU-4.7.6_06-43.59.1
  • xen-tools-debuginfo-4.7.6_06-43.59.1
  • xen-doc-html-4.7.6_06-43.59.1
  • xen-tools-domU-debuginfo-4.7.6_06-43.59.1
  • xen-libs-4.7.6_06-43.59.1
  • xen-libs-32bit-4.7.6_06-43.59.1
  • xen-libs-debuginfo-32bit-4.7.6_06-43.59.1
• SUSE Linux Enterprise Point of Service Image Server 12 12-SP2 (x86_64)
  • xen-debugsource-4.7.6_06-43.59.1
  • xen-tools-4.7.6_06-43.59.1
  • xen-4.7.6_06-43.59.1
  • xen-libs-debuginfo-4.7.6_06-43.59.1
  • xen-tools-domU-4.7.6_06-43.59.1
  • xen-tools-debuginfo-4.7.6_06-43.59.1
  • xen-doc-html-4.7.6_06-43.59.1
  • xen-tools-domU-debuginfo-4.7.6_06-43.59.1
  • xen-libs-4.7.6_06-43.59.1
  • xen-libs-32bit-4.7.6_06-43.59.1
  • xen-libs-debuginfo-32bit-4.7.6_06-43.59.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (x86_64)
  • xen-debugsource-4.7.6_06-43.59.1
  • xen-tools-4.7.6_06-43.59.1
  • xen-4.7.6_06-43.59.1
  • xen-libs-debuginfo-4.7.6_06-43.59.1
  • xen-tools-domU-4.7.6_06-43.59.1
  • xen-tools-debuginfo-4.7.6_06-43.59.1
  • xen-doc-html-4.7.6_06-43.59.1
  • xen-tools-domU-debuginfo-4.7.6_06-43.59.1
  • xen-libs-4.7.6_06-43.59.1
  • xen-libs-32bit-4.7.6_06-43.59.1
  • xen-libs-debuginfo-32bit-4.7.6_06-43.59.1
• SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (x86_64)
  • xen-debugsource-4.7.6_06-43.59.1
  • xen-tools-4.7.6_06-43.59.1
  • xen-4.7.6_06-43.59.1
  • xen-libs-debuginfo-4.7.6_06-43.59.1
  • xen-tools-domU-4.7.6_06-43.59.1
  • xen-tools-debuginfo-4.7.6_06-43.59.1
  • xen-doc-html-4.7.6_06-43.59.1
  • xen-tools-domU-debuginfo-4.7.6_06-43.59.1
  • xen-libs-4.7.6_06-43.59.1
  • xen-libs-32bit-4.7.6_06-43.59.1
  • xen-libs-debuginfo-32bit-4.7.6_06-43.59.1
• SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2 (x86_64)
  • xen-debugsource-4.7.6_06-43.59.1
  • xen-tools-4.7.6_06-43.59.1
  • xen-4.7.6_06-43.59.1
  • xen-libs-debuginfo-4.7.6_06-43.59.1
  • xen-tools-domU-4.7.6_06-43.59.1
  • xen-tools-debuginfo-4.7.6_06-43.59.1
  • xen-doc-html-4.7.6_06-43.59.1
  • xen-tools-domU-debuginfo-4.7.6_06-43.59.1
  • xen-libs-4.7.6_06-43.59.1
  • xen-libs-32bit-4.7.6_06-43.59.1
  • xen-libs-debuginfo-32bit-4.7.6_06-43.59.1
• SUSE Linux Enterprise Server 12 SP2 LTSS 12-SP2 (x86_64)
  • xen-debugsource-4.7.6_06-43.59.1
  • xen-tools-4.7.6_06-43.59.1
  • xen-4.7.6_06-43.59.1
  • xen-libs-debuginfo-4.7.6_06-43.59.1
  • xen-tools-domU-4.7.6_06-43.59.1
  • xen-tools-debuginfo-4.7.6_06-43.59.1
  • xen-doc-html-4.7.6_06-43.59.1
  • xen-tools-domU-debuginfo-4.7.6_06-43.59.1
  • xen-libs-4.7.6_06-43.59.1
  • xen-libs-32bit-4.7.6_06-43.59.1
  • xen-libs-debuginfo-32bit-4.7.6_06-43.59.1

References:

• https://www.suse.com/security/cve/CVE-2018-12207.html
• https://www.suse.com/security/cve/CVE-2019-11135.html
• https://www.suse.com/security/cve/CVE-2019-18420.html
• https://www.suse.com/security/cve/CVE-2019-18421.html
• https://www.suse.com/security/cve/CVE-2019-18424.html
• https://www.suse.com/security/cve/CVE-2019-18425.html
• https://www.suse.com/security/cve/CVE-2019-19577.html
• https://www.suse.com/security/cve/CVE-2019-19578.html
• https://www.suse.com/security/cve/CVE-2019-19579.html
• https://www.suse.com/security/cve/CVE-2019-19580.html
• https://www.suse.com/security/cve/CVE-2019-19581.html
• https://www.suse.com/security/cve/CVE-2019-19583.html
• https://www.suse.com/security/cve/CVE-2020-7211.html
• https://bugzilla.suse.com/show_bug.cgi?id=1152497
• https://bugzilla.suse.com/show_bug.cgi?id=1154448
• https://bugzilla.suse.com/show_bug.cgi?id=1154456
• https://bugzilla.suse.com/show_bug.cgi?id=1154458
• https://bugzilla.suse.com/show_bug.cgi?id=1154461
• https://bugzilla.suse.com/show_bug.cgi?id=1155945
• https://bugzilla.suse.com/show_bug.cgi?id=1157888
• https://bugzilla.suse.com/show_bug.cgi?id=1158003
• https://bugzilla.suse.com/show_bug.cgi?id=1158004
• https://bugzilla.suse.com/show_bug.cgi?id=1158005
• https://bugzilla.suse.com/show_bug.cgi?id=1158006
• https://bugzilla.suse.com/show_bug.cgi?id=1158007
• https://bugzilla.suse.com/show_bug.cgi?id=1161181