Security update for libvirt

Announcement ID:	SUSE-SU-2018:2141-1
Rating:	important
References:	bsc#1076500 bsc#1079869 bsc#1083625 bsc#1092885 bsc#854343 bsc#897352 bsc#954872 bsc#956298 bsc#964465 bsc#968483 bsc#980558 bsc#987527
Cross-References:	CVE-2016-5008 CVE-2017-5715 CVE-2018-1064 CVE-2018-3639 CVE-2018-5748
CVSS scores:	CVE-2016-5008 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-5715 ( SUSE ): 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2017-5715 ( NVD ): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2017-5715 ( NVD ): 5.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2018-1064 ( SUSE ): 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2018-1064 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-3639 ( SUSE ): 4.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVE-2018-3639 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2018-3639 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2018-5748 ( SUSE ): 2.8 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L CVE-2018-5748 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:	SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 LTSS 12 SUSE Linux Enterprise Server for SAP Applications 12

An update that solves five vulnerabilities and has seven security fixes can now be installed.

Description:

This update for libvirt fixes the following issues:

Security issues fixed:

• CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka "Memory Disambiguation" (bsc#1092885).
• CVE-2018-1064: Fix denial of service problem during reading from guest agent (bsc#1083625).
• CVE-2018-5748: Fix resource exhaustion via qemuMonitorIORead() method (bsc#1076500).
• CVE-2016-5008: Fix that an empty VNC password disables authentication (bsc#987527).
• CVE-2017-5715: Fix speculative side channel attacks aka "SpectreAttack" (var2) (bsc#1079869).

Bug fixes:

• bsc#980558: Fix NUMA node memory allocation.
• bsc#968483: Restart daemons in %posttrans after connection drivers.
• bsc#897352: Systemd fails to ignore LSB services.
• bsc#956298: virsh domxml-to-native causes segfault of libvirtd.
• bsc#964465: libvirtd.service causes systemd warning about xencommons service.
• bsc#954872: Script block-dmmd not working as expected.
• bsc#854343: libvirt installation run inappropriate systemd restart.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Server 12 LTSS 12
  zypper in -t patch SUSE-SLE-SERVER-12-2018-1455=1

Package List:

• SUSE Linux Enterprise Server 12 LTSS 12 (ppc64le s390x x86_64)
  • libvirt-daemon-debuginfo-1.2.5-27.13.1
  • libvirt-daemon-driver-network-1.2.5-27.13.1
  • libvirt-daemon-lxc-1.2.5-27.13.1
  • libvirt-daemon-driver-qemu-debuginfo-1.2.5-27.13.1
  • libvirt-daemon-driver-interface-debuginfo-1.2.5-27.13.1
  • libvirt-daemon-driver-secret-1.2.5-27.13.1
  • libvirt-daemon-config-nwfilter-1.2.5-27.13.1
  • libvirt-daemon-driver-network-debuginfo-1.2.5-27.13.1
  • libvirt-client-1.2.5-27.13.1
  • libvirt-lock-sanlock-debuginfo-1.2.5-27.13.1
  • libvirt-doc-1.2.5-27.13.1
  • libvirt-lock-sanlock-1.2.5-27.13.1
  • libvirt-daemon-1.2.5-27.13.1
  • libvirt-daemon-config-network-1.2.5-27.13.1
  • libvirt-daemon-driver-qemu-1.2.5-27.13.1
  • libvirt-daemon-driver-nwfilter-1.2.5-27.13.1
  • libvirt-daemon-driver-storage-debuginfo-1.2.5-27.13.1
  • libvirt-daemon-driver-nodedev-1.2.5-27.13.1
  • libvirt-daemon-driver-nwfilter-debuginfo-1.2.5-27.13.1
  • libvirt-daemon-driver-storage-1.2.5-27.13.1
  • libvirt-daemon-driver-lxc-1.2.5-27.13.1
  • libvirt-1.2.5-27.13.1
  • libvirt-daemon-driver-secret-debuginfo-1.2.5-27.13.1
  • libvirt-daemon-driver-interface-1.2.5-27.13.1
  • libvirt-debugsource-1.2.5-27.13.1
  • libvirt-daemon-driver-lxc-debuginfo-1.2.5-27.13.1
  • libvirt-daemon-qemu-1.2.5-27.13.1
  • libvirt-daemon-driver-nodedev-debuginfo-1.2.5-27.13.1
  • libvirt-client-debuginfo-1.2.5-27.13.1
• SUSE Linux Enterprise Server 12 LTSS 12 (x86_64)
  • libvirt-daemon-driver-libxl-1.2.5-27.13.1
  • libvirt-daemon-xen-1.2.5-27.13.1
  • libvirt-daemon-driver-libxl-debuginfo-1.2.5-27.13.1

References:

• https://www.suse.com/security/cve/CVE-2016-5008.html
• https://www.suse.com/security/cve/CVE-2017-5715.html
• https://www.suse.com/security/cve/CVE-2018-1064.html
• https://www.suse.com/security/cve/CVE-2018-3639.html
• https://www.suse.com/security/cve/CVE-2018-5748.html
• https://bugzilla.suse.com/show_bug.cgi?id=1076500
• https://bugzilla.suse.com/show_bug.cgi?id=1079869
• https://bugzilla.suse.com/show_bug.cgi?id=1083625
• https://bugzilla.suse.com/show_bug.cgi?id=1092885
• https://bugzilla.suse.com/show_bug.cgi?id=854343
• https://bugzilla.suse.com/show_bug.cgi?id=897352
• https://bugzilla.suse.com/show_bug.cgi?id=954872
• https://bugzilla.suse.com/show_bug.cgi?id=956298
• https://bugzilla.suse.com/show_bug.cgi?id=964465
• https://bugzilla.suse.com/show_bug.cgi?id=968483
• https://bugzilla.suse.com/show_bug.cgi?id=980558
• https://bugzilla.suse.com/show_bug.cgi?id=987527