Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.0627
SUSE Security Update: Security update for xen
10 March 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: xen
Publisher: SUSE
Operating System: SUSE
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Increased Privileges -- Existing Account
Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2017-5973 CVE-2017-5898 CVE-2017-5856
CVE-2017-5579 CVE-2017-2620 CVE-2017-2615
CVE-2016-10155 CVE-2016-9922 CVE-2016-9921
CVE-2016-9911 CVE-2016-9907 CVE-2016-9776
CVE-2016-9101 CVE-2014-8106
Reference: ESB-2017.0606
ESB-2017.0593
ESB-2017.0576
ESB-2017.0555
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for xen
______________________________________________________________________________
Announcement ID: SUSE-SU-2017:0647-1
Rating: important
References: #1000195 #1002496 #1013657 #1013668 #1014490
#1014507 #1015169 #1016340 #1022627 #1022871
#1023004 #1024183 #1024186 #1024307 #1024834
#1025188 #907805 #987002
Cross-References: CVE-2014-8106 CVE-2016-10155 CVE-2016-9101
CVE-2016-9776 CVE-2016-9907 CVE-2016-9911
CVE-2016-9921 CVE-2016-9922 CVE-2017-2615
CVE-2017-2620 CVE-2017-5579 CVE-2017-5856
CVE-2017-5898 CVE-2017-5973
Affected Products:
SUSE Linux Enterprise Software Development Kit 11-SP4
SUSE Linux Enterprise Server 11-SP4
SUSE Linux Enterprise Debuginfo 11-SP4
______________________________________________________________________________
An update that solves 14 vulnerabilities and has four fixes
is now available.
Description:
This update for xen fixes several issues.
These security issues were fixed:
- CVE-2017-5973: A infinite loop while doing control transfer in
xhci_kick_epctx allowed privileged user inside the guest to crash the
host process resulting in DoS (bsc#1025188)
- CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was
vulnerable to a memory leakage issue allowing a privileged user to cause
a DoS and/or potentially crash the Qemu process on the host (bsc#1024183)
- CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine
cirrus_bitblt_cputovideo failed to check the memory region, allowing for
an out-of-bounds write that allows for privilege escalation (bsc#1024834)
- CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation
support was vulnerable to a memory leakage issue allowing a privileged
user to leak host memory resulting in DoS (bsc#1024186)
- CVE-2017-5898: The CCID Card device emulator support was vulnerable to
an integer overflow flaw allowing a privileged user to crash the Qemu
process on the host resulting in DoS (bsc#1024307)
- CVE-2017-2615: An error in the bitblt copy operation could have allowed
a malicious guest administrator to cause an out of bounds memory access,
possibly leading to information disclosure or privilege escalation
(bsc#1023004)
- CVE-2014-8106: A heap-based buffer overflow in the Cirrus VGA emulator
allowed local guest users to execute arbitrary code via vectors related
to blit regions (bsc#907805)
- CVE-2017-5579: The 16550A UART serial device emulation support was
vulnerable to a memory leakage issue allowing a privileged user to cause
a DoS and/or potentially crash the Qemu process on the host (bsc#1022627)
- CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a
memory leakage flaw when destroying the USB redirector in
'usbredir_handle_destroy'. A guest user/process could have used this
issue to leak host memory, resulting in DoS for a host (bsc#1014490)
- CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory
leakage issue while processing packet data in 'ehci_init_transfer'. A
guest user/process could have used this issue to leak host memory,
resulting in DoS for the host (bsc#1014507)
- CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable
to a divide by zero issue while copying VGA data. A privileged user
inside guest could have used this flaw to crash the process instance on
the host, resulting in DoS (bsc#1015169)
- CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable
to a divide by zero issue while copying VGA data. A privileged user
inside guest could have used this flaw to crash the process instance on
the host, resulting in DoS (bsc#1015169)
- CVE-2016-9101: A memory leak in hw/net/eepro100.c allowed local guest OS
administrators to cause a denial of service (memory consumption and QEMU
process crash) by repeatedly unplugging an i8255x (PRO100) NIC device
(bsc#1013668)
- CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support
was vulnerable to an infinite loop issue while receiving packets in
'mcf_fec_receive'. A privileged user/process inside guest could have
used this issue to crash the Qemu process on the host leading to DoS
(bsc#1013657)
- A malicious guest could have, by frequently rebooting over extended
periods of time, run the host system out of memory, resulting in a
Denial of Service (DoS) (bsc#1022871)
These non-security issues were fixed:
- bsc#1000195: Prevent panic on CPU0 while booting on SLES 11 SP3
- bsc#1002496: Added support for reloading clvm in block-dmmd block-dmmd
- bsc#987002: Prevent crash of domU' after they were migrated from SP3 HV
to SP4
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 11-SP4:
zypper in -t patch sdksp4-xen-13019=1
- SUSE Linux Enterprise Server 11-SP4:
zypper in -t patch slessp4-xen-13019=1
- SUSE Linux Enterprise Debuginfo 11-SP4:
zypper in -t patch dbgsp4-xen-13019=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64):
xen-devel-4.4.4_14-51.1
- SUSE Linux Enterprise Server 11-SP4 (i586 x86_64):
xen-kmp-default-4.4.4_14_3.0.101_94-51.1
xen-libs-4.4.4_14-51.1
xen-tools-domU-4.4.4_14-51.1
- SUSE Linux Enterprise Server 11-SP4 (x86_64):
xen-4.4.4_14-51.1
xen-doc-html-4.4.4_14-51.1
xen-libs-32bit-4.4.4_14-51.1
xen-tools-4.4.4_14-51.1
- SUSE Linux Enterprise Server 11-SP4 (i586):
xen-kmp-pae-4.4.4_14_3.0.101_94-51.1
- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64):
xen-debuginfo-4.4.4_14-51.1
xen-debugsource-4.4.4_14-51.1
References:
https://www.suse.com/security/cve/CVE-2014-8106.html
https://www.suse.com/security/cve/CVE-2016-10155.html
https://www.suse.com/security/cve/CVE-2016-9101.html
https://www.suse.com/security/cve/CVE-2016-9776.html
https://www.suse.com/security/cve/CVE-2016-9907.html
https://www.suse.com/security/cve/CVE-2016-9911.html
https://www.suse.com/security/cve/CVE-2016-9921.html
https://www.suse.com/security/cve/CVE-2016-9922.html
https://www.suse.com/security/cve/CVE-2017-2615.html
https://www.suse.com/security/cve/CVE-2017-2620.html
https://www.suse.com/security/cve/CVE-2017-5579.html
https://www.suse.com/security/cve/CVE-2017-5856.html
https://www.suse.com/security/cve/CVE-2017-5898.html
https://www.suse.com/security/cve/CVE-2017-5973.html
https://bugzilla.suse.com/1000195
https://bugzilla.suse.com/1002496
https://bugzilla.suse.com/1013657
https://bugzilla.suse.com/1013668
https://bugzilla.suse.com/1014490
https://bugzilla.suse.com/1014507
https://bugzilla.suse.com/1015169
https://bugzilla.suse.com/1016340
https://bugzilla.suse.com/1022627
https://bugzilla.suse.com/1022871
https://bugzilla.suse.com/1023004
https://bugzilla.suse.com/1024183
https://bugzilla.suse.com/1024186
https://bugzilla.suse.com/1024307
https://bugzilla.suse.com/1024834
https://bugzilla.suse.com/1025188
https://bugzilla.suse.com/907805
https://bugzilla.suse.com/987002
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWMI0vox+lLeg9Ub1AQijCw/+Ime0ZOfnMtjAcUaudKV7D9vRapdi8cSa
PAkjZ8LNLOerDZVs4G3e5G3pCIe/pwecXfCwg6NRDfrnGPeEsc9LnM/HBW0CEBKc
m+u7+Dm9F1fXJjYKyly6SAqdkV9Y+M4MSIbnCMl3NgH/HuRPflE3GYwsyGuWfRMZ
MaDobFkAX78aiSxJNV2WxzZgoXz8qS7ESrKFhMrp4od2W5akyDyXvu7K01mJSaxV
dY45roFz8r9SmFNfQCpAjVQpxupcXcKW0BWJj3WrR2/Q6JvXtQ6lZqkdi1g3KXZN
dLwEwAiGF3inImiiV8Hsg6zU5/vHco/D+LNpgzQfDx71zXVQtlobQ5IOsIcC46QA
BiKIS6b/0uxNsb0x/u5+LqF6uyhs/oW9qQcu+ZKT8tb/nR8P+LguAHGzp8iZPJgZ
YkuMiNHdgdQaYHyjTWkEZgEfmZyIb8ok0zJt/PoC+hsEwan2lMBw2C6ROUt2W8ya
osi6Qp5YhQPpuvogW/n45aaysIUYibbpj3tGjMwEzHalduYraESJqMYbAr0YeOfc
TpQMjjBGXfuqseLvP4xwFrvSio0QoKyLW1cUruefFjmV4OmcLYkhsmPtiyJoM4Yl
7pSMg+0h3keY6eSOl4T0XjQW11Uqv2YIG/oSpFCRkoZJCHGGJVCJ+EXSs9X+WknG
Ja73zOevcEw=
=ivLK
-----END PGP SIGNATURE-----