Operating System:

[SUSE]

Published:

20 March 2017

Protect yourself against future threats.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.0726
               SUSE Security Update: Security update for xen
                               20 March 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:          Xen
Publisher:        SUSE
Operating System: SUSE
Impact/Access:    Execute Arbitrary Code/Commands -- Existing Account
                  Increased Privileges            -- Existing Account
                  Denial of Service               -- Existing Account
                  Access Confidential Data        -- Existing Account
Resolution:       Patch/Upgrade
CVE Names:        CVE-2017-2620 CVE-2017-2615 CVE-2016-10155
                  CVE-2016-10024 CVE-2016-10013 CVE-2016-9932
                  CVE-2016-9922 CVE-2016-9921 CVE-2016-9911
                  CVE-2016-9776 CVE-2016-9101 CVE-2014-8106

Reference:        ESB-2017.0637
                  ESB-2017.0627
                  ESB-2017.0606
                  ESB-2017.0593

- --------------------------BEGIN INCLUDED TEXT--------------------

   SUSE Security Update: Security update for xen
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:0718-1
Rating:             important
References:         #1002496 #1012651 #1013657 #1013668 #1014298 
                    #1014507 #1015169 #1016340 #1022871 #1023004 
                    #1024183 #1024834 #907805 
Cross-References:   CVE-2014-8106 CVE-2016-10013 CVE-2016-10024
                    CVE-2016-10155 CVE-2016-9101 CVE-2016-9776
                    CVE-2016-9911 CVE-2016-9921 CVE-2016-9922
                    CVE-2016-9932 CVE-2017-2615 CVE-2017-2620
                   
Affected Products:
                    SUSE OpenStack Cloud 5
                    SUSE Manager Proxy 2.1
                    SUSE Manager 2.1
                    SUSE Linux Enterprise Server 11-SP3-LTSS
                    SUSE Linux Enterprise Point of Sale 11-SP3
                    SUSE Linux Enterprise Debuginfo 11-SP3
______________________________________________________________________________

   An update that solves 12 vulnerabilities and has one errata
   is now available.

Description:


   This update for xen fixes several issues.

   These security issues were fixed:

   - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was
     vulnerable to a memory leakage issue allowing a privileged user to cause
     a DoS and/or potentially crash the Qemu process on the host (bsc#1024183)
   - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine
     cirrus_bitblt_cputovideo failed to check the memory region, allowing for
     an out-of-bounds write that allows for privilege escalation (bsc#1024834)
   - CVE-2017-2615: An error in the bitblt copy operation could have allowed
     a malicious guest administrator to cause an out of bounds memory access,
     possibly leading to information disclosure or privilege escalation
     (bsc#1023004)
   - CVE-2014-8106: A heap-based buffer overflow in the Cirrus VGA emulator
     allowed local guest users to execute arbitrary code via vectors related
     to blit regions (bsc#907805)
   - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory
     leakage issue while processing packet data in 'ehci_init_transfer'. A
     guest user/process could have used this issue to leak host memory,
     resulting in DoS for the host (bsc#1014507)
   - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable
     to a divide by zero issue while copying VGA data. A privileged user
     inside guest could have used this flaw to crash the process instance on
     the host, resulting in DoS (bsc#1015169)
   - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable
     to a divide by zero issue while copying VGA data. A privileged user
     inside guest could have used this flaw to crash the process instance on
     the host, resulting in DoS (bsc#1015169)
   - CVE-2016-10013: Xen allowed local 64-bit x86 HVM guest OS users to gain
     privileges by leveraging mishandling of SYSCALL singlestep during
     emulation (bsc#1016340).
   - CVE-2016-9932: CMPXCHG8B emulation on x86 systems allowed local HVM
     guest OS users to obtain sensitive information from host stack memory
     via a "supposedly-ignored" operand size prefix (bsc#1012651).
   - CVE-2016-9101: A memory leak in hw/net/eepro100.c allowed local guest OS
     administrators to cause a denial of service (memory consumption and QEMU
     process crash) by repeatedly unplugging an i8255x (PRO100) NIC device
     (bsc#1013668)
   - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support
     was vulnerable to an infinite loop issue while receiving packets in
     'mcf_fec_receive'. A privileged user/process inside guest could have
     used this issue to crash the Qemu process on the host leading to DoS
     (bsc#1013657)
   - A malicious guest could have, by frequently rebooting over extended
     periods of time, run the host system out of memory, resulting in a
     Denial of Service (DoS) (bsc#1022871)
   - CVE-2016-10024: Xen allowed local x86 PV guest OS kernel administrators
     to cause a denial of service (host hang or crash) by modifying the
     instruction stream asynchronously while performing certain kernel
     operations (bsc#1014298)

   This non-security issue was fixed:

   - bsc#1002496: Added support for reloading clvm in block-dmmd block-dmmd


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE OpenStack Cloud 5:

      zypper in -t patch sleclo50sp3-xen-13030=1

   - SUSE Manager Proxy 2.1:

      zypper in -t patch slemap21-xen-13030=1

   - SUSE Manager 2.1:

      zypper in -t patch sleman21-xen-13030=1

   - SUSE Linux Enterprise Server 11-SP3-LTSS:

      zypper in -t patch slessp3-xen-13030=1

   - SUSE Linux Enterprise Point of Sale 11-SP3:

      zypper in -t patch sleposp3-xen-13030=1

   - SUSE Linux Enterprise Debuginfo 11-SP3:

      zypper in -t patch dbgsp3-xen-13030=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE OpenStack Cloud 5 (x86_64):

      xen-4.2.5_21-35.1
      xen-doc-html-4.2.5_21-35.1
      xen-doc-pdf-4.2.5_21-35.1
      xen-kmp-default-4.2.5_21_3.0.101_0.47.96-35.1
      xen-libs-32bit-4.2.5_21-35.1
      xen-libs-4.2.5_21-35.1
      xen-tools-4.2.5_21-35.1
      xen-tools-domU-4.2.5_21-35.1

   - SUSE Manager Proxy 2.1 (x86_64):

      xen-4.2.5_21-35.1
      xen-doc-html-4.2.5_21-35.1
      xen-doc-pdf-4.2.5_21-35.1
      xen-kmp-default-4.2.5_21_3.0.101_0.47.96-35.1
      xen-libs-32bit-4.2.5_21-35.1
      xen-libs-4.2.5_21-35.1
      xen-tools-4.2.5_21-35.1
      xen-tools-domU-4.2.5_21-35.1

   - SUSE Manager 2.1 (x86_64):

      xen-4.2.5_21-35.1
      xen-doc-html-4.2.5_21-35.1
      xen-doc-pdf-4.2.5_21-35.1
      xen-kmp-default-4.2.5_21_3.0.101_0.47.96-35.1
      xen-libs-32bit-4.2.5_21-35.1
      xen-libs-4.2.5_21-35.1
      xen-tools-4.2.5_21-35.1
      xen-tools-domU-4.2.5_21-35.1

   - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64):

      xen-kmp-default-4.2.5_21_3.0.101_0.47.96-35.1
      xen-libs-4.2.5_21-35.1
      xen-tools-domU-4.2.5_21-35.1

   - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64):

      xen-4.2.5_21-35.1
      xen-doc-html-4.2.5_21-35.1
      xen-doc-pdf-4.2.5_21-35.1
      xen-libs-32bit-4.2.5_21-35.1
      xen-tools-4.2.5_21-35.1

   - SUSE Linux Enterprise Server 11-SP3-LTSS (i586):

      xen-kmp-pae-4.2.5_21_3.0.101_0.47.96-35.1

   - SUSE Linux Enterprise Point of Sale 11-SP3 (i586):

      xen-kmp-default-4.2.5_21_3.0.101_0.47.96-35.1
      xen-kmp-pae-4.2.5_21_3.0.101_0.47.96-35.1
      xen-libs-4.2.5_21-35.1
      xen-tools-domU-4.2.5_21-35.1

   - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64):

      xen-debuginfo-4.2.5_21-35.1
      xen-debugsource-4.2.5_21-35.1


References:

   https://www.suse.com/security/cve/CVE-2014-8106.html
   https://www.suse.com/security/cve/CVE-2016-10013.html
   https://www.suse.com/security/cve/CVE-2016-10024.html
   https://www.suse.com/security/cve/CVE-2016-10155.html
   https://www.suse.com/security/cve/CVE-2016-9101.html
   https://www.suse.com/security/cve/CVE-2016-9776.html
   https://www.suse.com/security/cve/CVE-2016-9911.html
   https://www.suse.com/security/cve/CVE-2016-9921.html
   https://www.suse.com/security/cve/CVE-2016-9922.html
   https://www.suse.com/security/cve/CVE-2016-9932.html
   https://www.suse.com/security/cve/CVE-2017-2615.html
   https://www.suse.com/security/cve/CVE-2017-2620.html
   https://bugzilla.suse.com/1002496
   https://bugzilla.suse.com/1012651
   https://bugzilla.suse.com/1013657
   https://bugzilla.suse.com/1013668
   https://bugzilla.suse.com/1014298
   https://bugzilla.suse.com/1014507
   https://bugzilla.suse.com/1015169
   https://bugzilla.suse.com/1016340
   https://bugzilla.suse.com/1022871
   https://bugzilla.suse.com/1023004
   https://bugzilla.suse.com/1024183
   https://bugzilla.suse.com/1024834
   https://bugzilla.suse.com/907805

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWM8vQYx+lLeg9Ub1AQgyFw//f4Ab9bddg36IfQR3ysheLWTTUMtOYOY2
ECj4h1/x/G9Ee+NT9VHjoJF/yuWdE3wCrCcXJC8a9KedduYgx9sRU8XQfqth1Kro
36Ofv4VFGBhH5nobZfJt502aOVyhay8/F8IUM6QakAJN6GHm/6R1e1gWsM5/CVIo
yBWFW71yqGoqVWZ1bpErDN8stpB2yTJVPCmdvx0vUW0s05NkrYL9T+EMBk0Qwenr
LxdhvQsGTYctAj6vl3KhwgnD8/hCTwfED8tgVXbYEY8QvQxTQ/d5GZ6OJSfK4XS4
mcd5y5J54DHLJlyyWX9BNvtyPzi2NxhPq0nuGkSm29EWQzFAalI9PwczM9bWyGEM
2wNK7Y4T49to8ENfPbAbb5VFut58pqGtDflnLWi0AJ0inBOXNjIl5gSng9kMdxAH
OnZisj+wT6Uox/wETOijL+x6vDjiPJKyII8jyQcSk8HQoI9YgjvpNkYyqmTDYxYc
ammPZV9OixJN6sWFRhXWqGDZEdyFGboB7Xa4rEx8pgX80SFTlXjVloldJYiFzbTo
8nlONVR3J48QdY2BDi2gunwpb2KFa8MUjB7/ujxpGBWsg95v0pVqS/PIzp0QgYnY
mKU0cKIIdAkJ1/JGCOYnUXBY+ZsyxdqR3YoYBjU+9gCu0rl6OW7afGUQlUPNh2m4
zmTY3mmDb2g=
=08qj
-----END PGP SIGNATURE-----