Cross-References: CVE-2013-3495 CVE-2014-5146 CVE-2014-5149 CVE-2014-8594 CVE-2014-8595 CVE-2014-8866 CVE-2014-8867 CVE-2014-9030 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________
An update that solves 8 vulnerabilities and has 10 fixes is now available.
Description:
xen was updated to fix nine security issues.
These security issues were fixed: - Guest affectable page reference leak in MMU_MACHPHYS_UPDATE handling (CVE-2014-9030). - Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor (CVE-2014-8867). - Excessive checking in compatibility mode hypercall argument translation (CVE-2014-8866). - Guest user mode triggerable VM exits not handled by hypervisor (bnc#9038500). - Missing privilege level checks in x86 emulation of far branches (CVE-2014-8595). - Insufficient restrictions on certain MMU update hypercalls (CVE-2014-8594). - Long latency virtual-mmu operations are not preemptible (CVE-2014-5146, CVE-2014-5149). - Intel VT-d Interrupt Remapping engines can be evaded by native NMI interrupts (CVE-2013-3495).
These non-security issues were fixed: - Corrupted save/restore test leaves orphaned data in xenstore (bnc#903357). - Temporary migration name is not cleaned up after migration (bnc#903359). - Xen save/restore of HVM guests cuts off disk and networking (bnc#866902). - increase limit domUloader to 32MB (bnc#901317). - XEN Host crashes when assigning non-VF device (SR-IOV) to guest (bnc#898772). - Windows 2012 R2 fails to boot up with greater than 60 vcpus (bnc#882089). - Restrict requires on grub2-x86_64-xen to x86_64 hosts - Change default dump directory (bsc#900292). - Update xen2libvirt.py to better detect and handle file formats - libxc: check return values on mmap() and madvise() on xc_alloc_hypercall_buffer() (bnc#897906). - Bug `xen-tools` uninstallable; grub2-x86_64-xen dependency not available (bnc#897614). - Adjust xentop column layout (bnc#896023).
Patch Instructions:
To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 12:
zypper in -t patch SUSE-SLE-SDK-12-2015-8
- SUSE Linux Enterprise Server 12:
zypper in -t patch SUSE-SLE-SERVER-12-2015-8
- SUSE Linux Enterprise Desktop 12:
zypper in -t patch SUSE-SLE-DESKTOP-12-2015-8
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 12 (x86_64):
