Security update for xen

Announcement ID:	SUSE-SU-2020:1139-1
Rating:	important
References:	bsc#1027519 bsc#1134506 bsc#1155200 bsc#1157490 bsc#1160932 bsc#1161181 bsc#1162040 bsc#1165206 bsc#1167007 bsc#1167152 bsc#1168140 bsc#1168142 bsc#1168143 bsc#1169392
Cross-References:	CVE-2020-11739 CVE-2020-11740 CVE-2020-11741 CVE-2020-11742 CVE-2020-11743 CVE-2020-7211
CVSS scores:	CVE-2020-11739 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2020-11740 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-11741 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2020-11742 ( SUSE ): 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CVE-2020-11742 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-11743 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-7211 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-7211 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5

An update that solves six vulnerabilities and has eight security fixes can now be installed.

Description:

This update for xen to version 4.12.2 fixes the following issues:

Security issues fixed:

• CVE-2020-11742: Bad continuation handling in GNTTABOP_copy (bsc#1169392).
• CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues (bsc#1168140).
• CVE-2020-11739: Missing memory barriers in read-write unlock paths (bsc#1168142).
• CVE-2020-11743: Bad error path in GNTTABOP_map_grant (bsc#1168143).
• CVE-2020-7211: Fixed potential directory traversal using relative paths via tftp server on Windows host (bsc#1161181).
• arm: a CPU may speculate past the ERET instruction (bsc#1160932).

Non-security issues fixed:

• Xenstored Crashed during VM install (bsc#1167152)
• DomU hang: soft lockup CPU #0 stuck under high load (bsc#1165206, bsc#1134506)
• Update API compatibility versions, fixes issues for libvirt. (bsc#1167007, bsc#1157490)
• aacraid blocks xen commands (bsc#1155200)
• Problems Booting Fedora31 VM on sles15 sp1 Xen Dom0 (bsc#1162040).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Software Development Kit 12 SP5
  zypper in -t patch SUSE-SLE-SDK-12-SP5-2020-1139=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-1139=1
• SUSE Linux Enterprise High Performance Computing 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-1139=1
• SUSE Linux Enterprise Server 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-1139=1

Package List:

• SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 x86_64)
  • xen-devel-4.12.2_04-3.11.1
  • xen-debugsource-4.12.2_04-3.11.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5 (x86_64)
  • xen-4.12.2_04-3.11.1
  • xen-doc-html-4.12.2_04-3.11.1
  • xen-tools-4.12.2_04-3.11.1
  • xen-libs-debuginfo-32bit-4.12.2_04-3.11.1
  • xen-libs-32bit-4.12.2_04-3.11.1
  • xen-tools-debuginfo-4.12.2_04-3.11.1
  • xen-debugsource-4.12.2_04-3.11.1
  • xen-libs-4.12.2_04-3.11.1
  • xen-tools-domU-debuginfo-4.12.2_04-3.11.1
  • xen-libs-debuginfo-4.12.2_04-3.11.1
  • xen-tools-domU-4.12.2_04-3.11.1
• SUSE Linux Enterprise High Performance Computing 12 SP5 (x86_64)
  • xen-4.12.2_04-3.11.1
  • xen-doc-html-4.12.2_04-3.11.1
  • xen-tools-4.12.2_04-3.11.1
  • xen-libs-debuginfo-32bit-4.12.2_04-3.11.1
  • xen-libs-32bit-4.12.2_04-3.11.1
  • xen-tools-debuginfo-4.12.2_04-3.11.1
  • xen-debugsource-4.12.2_04-3.11.1
  • xen-libs-4.12.2_04-3.11.1
  • xen-tools-domU-debuginfo-4.12.2_04-3.11.1
  • xen-libs-debuginfo-4.12.2_04-3.11.1
  • xen-tools-domU-4.12.2_04-3.11.1
• SUSE Linux Enterprise Server 12 SP5 (x86_64)
  • xen-4.12.2_04-3.11.1
  • xen-doc-html-4.12.2_04-3.11.1
  • xen-tools-4.12.2_04-3.11.1
  • xen-libs-debuginfo-32bit-4.12.2_04-3.11.1
  • xen-libs-32bit-4.12.2_04-3.11.1
  • xen-tools-debuginfo-4.12.2_04-3.11.1
  • xen-debugsource-4.12.2_04-3.11.1
  • xen-libs-4.12.2_04-3.11.1
  • xen-tools-domU-debuginfo-4.12.2_04-3.11.1
  • xen-libs-debuginfo-4.12.2_04-3.11.1
  • xen-tools-domU-4.12.2_04-3.11.1

References:

• https://www.suse.com/security/cve/CVE-2020-11739.html
• https://www.suse.com/security/cve/CVE-2020-11740.html
• https://www.suse.com/security/cve/CVE-2020-11741.html
• https://www.suse.com/security/cve/CVE-2020-11742.html
• https://www.suse.com/security/cve/CVE-2020-11743.html
• https://www.suse.com/security/cve/CVE-2020-7211.html
• https://bugzilla.suse.com/show_bug.cgi?id=1027519
• https://bugzilla.suse.com/show_bug.cgi?id=1134506
• https://bugzilla.suse.com/show_bug.cgi?id=1155200
• https://bugzilla.suse.com/show_bug.cgi?id=1157490
• https://bugzilla.suse.com/show_bug.cgi?id=1160932
• https://bugzilla.suse.com/show_bug.cgi?id=1161181
• https://bugzilla.suse.com/show_bug.cgi?id=1162040
• https://bugzilla.suse.com/show_bug.cgi?id=1165206
• https://bugzilla.suse.com/show_bug.cgi?id=1167007
• https://bugzilla.suse.com/show_bug.cgi?id=1167152
• https://bugzilla.suse.com/show_bug.cgi?id=1168140
• https://bugzilla.suse.com/show_bug.cgi?id=1168142
• https://bugzilla.suse.com/show_bug.cgi?id=1168143
• https://bugzilla.suse.com/show_bug.cgi?id=1169392