Detections
Analytics

openSUSE Security Update : xen (openSUSE-2019-1403) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

medium Nessus Plugin ID 125242

Language:

Synopsis

The remote openSUSE host is missing a security update.

Description

This update for xen fixes the following issues :

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

 - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)

 - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)

 - CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)

 - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

These updates contain the XEN Hypervisor adjustments, that additionaly also use CPU Microcode updates.

The mitigation can be controlled via the 'mds' commandline option, see the documentation.

For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736

Other fixes :

 - Added code to change LIBXL_HOTPLUG_TIMEOUT at runtime.

 The included README has details about the impact of this change (bsc#1120095)

 - Fixes in Live migrating PV domUs

 An earlier change broke live migration of PV domUs without a device model. The migration would stall for 10 seconds while the domU was paused, which caused network connections to drop. Fix this by tracking the need for a device model within libxl. (bsc#1079730, bsc#1098403, bsc#1111025)

 - Libvirt segfault when crash triggered on top of HVM guest (bsc#1120067)

This update was imported from the SUSE:SLE-15:Update update project.

Solution

Update the affected xen packages.

See Also

https://bugzilla.opensuse.org/show_bug.cgi?id=1027519

https://bugzilla.opensuse.org/show_bug.cgi?id=1079730

https://bugzilla.opensuse.org/show_bug.cgi?id=1098403

https://bugzilla.opensuse.org/show_bug.cgi?id=1111025

https://bugzilla.opensuse.org/show_bug.cgi?id=1111331

https://bugzilla.opensuse.org/show_bug.cgi?id=1120067

https://bugzilla.opensuse.org/show_bug.cgi?id=1120095

https://www.suse.com/support/kb/doc/?id=7023736

Plugin Details

Severity: Medium

ID: 125242

File Name: openSUSE-2019-1403.nasl

Version: 1.6

Type: local

Agent: unix

Published: 5/17/2019

Updated: 5/27/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 3.7

Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2019-11091

CVSS v3

Risk Factor: Medium

Base Score: 5.6

Temporal Score: 5.1

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:xen-debugsource, p-cpe:/a:novell:opensuse:xen-libs-32bit, cpe:/o:novell:opensuse:15.0, p-cpe:/a:novell:opensuse:xen-devel, p-cpe:/a:novell:opensuse:xen-doc-html, p-cpe:/a:novell:opensuse:xen-libs-debuginfo, p-cpe:/a:novell:opensuse:xen-tools-domu-debuginfo, p-cpe:/a:novell:opensuse:xen, p-cpe:/a:novell:opensuse:xen-libs, p-cpe:/a:novell:opensuse:xen-tools, p-cpe:/a:novell:opensuse:xen-libs-32bit-debuginfo, p-cpe:/a:novell:opensuse:xen-tools-debuginfo, p-cpe:/a:novell:opensuse:xen-tools-domu

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/16/2019

Vulnerability Publication Date: 5/30/2019

Reference Information

CVE: CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091