This update for libvirt fixes the following issues :

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)

CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)

CVE-2018-12130: Microarchitectural Load Port Data Sampling (MLPDS)

CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

These updates contain the libvirt adjustments, that pass through the new 'md-clear' CPU flag (bsc#1135273).

For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736

Security issues fixed: CVE-2019-10132: Reject clients unless their UID matches the server UID (bsc#1134348)

Non security issues fixed: delay global firewall setup if no networks are running (bsc#1133229)

add systemd-container dependency to qemu and lxc drivers (bsc#1136109)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2019:1490-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

high Nessus Plugin ID 125922

Version 1.7

Version 1.6

Version 1.5

Version 1.7 May 27, 2024, 11:42 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202405271142
Version 1.6 May 16, 2024, 8:03 AM CVSSv2 score source (set to "CVE-2019-10132") Exploit attributes ("Exploit available" set to "False") Plugin Feed: 202405160803
Version 1.5 Dec 6, 2022, 1:01 AM Reference Plugin Feed: 202212060101