This update for qemu fixes several issues. This security issue was fixed :

  - CVE-2018-3639: Spectre v4 vulnerability mitigation     support for KVM guests (bsc#1092885). Systems with     microprocessors utilizing speculative execution and     speculative execution of memory reads before the     addresses of all prior memory writes are known may allow     unauthorized disclosure of information to an attacker     with local user access via a side-channel analysis. This     patch permits the new x86 cpu feature flag named 'ssbd'     to be presented to the guest, given that the host has     this feature, and KVM exposes it to the guest as well.
    For this feature to be enabled please use the qemu     commandline

    -cpu $MODEL,+spec-ctrl,+ssbd so the guest OS can take     advantage of the feature. spec-ctrl and ssbd support is     also required in the host.

  - CVE-2017-5715: This update has the next round of Spectre     v2 related patches, which now integrates with     corresponding changes in libvirt. A January 2018 release     of qemu initially addressed the Spectre v2 vulnerability     for KVM guests by exposing the spec-ctrl feature for all     x86 vcpu types. We remove that initial patch and now     rely on patches from upstream (bsc#1068032). This update     defines spec_ctrl and ibpb cpu feature flags as well as     new cpu models which are clones of existing models with     either -IBRS or -IBPB added to the end of the model     name. These new vcpu models explicitly include the new     feature(s), whereas the feature flags can be added to     the cpu parameter as with other features. In short, for     continued Spectre v2 protection, ensure that either the     appropriate cpu feature flag is added to the QEMU     command-line, or one of the new cpu models is used.
    Although migration from older versions is supported, the     new cpu features won't be properly exposed to the guest     until it is restarted with the cpu features explicitly     added. A reboot is insufficient.

  - A patch is added to continue to detect Spectre v2     mitigation features (as shown by cpuid), and if found     provide that feature to guests, even if running on older     KVM (kernel) versions which do not yet expose that     feature to QEMU. (bsc#1082276)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

SUSE SLES12 Security Update : qemu (SUSE-SU-2018:1363-1) (Spectre)

medium Nessus Plugin ID 110030

Version 1.14

Version 1.13

Version 1.14 Jan 13, 2026, 11:35 AM Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202601131135
Version 1.13 Oct 3, 2024, 9:04 AM CVSSv2 score source (set to "CVE-2018-3639") CVSSv3 score source (set to "CVE-2017-5715") Plugin Feed: 202410030904