This update for qemu fixes the following issues :

qemu was updated to v3.1.1.1, a stable, bug-fix-only release, which includes 2 fixes we already carry, as well as one additional use- after-free fix in slirp. (CVE-2018-20126 bsc#1119991, CVE-2019-14378 bsc#1143794, and CVE-2019-15890 bsc#1149811 respectively)

Security issues fixed :

CVE-2019-12068: Fixed potential DOS in lsi scsi controller emulation (bsc#1146873)

CVE-2019-11135: Expose taa-no 'feature', indicating CPU does not have the TSX Async Abort vulnerability. (bsc#1152506)

CVE-2018-12207: Expose pschange-mc-no 'feature', indicating CPU does not have the page size change machine check vulnerability (bsc#1117665)

Other issues fixed: Change how this bug gets fixed (bsc#1144087)

Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was removed again in qemu-4.0. (bsc#1079730, bsc#1098403, bsc#1111025, bsc#1145427, bsc#1145774)

Feature support for vfio-ccw dasd ipl (bsc#1145379 jira-SLE-6132)

Additional hardware instruction support for s390, also update qemu linux headers to 5.2-rc1 (bsc#1145436 jira-SLE-6237)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Remove a backslash '\' escape character from 80-qemu-ga.rules (bsc#1153358) Unlike sles 15 or newer guests, The udev rule file of qemu guest agent in sles 12 sp4 or newer guest only needs one escape character.

Fix use-after-free in slirp (CVE-2018-20126 bsc#1119991)

Fix potential DOS in lsi scsi controller emulation (CVE-2019-12068 bsc#1146873)

Expose taa-no 'feature', indicating CPU does not have the TSX Async Abort vulnerability. (CVE-2019-11135 bsc#1152506)

Expose pschange-mc-no 'feature', indicating CPU does not have the page size change machine check vulnerability (CVE-2018-12207 bsc#1155812)

Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE12-SP4

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional. (bsc#1155945)

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack. (bsc#1152497).

CVE-2019-18425: 32-bit PV guest user mode could elevate its privileges to that of the guest kernel. (bsc#1154456).

CVE-2019-18421: A malicious PV guest administrator may have been able to escalate their privilege to that of the host. (bsc#1154458).

CVE-2019-18420: Malicious x86 PV guests may have caused a hypervisor crash, resulting in a Denial of Service (Dos). (bsc#1154448)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional. (bsc#1155945)

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack. (bsc#1152497).

CVE-2019-18423: A malicious guest administrator may cause a hypervisor crash, resulting in a Denial of Service (DoS). (bsc#1154460).

CVE-2019-18422: A malicious ARM guest might contrive to arrange for critical Xen code to run with interrupts erroneously enabled. This could lead to data corruption, denial of service, or possibly even privilege escalation. However a precise attack technique has not been identified. (bsc#1154464)

CVE-2019-18424: An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation.
(bsc#1154461).

CVE-2019-18421: A malicious PV guest administrator may have been able to escalate their privilege to that of the host. (bsc#1154458).

CVE-2019-18425: 32-bit PV guest user mode could elevate its privileges to that of the guest kernel. (bsc#1154456).

CVE-2019-18420: Malicious x86 PV guests may have caused a hypervisor crash, resulting in a Denial of Service (Dos). (bsc#1154448)

Upstream bug fixes (bsc#1027519)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4185-1 advisory.

    Stephan van Schaik, Alyssa Milburn, Sebastian sterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos,     Cristiano Giuffrida, Giorgi Maisuradze, Moritz Lipp, Michael Schwarz, Daniel Gruss, and Jo Van Bulck     discovered that Intel processors using Transactional Synchronization Extensions (TSX) could expose memory     contents previously stored in microarchitectural buffers to a malicious process that is executing on the     same CPU core. A local attacker could use this to expose sensitive information. (CVE-2019-11135)

    It was discovered that the Intel i915 graphics chipsets allowed userspace to modify page table entries via     writes to MMIO from the Blitter Command Streamer and expose kernel memory information. A local attacker     could use this to expose sensitive information or possibly elevate privileges. (CVE-2019-0155)

    Deepak Gupta discovered that on certain Intel processors, the Linux kernel did not properly perform     invalidation on page table updates by virtual guest operating systems. A local attacker in a guest VM     could use this to cause a denial of service (host system crash). (CVE-2018-12207)

    It was discovered that the Intel i915 graphics chipsets could cause a system hang when userspace performed     a read from GT memory mapped input output (MMIO) when the product is in certain low power states. A local     attacker could use this to cause a denial of service. (CVE-2019-0154)

    Hui Peng discovered that the Atheros AR6004 USB Wi-Fi device driver for the Linux kernel did not properly     validate endpoint descriptors returned by the device. A physically proximate attacker could use this to     cause a denial of service (system crash). (CVE-2019-15098)

    Ori Nimron discovered that the AX25 network protocol implementation in the Linux kernel did not properly     perform permissions checks. A local attacker could use this to create a raw socket. (CVE-2019-17052)

    Ori Nimron discovered that the IEEE 802.15.4 Low-Rate Wireless network protocol implementation in the     Linux kernel did not properly perform permissions checks. A local attacker could use this to create a raw     socket. (CVE-2019-17053)

    Ori Nimron discovered that the Appletalk network protocol implementation in the Linux kernel did not     properly perform permissions checks. A local attacker could use this to create a raw socket.
    (CVE-2019-17054)

    Ori Nimron discovered that the modular ISDN network protocol implementation in the Linux kernel did not     properly perform permissions checks. A local attacker could use this to create a raw socket.
    (CVE-2019-17055)

    Ori Nimron discovered that the Near field Communication (NFC) network protocol implementation in the Linux     kernel did not properly perform permissions checks. A local attacker could use this to create a raw     socket. (CVE-2019-17056)

    Nico Waisman discovered that a buffer overflow existed in the Realtek Wi-Fi driver for the Linux kernel     when handling Notice of Absence frames. A physically proximate attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2019-17666)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xen fixes the following issues :

  - CVE-2018-12207: Untrusted virtual machines on Intel CPUs     could exploit a race condition in the Instruction Fetch     Unit of the Intel CPU to cause a Machine Exception     during Page Size Change, causing the CPU core to be     non-functional. (bsc#1155945)

  - CVE-2019-11135: Aborting an asynchronous TSX operation     on Intel CPUs with Transactional Memory support could be     used to facilitate sidechannel information leaks out of     microarchitectural buffers, similar to the previously     described 'Microarchitectural Data Sampling' attack.
    (bsc#1152497).

  - CVE-2019-18423: A malicious guest administrator may     cause a hypervisor crash, resulting in a Denial of     Service (DoS). (bsc#1154460).

  - CVE-2019-18422: A malicious ARM guest might contrive to     arrange for critical Xen code to run with interrupts     erroneously enabled. This could lead to data corruption,     denial of service, or possibly even privilege     escalation. However a precise attack technique has not     been identified. (bsc#1154464)

  - CVE-2019-18424: An untrusted domain with access to a     physical device can DMA into host memory, leading to     privilege escalation. (bsc#1154461).

  - CVE-2019-18421: A malicious PV guest administrator may     have been able to escalate their privilege to that of     the host. (bsc#1154458).

  - CVE-2019-18425: 32-bit PV guest user mode could elevate     its privileges to that of the guest kernel.
    (bsc#1154456).

  - CVE-2019-18420: Malicious x86 PV guests may have caused     a hypervisor crash, resulting in a Denial of Service     (Dos). (bsc#1154448)

  - Upstream bug fixes (bsc#1027519)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for qemu fixes the following issues :

qemu was updated to v3.1.1.1, a stable, bug-fix-only release, which includes 2 fixes we already carry, as well as one additional use- after-free fix in slirp. (CVE-2018-20126 bsc#1119991, CVE-2019-14378 bsc#1143794, and CVE-2019-15890 bsc#1149811 respectively)

Security issues fixed :

  - CVE-2019-12068: Fixed potential DOS in lsi scsi     controller emulation (bsc#1146873)

  - CVE-2019-11135: Expose taa-no 'feature', indicating CPU     does not have the TSX Async Abort vulnerability.
    (bsc#1152506)

  - CVE-2018-12207: Expose pschange-mc-no 'feature',     indicating CPU does not have the page size change     machine check vulnerability (bsc#1117665)

Other issues fixed :

  - Change how this bug gets fixed (bsc#1144087)

  - Disable file locking in the Xen PV disk backend to avoid     locking issues with PV domUs during migration. The     issues triggered by the locking can not be properly     handled in libxl. The locking introduced in qemu-2.10     was removed again in qemu-4.0. (bsc#1079730,     bsc#1098403, bsc#1111025, bsc#1145427, bsc#1145774)

  - Feature support for vfio-ccw dasd ipl (bsc#1145379     jira-SLE-6132)

  - Additional hardware instruction support for s390, also     update qemu linux headers to 5.2-rc1 (bsc#1145436     jira-SLE-6237)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3834 advisory.

    - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
    - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
    - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756882 1756883]     {CVE-2019-0155}
    - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
    - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756882 1756883]     {CVE-2019-0155}
    - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
    - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
    - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756882 1756883]     {CVE-2019-0155}
    - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
    - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
    - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
    - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
    - [x86] tsx: Add config options to set tsx=on|off|auto (Waiman Long) [1766539 1766540] {CVE-2019-11135}
    - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766539     1766540] {CVE-2019-11135}
    - [x86] tsx: Add 'auto' option to the tsx= cmdline parameter (Waiman Long) [1766539 1766540]     {CVE-2019-11135}
    - [x86] speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766539 1766540]     {CVE-2019-11135}
    - [x86] speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766539 1766540]     {CVE-2019-11135}
    - [x86] cpu: Add a 'tsx=' cmdline option with TSX disabled by default (Waiman Long) [1766539 1766540]     {CVE-2019-11135}
    - [x86] cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766539 1766540]     {CVE-2019-11135}
    - [x86] msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766539 1766540] {CVE-2019-11135}
    - [documentation] documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1733009 1690343]     {CVE-2018-12207}
    - [x86] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1733009 1690343]     {CVE-2018-12207}
    - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1733009 1690343]     {CVE-2018-12207}
    - [x86] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
    - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1733009 1690343]     {CVE-2018-12207}
    - [x86] cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1733009 1690343]     {CVE-2018-12207}
    - [x86] Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
    - [x86] kvm: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1733009     1690343] {CVE-2018-12207}
    - [x86] kvm: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1733009 1690343]     {CVE-2018-12207}
    - [x86] kvm: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1733009 1690343]     {CVE-2018-12207}
    - [x86] kvm: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1733009 1690343]     {CVE-2018-12207}
    - [x86] kvm: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1733009 1690343]     {CVE-2018-12207}
    - [x86] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1733009 1690343]     {CVE-2018-12207}
    - [x86] kvm: x86: mmu: Remove unused parameter of __direct_map() (Paolo Bonzini) [1733009 1690343]     {CVE-2018-12207}
    - [virt] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
    - [x86] kvm: mmu: drop vcpu param in gpte_access (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - ocfs2: protect extent tree in     ocfs2_prepare_inode_for_write (Shuning Zhang) [Orabug:
    30036349]

  - ocfs2: direct-IO: protect get_blocks (Junxiao Bi)     [Orabug: 30036349]

  - SUNRPC: Remove xprt_connect_status (Trond Myklebust)     [Orabug: 30165838]

  - SUNRPC: Handle ENETDOWN errors (Trond Myklebust)     [Orabug: 30165838]

  - vhost: make sure log_num < in_num (yongduan) [Orabug:
    30312787] (CVE-2019-14835)

  - vhost: block speculation of translated descriptors     (Michael S. Tsirkin) [Orabug: 30312787] (CVE-2019-14835)

  - vhost: Fix Spectre V1 vulnerability (Jason Wang)     [Orabug: 30312787]

  - array_index_nospec: Sanitize speculative array     de-references (Dan Williams) [Orabug: 30312787]

  - net: hsr: fix memory leak in hsr_dev_finalize (Mao     Wenan) [Orabug: 30444853] (CVE-2019-16995)

  - ieee802154: enforce CAP_NET_RAW for raw sockets (Ori     Nimron) [Orabug: 30444946] (CVE-2019-17053)

  - mISDN: enforce CAP_NET_RAW for raw sockets (Ori Nimron)     [Orabug: 30445158] (CVE-2019-17055)

  - net: sit: fix memory leak in sit_init_net (Mao Wenan)     [Orabug: 30445305] (CVE-2019-16994)

  - media: dvb: usb: fix use after free in     dvb_usb_device_exit (Oliver Neukum) [Orabug: 30490491]     (CVE-2019-15213)

  - media: cpia2_usb: first wake up, then free in disconnect     (Oliver Neukum) [Orabug: 30511741] (CVE-2019-15215)

  - media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in     zr364xx_vidioc_querycap (Vandana BN) [Orabug: 30532774]     (CVE-2019-15217)

  - target: Propagate backend read-only to core_tpg_add_lun     (Nicholas Bellinger) [Orabug: 30538419]

  - kvm: mmu: ITLB_MULTIHIT mitigation selection (Kanth     Ghatraju) [Orabug: 30539766]

  - cpu/speculation: Uninline and export CPU mitigations     helpers (Kanth Ghatraju) [Orabug: 30539766]

  - rds: Use correct conn when dropping connections due to     cancel (H&aring kon Bugge) [Orabug: 30316058]

  - rds: ib: Optimize rds_ib_laddr_check (H&aring kon Bugge)     [Orabug: 30327671]

  - rds: Bring loop-back peer down as well (H&aring kon     Bugge) [Orabug: 30271704]

  - rds: ib: Avoid connect retry on loopback connections     (H&aring kon Bugge) 

  - rds: ib: Qualify CM REQ duplicate detection with     connection being up (H&aring kon Bugge) [Orabug:
    30062150]

  - rds: Further prioritize local loop-back connections     (H&aring kon Bugge) 

  - rds: Fix initial zero delay when queuing re-connect work     (H&aring kon Bugge) 

  - rds: Re-introduce separate work-queue for local     connections (H&aring kon Bugge) [Orabug: 30062150]

  - rds: Re-factor and avoid superfluous queuing of shutdown     work (H&aring kon Bugge) [Orabug: 29994551]

  - rds: ib: Flush ARP cache when connection attempt is     rejected (H&aring kon Bugge) [Orabug: 29994550]

  - rds: ib: Fix incorrect setting of cp_reconnect_racing     (H&aring kon Bugge) 

  - RDMA/cma: Make # CM retries configurable (H&aring kon     Bugge) [Orabug: 29994555]

  - rds: Re-factor and avoid superfluous queuing of     reconnect work (H&aring kon Bugge) [Orabug: 29994558]

  - rds: ib: Correct the cm_id compare commit (H&aring kon     Bugge) [Orabug: 29994560]

  - rds: Increase entropy in hashing (H&aring kon Bugge)     [Orabug: 29994561]

  - rds: ib: Resurrect the CQs instead of delete+create     (H&aring kon Bugge) 

  - rds: Avoid queuing superfluous send and recv work     (H&aring kon Bugge) 

  - x86/tsx: Add config options to set tsx=on|off|auto     (Michal Hocko) [Orabug: 30517133] (CVE-2019-11135)

  - x86/speculation/taa: Add documentation for TSX Async     Abort (Pawan Gupta) [Orabug: 30517133] (CVE-2019-11135)

  - x86/tsx: Add 'auto' option to the tsx= cmdline parameter     (Pawan Gupta) [Orabug: 30517133] (CVE-2019-11135)

  - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled     (Pawan Gupta) [Orabug: 30517133] (CVE-2019-11135)

  - x86/speculation/taa: Add sysfs reporting for TSX Async     Abort (Pawan Gupta) [Orabug: 30517133] (CVE-2019-11135)

  - x86/speculation/taa: Add mitigation for TSX Async Abort     (Kanth Ghatraju) [Orabug: 30517133] (CVE-2019-11135)

  - x86/cpu: Add a 'tsx=' cmdline option with TSX disabled     by default (Pawan Gupta) [Orabug: 30517133]     (CVE-2019-11135)

  - x86/cpu: Add a helper function x86_read_arch_cap_msr     (Pawan Gupta) [Orabug: 30517133] (CVE-2019-11135)

  - x86/msr: Add the IA32_TSX_CTRL MSR (Pawan Gupta)     [Orabug: 30517133] (CVE-2019-11135)

  - kvm: x86: mmu: Recovery of shattered NX large pages     (Junaid Shahid) [Orabug: 30517059] (CVE-2018-12207)

  - kvm: Add helper function for creating VM worker threads     (Junaid Shahid) [Orabug: 30517059] (CVE-2018-12207)

  - kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini)     [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: remove now unneeded hugepage gfn adjustment     (Paolo Bonzini) [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: make FNAME(fetch) and __direct_map more     similar (Paolo Bonzini) [Orabug: 30517059]     (CVE-2018-12207)

  - kvm: x86: Do not release the page inside mmu_set_spte     (Junaid Shahid) [Orabug: 30517059] (CVE-2018-12207)

  - x86/cpu: Add Tremont to the cpu vulnerability whitelist     (Pawan Gupta) [Orabug: 30517059] (CVE-2018-12207)

  - x86: Add ITLB_MULTIHIT bug infrastructure (Pawan Gupta)     [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Move mapping_level_dirty_bitmap call in     mapping_level (Takuya Yoshikawa) [Orabug: 30517059]     (CVE-2018-12207)

  - Revert 'KVM: x86: use the fast way to invalidate all     pages' (Sean Christopherson) [Orabug: 30517059]     (CVE-2018-12207)

  - kvm: Convert kvm_lock to a mutex (Junaid Shahid)     [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Simplify force_pt_level calculation code     in FNAME(page_fault) (Takuya Yoshikawa) [Orabug:
    30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Make force_pt_level bool (Takuya     Yoshikawa) [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Remove unused parameter parent_pte from     kvm_mmu_get_page (Takuya Yoshikawa) [Orabug: 30517059]     (CVE-2018-12207)

  - KVM: x86: extend usage of RET_MMIO_PF_* constants (Paolo     Bonzini) [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Make mmu_set_spte return emulate value     (Takuya Yoshikawa) [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Move parent_pte handling from     kvm_mmu_get_page to link_shadow_page (Takuya Yoshikawa)     [Orabug: 30517059] (CVE-2018-12207)

  - KVM: x86: MMU: Move initialization of parent_ptes out     from kvm_mmu_alloc_page (Takuya Yoshikawa) [Orabug:
    30517059] (CVE-2018-12207)

  - scsi: qla2xxx: Fix NULL pointer crash due to probe     failure [Orabug: 30161119]

  - i2c: core-smbus: prevent stack corruption on read     I2C_BLOCK_DATA (Jeremy Compostella) [Orabug: 30210503]     (CVE-2017-18551)

  - scsi: qla2xxx: Ability to process multiple SGEs in     Command SGL for CT passthrough commands. (Giridhar     Malavali) [Orabug: 30256423]

  - net-sysfs: Fix mem leak in netdev_register_kobject     (YueHaibing) [Orabug: 30350263] (CVE-2019-15916)

  - Drivers: hv: vmbus: add special crash handler (Vitaly     Kuznetsov)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:14218-1 advisory.

  - An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket     option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general     protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be     triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after     namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of     the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before     4.9.187. (CVE-2017-18509)

  - An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an     out of bounds write in the function i2c_smbus_xfer_emulated. (CVE-2017-18551)

  - Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R)     Processors may allow an authenticated user to potentially enable denial of service of the host system via     local access. (CVE-2018-12207)

  - An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists,     related to xfs_fs_fill_super failure. (CVE-2018-20976)

  - Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory     entry lists. (CVE-2019-10220)

  - TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11135)

  - An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux     kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer     'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be     supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm'     device could use this flaw to crash the host kernel, resulting in a denial of service or potentially     escalating privileges on the system. (CVE-2019-14821)

  - A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost     functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A     privileged guest user able to pass descriptors with invalid length to the host when migration is underway,     could use this flaw to increase their privileges on the host. (CVE-2019-14835)

  - check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to     kernel stack exhaustion. (CVE-2019-15118)

  - An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB     device in the drivers/usb/misc/rio500.c driver. (CVE-2019-15212)

  - An issue was discovered in the Linux kernel before 5.0.14. There is a NULL pointer dereference caused by a     malicious USB device in the drivers/usb/misc/yurex.c driver. (CVE-2019-15216)

  - An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a     malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver. (CVE-2019-15217)

  - An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a     malicious USB device in the drivers/usb/misc/sisusbvga/sisusb.c driver. (CVE-2019-15219)

  - An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a     malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c driver.
    (CVE-2019-15291)

  - An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit,     related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c.
    (CVE-2019-15292)

  - drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via     crafted USB device traffic (which may be remote via usbip or usbredir). (CVE-2019-15505)

  - In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS     expander discovery fails. This will cause a BUG and denial of service. (CVE-2019-15807)

  - A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x     through 4.9.190, 4.14.x through 4.14.141, 4.19.x through 4.19.69, and 5.2.x through 5.2.11. Misuse of the     upstream x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg() commit reintroduced the Spectre     vulnerability that it aimed to eliminate. This occurred because the backport process depends on cherry     picking specific commits, and because two (correctly ordered) code lines were swapped. (CVE-2019-15902)

  - An issue was discovered in the Linux kernel before 4.20.2. An out-of-bounds access exists in the function     build_audio_procunit in the file sound/usb/mixer.c. (CVE-2019-15927)

  - drivers/net/wireless/marvell/libertas/if_sdio.c in the Linux kernel 5.2.14 does not check the     alloc_workqueue return value, leading to a NULL pointer dereference. (CVE-2019-16232)

  - drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value,     leading to a NULL pointer dereference. (CVE-2019-16233)

  - drivers/net/wireless/intel/iwlwifi/pcie/trans.c in the Linux kernel 5.2.14 does not check the     alloc_workqueue return value, leading to a NULL pointer dereference. (CVE-2019-16234)

  - An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write()     properly, which causes an i_size_read() infinite loop and denial of service on SMP systems.
    (CVE-2019-16413)

  - ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2     does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka     CID-0614e2b73768. (CVE-2019-17052)

  - ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel     through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket,     aka CID-e69dbd4619e7. (CVE-2019-17053)

  - atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2     does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka     CID-6cc03e8aa36c. (CVE-2019-17054)

  - base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through     5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka     CID-b91ee4aa2a21. (CVE-2019-17055)

  - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a     long SSID IE, leading to a Buffer Overflow. (CVE-2019-17133)

  - In the Android kernel in Pixel C USB monitor driver there is a possible OOB write due to a missing bounds     check. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation. (CVE-2019-9456)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for xen fixes the following issues :

CVE-2018-12207: Fixed a race condition where untrusted virtual machines could have been using the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional (bsc#1155945 XSA-304).

CVE-2018-19965: Fixed a DoS from attempting to use INVPCID with a non-canonical addresses (bsc#1115045 XSA-279).

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate side-channel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack. (bsc#1152497 XSA-305).

CVE-2019-12067: Fixed a NULL pointer dereference in QEMU AHCI (bsc#1145652).

CVE-2019-12068: Fixed an infinite loop while executing script (bsc#1146874).

CVE-2019-12155: Fixed a NULL pointer dereference while releasing spice resources (bsc#1135905).

CVE-2019-14378: Fixed a heap buffer overflow during packet reassembly in slirp networking implementation (bsc#1143797).

CVE-2019-15890: Fixed a use-after-free during packet reassembly (bsc#1149813).

CVE-2019-17340: Fixed grant table transfer issues on large hosts (XSA-284 bsc#1126140).

CVE-2019-17341: Fixed a race with pass-through device hotplug (XSA-285 bsc#1126141).

CVE-2019-17342: Fixed steal_page violating page_struct access discipline (XSA-287 bsc#1126192).

CVE-2019-17343: Fixed an inconsistent PV IOMMU discipline (XSA-288 bsc#1126195).

CVE-2019-17344: Fixed a missing preemption in x86 PV page table unvalidation (XSA-290 bsc#1126196).

CVE-2019-17347: Fixed a PV kernel context switch corruption (XSA-293 bsc#1126201).

CVE-2019-18420: Fixed a hypervisor crash that could be caused by malicious x86 PV guests, resulting in a denial of service (bsc#1154448 XSA-296).

CVE-2019-18421: Fixed a privilege escalation through malicious PV guest administrators (bsc#1154458 XSA-299).

CVE-2019-18424: Fixed a privilege escalation through DMA to physical devices by untrusted domains (bsc#1154461 XSA-302).

CVE-2019-18425: Fixed a privilege escalation from 32-bit PV guest used mode (bsc#1154456 XSA-298).

CVE-2019-19577: Fixed an issue where a malicious guest administrator could have caused Xen to access data structures while they are being modified leading to a crash (bsc#1158007 XSA-311).

CVE-2019-19578: Fixed an issue where a malicious or buggy PV guest could have caused hypervisor crash resulting in denial of service affecting the entire host (bsc#1158005 XSA-309).

CVE-2019-19579: Fixed a privilege escalation where an untrusted domain with access to a physical device can DMA into host memory (bsc#1157888 XSA-306).

CVE-2019-19580: Fixed a privilege escalation where a malicious PV guest administrator could have been able to escalate their privilege to that of the host (bsc#1158006 XSA-310).

CVE-2019-19581: Fixed a potential out of bounds on 32-bit Arm (bsc#1158003 XSA-307).

CVE-2019-19583: Fixed improper checks which could have allowed HVM/PVH guest userspace code to crash the guest, leading to a guest denial of service (bsc#1158004 XSA-308).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access. (CVE-2018-12207)

Impact

A privileged guest user may use this flaw to induce a hardware Machine Check Error (MCE) that halts the host processor and resultsin a denial-of-service (DoS) scenario.

This is a hardware issue and requires kernel updates to remediate.
This issue impacts all BIG-IP platforms using the following Intel processor families :

Xeon

Pentium Gold

Core X-series

Core i

Celeron G

The following BIG-IP platforms are vulnerable :

BIG-IP 2000s, 2200s, 4000s, 4200v, 5000s, 5050s, 5200v,5250v, 5250v fips, 7000s, 7200v , 7200v FIPS , 7250v series

BIG-IP 10000s, 10050s, 10055s, 10150s NEBS, 10200v, 10200v FIPS, 10200v SSL, 10250v, 10255v, 10350v, 10350v NEBS, 11050 NEBS, 12250vseries

BIG-IP iSeries platforms:i850, i2x00,i4x00, i5x00, i5820-DF, i7x00, i7x00-D2, i7820-DF, i10x00 / i10x00-D2, i11x00, i11x00-DS, i15x00

VIPRION B2100, VIPRION B2150 , VIPRION B2250, VIPRION B4300 , VIPRION B4340N

Enterprise Manager 4000

BIG-IQ 7000

The following BIG-IP platforms are not vulnerable :

BIG-IP 800, 1600, 3600, 3900, 4200, 4340, 6900 series

BIG-IP 8900, 8950, 1100, 11050, 11050 FIPS series

ID	Name	Product	Family	Published	Updated	Severity
130953	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2019:2955-1)	Nessus	SuSE Local Security Checks	11/13/2019	4/11/2024	high
130954	SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2019:2956-1)	Nessus	SuSE Local Security Checks	11/13/2019	1/13/2021	medium
130958	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2019:2960-1)	Nessus	SuSE Local Security Checks	11/13/2019	4/11/2024	critical
130959	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2019:2961-1)	Nessus	SuSE Local Security Checks	11/13/2019	4/11/2024	critical
130965	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4185-1)	Nessus	Ubuntu Local Security Checks	11/13/2019	8/28/2024	high
131062	openSUSE Security Update : xen (openSUSE-2019-2508)	Nessus	SuSE Local Security Checks	11/15/2019	4/11/2024	critical
131064	openSUSE Security Update : qemu (openSUSE-2019-2510)	Nessus	SuSE Local Security Checks	11/15/2019	4/11/2024	high
131110	Oracle Linux 7 : kernel (ELSA-2019-3834)	Nessus	Oracle Linux Local Security Checks	11/18/2019	2/9/2026	medium
131208	OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0056)	Nessus	OracleVM Local Security Checks	11/22/2019	4/10/2024	high
150533	SUSE SLES11 Security Update : kernel (SUSE-SU-2019:14218-1)	Nessus	SuSE Local Security Checks	6/10/2021	12/26/2023	critical
133763	SUSE SLES12 Security Update : xen (SUSE-SU-2020:0388-1)	Nessus	SuSE Local Security Checks	2/18/2020	3/27/2024	critical
138230	F5 Networks BIG-IP : Intel MCE vulnerability (K17269881)	Nessus	F5 Networks Local Security Checks	7/9/2020	11/3/2023	medium

Detections

Analytics

Plugins Search

high

medium

critical

critical

high

critical

high

medium

high

critical

critical

medium