SUSE-SU-2016:2507-1

Dashboard / Vulnerabilities / SUSE-SU-2016:2507-1

SUSE-SU-2016:2507-1

Summary: Security update for xen

Details: This update for xen fixes several issues. These security issues were fixed: - CVE-2016-7092: The get_page_from_l3e function in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables (bsc#995785) - CVE-2016-7093: Xen allowed local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation (bsc#995789) - CVE-2016-7094: Buffer overflow in Xen allowed local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update (bsc#995792) - CVE-2016-7154: Use-after-free vulnerability in the FIFO event channel code in Xen allowed local guest OS administrators to cause a denial of service (host crash) and possibly execute arbitrary code or obtain sensitive information via an invalid guest frame number (bsc#997731) - CVE-2016-6836: VMWARE VMXNET3 NIC device allowed privileged user inside the guest to leak information. It occured while processing transmit(tx) queue, when it reaches the end of packet (bsc#994761) - CVE-2016-6888: A integer overflow int the VMWARE VMXNET3 NIC device support, during the initialisation of new packets in the device, could have allowed a privileged user inside guest to crash the Qemu instance resulting in DoS (bsc#994772) - CVE-2016-6833: A use-after-free issue in the VMWARE VMXNET3 NIC device support allowed privileged user inside guest to crash the Qemu instance resulting in DoS (bsc#994775) - CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC device support, causing an OOB read access (bsc#994625) - CVE-2016-6834: A infinite loop during packet fragmentation in the VMWARE VMXNET3 NIC device support allowed privileged user inside guest to crash the Qemu instance resulting in DoS (bsc#994421) - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries (bsc#988675) These non-security issues were fixed: - bsc#993507: virsh detach-disk failing to detach disk - bsc#991934: Xen hypervisor crash in csched_acct - bsc#992224: During boot of Xen Hypervisor, Failed to get contiguous memory for DMA - bsc#970135: New virtualization project clock test randomly fails on Xen - bsc#994136: Unplug also SCSI disks in qemu-xen-traditional for upstream unplug protocol - bsc#994136: xen_platform: unplug also SCSI disks in qemu-xen - bsc#971949: xl: Support (by ignoring) xl migrate --live. xl migrations are always live - bsc#990970: Add PMU support for Intel E7-8867 v4 (fam=6, model=79) - bsc#966467: Live Migration SLES 11 SP3 to SP4 on AMD

References: https://www.suse.com/support/update/announcement/2016/suse-su-20162507-1/, https://bugzilla.suse.com/966467, https://bugzilla.suse.com/970135, https://bugzilla.suse.com/971949, https://bugzilla.suse.com/988675, https://bugzilla.suse.com/990970, https://bugzilla.suse.com/991934, https://bugzilla.suse.com/992224, https://bugzilla.suse.com/993507, https://bugzilla.suse.com/994136, https://bugzilla.suse.com/994421, https://bugzilla.suse.com/994625, https://bugzilla.suse.com/994761, https://bugzilla.suse.com/994772, https://bugzilla.suse.com/994775, https://bugzilla.suse.com/995785, https://bugzilla.suse.com/995789, https://bugzilla.suse.com/995792, https://bugzilla.suse.com/997731, https://www.suse.com/security/cve/CVE-2016-6258, https://www.suse.com/security/cve/CVE-2016-6833, https://www.suse.com/security/cve/CVE-2016-6834, https://www.suse.com/security/cve/CVE-2016-6835, https://www.suse.com/security/cve/CVE-2016-6836, https://www.suse.com/security/cve/CVE-2016-6888, https://www.suse.com/security/cve/CVE-2016-7092, https://www.suse.com/security/cve/CVE-2016-7093, https://www.suse.com/security/cve/CVE-2016-7094, https://www.suse.com/security/cve/CVE-2016-7154