SUSE-SU-2019:1438-1

Dashboard / Vulnerabilities / SUSE-SU-2019:1438-1

SUSE-SU-2019:1438-1

Summary: Security update for libvirt

Details: This update for libvirt fixes the following issues: Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331) - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130: Microarchitectural Load Port Data Sampling (MLPDS) - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) These updates contain the libvirt adjustments, that pass through the new 'md-clear' CPU flag (bsc#1135273). For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736 Other security issues fixed: - CVE-2019-3886: Fixed an information leak which allowed to retrieve the guest hostname under readonly mode (bsc#1131595). - qemu: Add support for using AES secret for SCSI hotplug

References: https://www.suse.com/support/update/announcement/2019/suse-su-20191438-1/, https://bugzilla.suse.com/1111331, https://bugzilla.suse.com/1131595, https://bugzilla.suse.com/1135273, https://www.suse.com/security/cve/CVE-2018-12126, https://www.suse.com/security/cve/CVE-2018-12127, https://www.suse.com/security/cve/CVE-2018-12130, https://www.suse.com/security/cve/CVE-2019-11091, https://www.suse.com/security/cve/CVE-2019-3886