copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2016.0803 - [SUSE] xen: Multiple vulnerabilities

Date: 29 March 2016
References: ESB-2015.3218  ESB-2016.0161  ESB-2016.0416  ESB-2016.1622  ESB-2016.1675  ESB-2016.2658  

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.0803
               SUSE Security Update: Security update for xen
                               29 March 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:          xen
Publisher:        SUSE
Operating System: SUSE
Impact/Access:    Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                  Increased Privileges            -- Existing Account      
                  Denial of Service               -- Remote/Unauthenticated
                  Access Confidential Data        -- Existing Account      
                  Reduced Security                -- Existing Account      
Resolution:       Patch/Upgrade
CVE Names:        CVE-2016-2841 CVE-2016-2538 CVE-2016-2392
                  CVE-2016-2391 CVE-2016-2271 CVE-2016-2270
                  CVE-2016-2198 CVE-2016-1981 CVE-2016-1922
                  CVE-2016-1714 CVE-2016-1571 CVE-2016-1570
                  CVE-2016-1568 CVE-2015-8818 CVE-2015-8817
                  CVE-2015-8745 CVE-2015-8744 CVE-2015-8743
                  CVE-2015-8619 CVE-2015-8613 CVE-2015-8568
                  CVE-2015-8567 CVE-2015-8558 CVE-2015-8555
                  CVE-2015-8554 CVE-2015-8550 CVE-2015-8504
                  CVE-2015-8345 CVE-2015-7549 CVE-2015-7512
                  CVE-2015-6855 CVE-2015-5278 CVE-2015-1779
                  CVE-2014-9718 CVE-2014-7815 CVE-2014-3689
                  CVE-2014-3640 CVE-2014-0222 CVE-2013-4539
                  CVE-2013-4538 CVE-2013-4537 CVE-2013-4534
                  CVE-2013-4533  

Reference:        ESB-2016.0416
                  ESB-2016.0161
                  ESB-2015.3218

- --------------------------BEGIN INCLUDED TEXT--------------------

   SUSE Security Update: Security update for xen
______________________________________________________________________________

Announcement ID:    SUSE-SU-2016:0873-1
Rating:             important
References:         #864391 #864655 #864769 #864805 #864811 #877642 
                    #897654 #901508 #902737 #924018 #928393 #945404 
                    #945989 #954872 #956829 #957162 #957698 #957988 
                    #958007 #958009 #958491 #958523 #958917 #959005 
                    #959332 #959387 #959695 #960334 #960707 #960725 
                    #960835 #960861 #960862 #961332 #961358 #961691 
                    #962320 #963782 #963923 #964413 #965315 #965317 
                    #967012 #967013 #967969 #969121 #969122 #969350 
                    
Cross-References:   CVE-2013-4533 CVE-2013-4534 CVE-2013-4537
                    CVE-2013-4538 CVE-2013-4539 CVE-2014-0222
                    CVE-2014-3640 CVE-2014-3689 CVE-2014-7815
                    CVE-2014-9718 CVE-2015-1779 CVE-2015-5278
                    CVE-2015-6855 CVE-2015-7512 CVE-2015-7549
                    CVE-2015-8345 CVE-2015-8504 CVE-2015-8550
                    CVE-2015-8554 CVE-2015-8555 CVE-2015-8558
                    CVE-2015-8567 CVE-2015-8568 CVE-2015-8613
                    CVE-2015-8619 CVE-2015-8743 CVE-2015-8744
                    CVE-2015-8745 CVE-2015-8817 CVE-2015-8818
                    CVE-2016-1568 CVE-2016-1570 CVE-2016-1571
                    CVE-2016-1714 CVE-2016-1922 CVE-2016-1981
                    CVE-2016-2198 CVE-2016-2270 CVE-2016-2271
                    CVE-2016-2391 CVE-2016-2392 CVE-2016-2538
                    CVE-2016-2841
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 12-SP1
                    SUSE Linux Enterprise Server 12-SP1
                    SUSE Linux Enterprise Desktop 12-SP1
______________________________________________________________________________

   An update that solves 43 vulnerabilities and has 5 fixes is
   now available.

Description:

   xen was updated to fix 44 security issues.

   These security issues were fixed:
   - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in
     hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or
     possibly execute arbitrary code via a crafted s->rx_level value in a
     savevm image (bsc#864655).
   - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote
     attackers to cause a denial of service or possibly execute arbitrary
     code via vectors related to IRQDest elements (bsc#864811).
   - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed
     remote attackers to execute arbitrary code via a crafted arglen value in
     a savevm image (bsc#864391).
   - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in
     hw/display/ssd0323.c allowed remote attackers to cause a denial of
     service (memory corruption) or possibly execute arbitrary code via
     crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and
     row_end values; or (5) col_star and col_end values in a savevm image
     (bsc#864769).
   - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in
     hw/input/tsc210x.c might have allowed remote attackers to execute
     arbitrary code via a crafted (1) precision, (2) nextprecision, (3)
     function, or (4) nextfunction value in a savevm image (bsc#864805).
   - CVE-2014-0222: Integer overflow in the qcow_open function in
     block/qcow.c allowed remote attackers to cause a denial of service
     (crash) via a large L2 table in a QCOW version 1 image (bsc#877642).
   - CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users
     to cause a denial of service (NULL pointer dereference) by sending a udp
     packet with a value of 0 in the source port and address, which triggers
     access of an uninitialized socket (bsc#897654).
   - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed
     local guest users to write to qemu memory locations and gain privileges
     via unspecified parameters related to rectangle handling (bsc#901508).
   - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote
     attackers to cause a denial of service (crash) via a small
     bytes_per_pixel value (bsc#902737).
   - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE
     functionality had multiple interpretations of a function's return value,
     which allowed guest OS users to cause a host OS denial of service
     (memory consumption or infinite loop, and system crash) via a PRDT with
     zero complete sectors, related to the bmdma_prepare_buf and
     ahci_dma_prepare_buf functions (bsc#928393).
   - CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers
     to cause a denial of service (memory and CPU consumption) via a large
     (1) websocket payload or (2) HTTP headers section (bsc#924018).
   - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989).
   - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands
     accepted by an ATAPI device, which allowed guest users to cause a denial
     of service or possibly have unspecified other impact via certain IDE
     commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty
     drive, which triggers a divide-by-zero error and instance crash
     (bsc#945404).
   - CVE-2015-7512: Buffer overflow in the pcnet_receive function in
     hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote
     attackers to cause a denial of service (guest OS crash) or execute
     arbitrary code via a large packet (bsc#957162).
   - CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958917).
   - CVE-2015-8345: eepro100: infinite loop in processing command block list
     (bsc#956829).
   - CVE-2015-8504: VNC: floating point exception (bsc#958491).
   - CVE-2015-8550: Paravirtualized drivers were incautious about shared
     memory contents (XSA-155) (bsc#957988).
   - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164)
     (bsc#958007).
   - CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization
     (XSA-165) (bsc#958009).
   - CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS
     (bsc#959005).
   - CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387).
   - CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387).
   - CVE-2015-8613: SCSI: stack based buffer overflow in
     megasas_ctrl_get_info (bsc#961358).
   - CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334).
   - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions
     (bsc#960725).
   - CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash
     via assert(2) call (bsc#960835).
   - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call
     (bsc#960707).
   - CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault
     (I) (bsc#969121).
   - CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault
     (II) (bsc#969122).
   - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands
     (bsc#961332).
   - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed
     local PV guests to obtain sensitive information, cause a denial of
     service, gain privileges, or have unspecified other impact via a crafted
     page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2)
     MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3)
     unknown vectors related to page table updates (bsc#960861).
   - CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address
     (XSA-168) (bsc#960862).
   - CVE-2016-1714: nvram: OOB r/w access in processing firmware
     configurations (bsc#961691).
   - CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962320).
   - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov
     routines (bsc#963782).
   - CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write
     (bsc#964413).
   - CVE-2016-2270: Xen allowed local guest administrators to cause a denial
     of service (host reboot) via vectors related to multiple mappings of
     MMIO pages with different cachability settings (bsc#965315).
   - CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM
     guest users to cause a denial of service (guest crash) via vectors
     related to a non-canonical RIP (bsc#965317).
   - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL
     pointer dereference (bsc#967013).
   - CVE-2016-2392: NULL pointer dereference in remote NDIS control message
     handling (bsc#967012).
   - CVE-2016-2538: Integer overflow in remote NDIS control message handling
     (bsc#967969).
   - CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350).
   - XSA-166: ioreq handling possibly susceptible to multiple read issue
     (bsc#958523).

   These non-security issues were fixed:
   - bsc#954872: script block-dmmd not working as expected
   - bsc#957698: DOM0 can't bring up on Dell PC
   - bsc#963923: domain weights not honored when sched-credit tslice is
     reduced
   - bsc#959332: SLES12SP1 PV guest is unreachable when restored or migrated
   - bsc#959695: Missing docs for xen


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 12-SP1:

      zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-508=1

   - SUSE Linux Enterprise Server 12-SP1:

      zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-508=1

   - SUSE Linux Enterprise Desktop 12-SP1:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-508=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 12-SP1 (x86_64):

      xen-debugsource-4.5.2_06-7.1
      xen-devel-4.5.2_06-7.1

   - SUSE Linux Enterprise Server 12-SP1 (x86_64):

      xen-4.5.2_06-7.1
      xen-debugsource-4.5.2_06-7.1
      xen-doc-html-4.5.2_06-7.1
      xen-kmp-default-4.5.2_06_k3.12.53_60.30-7.1
      xen-kmp-default-debuginfo-4.5.2_06_k3.12.53_60.30-7.1
      xen-libs-32bit-4.5.2_06-7.1
      xen-libs-4.5.2_06-7.1
      xen-libs-debuginfo-32bit-4.5.2_06-7.1
      xen-libs-debuginfo-4.5.2_06-7.1
      xen-tools-4.5.2_06-7.1
      xen-tools-debuginfo-4.5.2_06-7.1
      xen-tools-domU-4.5.2_06-7.1
      xen-tools-domU-debuginfo-4.5.2_06-7.1

   - SUSE Linux Enterprise Desktop 12-SP1 (x86_64):

      xen-4.5.2_06-7.1
      xen-debugsource-4.5.2_06-7.1
      xen-kmp-default-4.5.2_06_k3.12.53_60.30-7.1
      xen-kmp-default-debuginfo-4.5.2_06_k3.12.53_60.30-7.1
      xen-libs-32bit-4.5.2_06-7.1
      xen-libs-4.5.2_06-7.1
      xen-libs-debuginfo-32bit-4.5.2_06-7.1
      xen-libs-debuginfo-4.5.2_06-7.1


References:

   https://www.suse.com/security/cve/CVE-2013-4533.html
   https://www.suse.com/security/cve/CVE-2013-4534.html
   https://www.suse.com/security/cve/CVE-2013-4537.html
   https://www.suse.com/security/cve/CVE-2013-4538.html
   https://www.suse.com/security/cve/CVE-2013-4539.html
   https://www.suse.com/security/cve/CVE-2014-0222.html
   https://www.suse.com/security/cve/CVE-2014-3640.html
   https://www.suse.com/security/cve/CVE-2014-3689.html
   https://www.suse.com/security/cve/CVE-2014-7815.html
   https://www.suse.com/security/cve/CVE-2014-9718.html
   https://www.suse.com/security/cve/CVE-2015-1779.html
   https://www.suse.com/security/cve/CVE-2015-5278.html
   https://www.suse.com/security/cve/CVE-2015-6855.html
   https://www.suse.com/security/cve/CVE-2015-7512.html
   https://www.suse.com/security/cve/CVE-2015-7549.html
   https://www.suse.com/security/cve/CVE-2015-8345.html
   https://www.suse.com/security/cve/CVE-2015-8504.html
   https://www.suse.com/security/cve/CVE-2015-8550.html
   https://www.suse.com/security/cve/CVE-2015-8554.html
   https://www.suse.com/security/cve/CVE-2015-8555.html
   https://www.suse.com/security/cve/CVE-2015-8558.html
   https://www.suse.com/security/cve/CVE-2015-8567.html
   https://www.suse.com/security/cve/CVE-2015-8568.html
   https://www.suse.com/security/cve/CVE-2015-8613.html
   https://www.suse.com/security/cve/CVE-2015-8619.html
   https://www.suse.com/security/cve/CVE-2015-8743.html
   https://www.suse.com/security/cve/CVE-2015-8744.html
   https://www.suse.com/security/cve/CVE-2015-8745.html
   https://www.suse.com/security/cve/CVE-2015-8817.html
   https://www.suse.com/security/cve/CVE-2015-8818.html
   https://www.suse.com/security/cve/CVE-2016-1568.html
   https://www.suse.com/security/cve/CVE-2016-1570.html
   https://www.suse.com/security/cve/CVE-2016-1571.html
   https://www.suse.com/security/cve/CVE-2016-1714.html
   https://www.suse.com/security/cve/CVE-2016-1922.html
   https://www.suse.com/security/cve/CVE-2016-1981.html
   https://www.suse.com/security/cve/CVE-2016-2198.html
   https://www.suse.com/security/cve/CVE-2016-2270.html
   https://www.suse.com/security/cve/CVE-2016-2271.html
   https://www.suse.com/security/cve/CVE-2016-2391.html
   https://www.suse.com/security/cve/CVE-2016-2392.html
   https://www.suse.com/security/cve/CVE-2016-2538.html
   https://www.suse.com/security/cve/CVE-2016-2841.html
   https://bugzilla.suse.com/864391
   https://bugzilla.suse.com/864655
   https://bugzilla.suse.com/864769
   https://bugzilla.suse.com/864805
   https://bugzilla.suse.com/864811
   https://bugzilla.suse.com/877642
   https://bugzilla.suse.com/897654
   https://bugzilla.suse.com/901508
   https://bugzilla.suse.com/902737
   https://bugzilla.suse.com/924018
   https://bugzilla.suse.com/928393
   https://bugzilla.suse.com/945404
   https://bugzilla.suse.com/945989
   https://bugzilla.suse.com/954872
   https://bugzilla.suse.com/956829
   https://bugzilla.suse.com/957162
   https://bugzilla.suse.com/957698
   https://bugzilla.suse.com/957988
   https://bugzilla.suse.com/958007
   https://bugzilla.suse.com/958009
   https://bugzilla.suse.com/958491
   https://bugzilla.suse.com/958523
   https://bugzilla.suse.com/958917
   https://bugzilla.suse.com/959005
   https://bugzilla.suse.com/959332
   https://bugzilla.suse.com/959387
   https://bugzilla.suse.com/959695
   https://bugzilla.suse.com/960334
   https://bugzilla.suse.com/960707
   https://bugzilla.suse.com/960725
   https://bugzilla.suse.com/960835
   https://bugzilla.suse.com/960861
   https://bugzilla.suse.com/960862
   https://bugzilla.suse.com/961332
   https://bugzilla.suse.com/961358
   https://bugzilla.suse.com/961691
   https://bugzilla.suse.com/962320
   https://bugzilla.suse.com/963782
   https://bugzilla.suse.com/963923
   https://bugzilla.suse.com/964413
   https://bugzilla.suse.com/965315
   https://bugzilla.suse.com/965317
   https://bugzilla.suse.com/967012
   https://bugzilla.suse.com/967013
   https://bugzilla.suse.com/967969
   https://bugzilla.suse.com/969121
   https://bugzilla.suse.com/969122
   https://bugzilla.suse.com/969350

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVvoaSH6ZAP0PgtI9AQL9GQ/+KDv1mOLD5MYXcN6HUSkydQTwDv/f+PJb
fe2UVZYEZEAeI2YU5IKm5QllqgSD8lgGZL/qMl/WO+DUpLxlAxk6ui8k2z9psmch
Irat8X0eyu2dhOWVXzp39csu7PEJLQp6fYoLqepI3jgy8zMuk1CwLxcL4d13Oupl
0OP6KGxngr4BQSgXD173vL69BPu/ZDYqCPmKZrKlkjOBTyX+Jeh0wFzUoTT7Tiff
R3GRbVjTJ+amFHei2KOTaDo+qRuKdzIwEL4vYhyH2nQhVP7P6A8UgEVhDLsVAy7u
m7qNVTNGx36aLLwXy186ko/DZQAQrh3ZP0l1zdOJMdQD4+C9QyIiuhQFvNA0vax7
77rYK/TvQjC3+J6mBTvascMTXzE6QoMjJwI+9/8xs1hAVvuzm+g0nXfxLFejxCzr
U9dEg2ILD2Ukab7zF1UhKT7uHKDTeeSTbULz5SbGrTxP0GbwCS47AYpYXin7EwXT
9dEVEjPqahTEslCoo9U4Iic+ucnat0oYx26Z6it/aLO8RYRxIGIeyxxMVL7v+9p3
j3kXdJfAWjL+wvgUMaStPlfcOSOAWmz16vWYJylRAMromKr27GyCEEVSRf5GTcIW
Y+cFzeqwKW7Lou4Ofkdh7efnUD3Kf46NjQ+2yWqNgKhYR6vQIMh3yQhVdlRABfPf
8YIxwA0xhCE=
=M6qt
-----END PGP SIGNATURE-----