Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 509
Alerts This Week
Warning Icon 1 509

SUSE: 2018:2410-1 Important: Xen Information Disclosure Risk

suse
Calendar Grey August 17, 2018
Scroller Suse Esm H88
Major SUSE Security Patch targets severe vulnerabilities in xen. Make sure your infrastructure is safeguarded against possible threats.
An update that solves one vulnerability and has two fixes is now available

Summary

This update for xen fixes the following security issues: - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bsc#1091107, bsc#1027519). - Incorrect MSR_DEBUGCTL handling let guests enable BTS allowing a malicious or buggy guest administrator can lock up the entire host (bsc#1103276) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 7:

Topics%20covered

Topics Covered

security advisory unauthorized access access control important information disclosure SUSE xen

References

#1027519 #1091107 #1103276

Cross- CVE-2018-3646

Affected Products:

SUSE OpenStack Cloud 7

SUSE Linux Enterprise Server for SAP 12-SP2

SUSE Linux Enterprise Server 12-SP2-LTSS

SUSE Enterprise Storage 4

https://www.suse.com/security/cve/CVE-2018-3646.html

https://bugzilla.suse.com/1027519

https://bugzilla.suse.com/1091107

https://bugzilla.suse.com/1103276

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2018:2410-1
Rating: important

Topics%20covered

Topics Covered

security advisory unauthorized access access control important information disclosure SUSE xen

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.