CVE-2020-28368

Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.

Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.

This update for xen fixes the following issues:

Security issue fixed:

• CVE-2020-28368: Fixed the Intel RAPL sidechannel attack, aka PLATYPUS attack, aka XSA-351 (bsc#1178591).

Non-security issues fixed:

• Updated to Xen 4.13.2 bug fix release (bsc#1027519).
• Fixed a panic during MSI cleanup on AMD hardware (bsc#1027519).
• Adjusted help for --max_iters, default is 5 (bsc#1177950).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for xen fixes the following issues:

Security issue fixed:

• CVE-2020-28368: Fixed the Intel RAPL sidechannel attack, aka PLATYPUS attack, aka XSA-351 (bsc#1178591).

Non-security issues fixed:

• Updated to Xen 4.12.4 bug fix release (bsc#1027519).
• Fixed a panic during MSI cleanup on AMD hardware (bsc#1027519).
• Adjusted help for --max_iters, default is 5 (bsc#1177950).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for xen fixes the following issues:

• bsc#1178963 - VUL-0: xen: stack corruption from XSA-346 change (XSA-355)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for xen fixes the following issues:

• bsc#1178963 - VUL-0: xen: stack corruption from XSA-346 change (XSA-355)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the xen-4.15.1_01-1.2 package on the GA media of openSUSE Tumbleweed.

This update for xen fixes the following issues:

• bsc#1178963 - stack corruption from XSA-346 change (XSA-355)
• bsc#1178935 - CVE-2020-25723: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c
• bsc#1177409 - CVE-2020-27674: x86 PV guest INVLPG-like flushes may leave stale TLB entries (XSA-286)
• bsc#1177412 - CVE-2020-27672: Race condition in Xen mapping code (XSA-345)
• bsc#1177413 - CVE-2020-27671: undue deferral of IOMMU TLB flushes (XSA-346)
• bsc#1177414 - CVE-2020-27670: unsafe AMD IOMMU page table updates (XSA-347)
• bsc#1178591 - CVE-2020-28368: Intel RAPL sidechannel attack aka PLATYPUS attack aka XSA-351

This update for xen fixes the following issues:

Security issue fixed:

• CVE-2020-28368: Fixed the Intel RAPL sidechannel attack, aka PLATYPUS attack, aka XSA-351 (bsc#1178591).

Non-security issues fixed:

• Updated to Xen 4.13.2 bug fix release (bsc#1027519).
• Fixed a panic during MSI cleanup on AMD hardware (bsc#1027519).
• Adjusted help for --max_iters, default is 5 (bsc#1177950).

This update for xen fixes the following issues:

Security issue fixed:

• CVE-2020-28368: Fixed the Intel RAPL sidechannel attack, aka PLATYPUS attack, aka XSA-351 (bsc#1178591).

Non-security issues fixed:

• Updated to Xen 4.12.4 bug fix release (bsc#1027519).
• Fixed a panic during MSI cleanup on AMD hardware (bsc#1027519).
• Adjusted help for --max_iters, default is 5 (bsc#1177950).

This update for xen fixes the following issues:

Security issue fixed:

• CVE-2020-28368: Fixed the Intel RAPL sidechannel attack, aka PLATYPUS attack, aka XSA-351 (bsc#1178591).

Non-security issues fixed:

• Updated to Xen 4.12.4 bug fix release (bsc#1027519).
• Fixed a panic during MSI cleanup on AMD hardware (bsc#1027519).
• Adjusted help for --max_iters, default is 5 (bsc#1177950).
• Improved performance of live migration to get more throughput on 10Gbs+ connections (jsc#SLE-16899).

This update for xen fixes the following issues:

Security issue fixed:

• CVE-2020-28368: Fixed the Intel RAPL sidechannel attack, aka PLATYPUS attack, aka XSA-351 (bsc#1178591).

Non-security issue fixed:

• Adjusted help for --max_iters, default is 5 (bsc#1177950).

This update for xen fixes the following issues:

Security issue fixed:

• CVE-2020-28368: Fixed the Intel RAPL sidechannel attack, aka PLATYPUS attack, aka XSA-351 (bsc#1178591).

Non-security issue fixed:

• Adjusted help for --max_iters, default is 5 (bsc#1177950).

This update for xen fixes the following issues:

• bsc#1178963 - VUL-0: xen: stack corruption from XSA-346 change (XSA-355)

This update for xen fixes the following issues:

• bsc#1178963 - VUL-0: xen: stack corruption from XSA-346 change (XSA-355)

This update for xen fixes the following issues:

• bsc#1178963 - VUL-0: xen: stack corruption from XSA-346 change (XSA-355)

This update for xen fixes the following issues:

• bsc#1178963 - VUL-0: xen: stack corruption from XSA-346 change (XSA-355)

This update for xen fixes the following issues:

• bsc#1178963 - stack corruption from XSA-346 change (XSA-355)
• bsc#1177409 - CVE-2020-27674: x86 PV guest INVLPG-like flushes may leave stale TLB entries (XSA-286)
• bsc#1177412 - CVE-2020-27672: Race condition in Xen mapping code (XSA-345)
• bsc#1177413 - CVE-2020-27671: undue deferral of IOMMU TLB flushes (XSA-346)
• bsc#1177414 - CVE-2020-27670: unsafe AMD IOMMU page table updates (XSA-347)
• bsc#1178591 - CVE-2020-28368: Intel RAPL sidechannel attack aka PLATYPUS attack aka XSA-351

This update for xen fixes the following issues:

• bsc#1178963 - VUL-0: xen: stack corruption from XSA-346 change (XSA-355)

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178123).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25704: Fixed a leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107)
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28941: Fixed an issue where local attackers on systems with the speakup driver could cause a local denial of service attack (bsc#1178740).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-8694, CVE-2020-8695: Fixed an insufficient access control in the Linux kernel driver for some Intel(R) Processors which might have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1170415 bsc#1170446)
• CVE-2020-28368: Fixed Intel RAPL sidechannel attack aka PLATYPUS attack (XSA-351 bsc#1178591).
• CVE-2020-29369: Fixed a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe (bnc#1173504 bsc#1179432).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• ACPI: button: Add DMI quirk for Medion Akoya E2228T (git-fixes).
• ACPICA: Add NHLT table signature (bsc#1176200).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: GED: fix -Wformat (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• Add bug reference to two hv_netvsc patches (bsc#1178853).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: fix kernel-doc markups (git-fixes).
• ALSA: hda: fix jack detection with Realtek codecs when in D3 (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button (git-fixes).
• ALSA: hda/realtek - Add supported mute Led for HP (git-fixes).
• ALSA: hda/realtek - Enable headphone for ASUS TM420 (git-fixes).
• ALSA: hda/realtek - Fixed HP headset Mic can't be detected (git-fixes).
• ALSA: hda/realtek - HP Headset Mic can't detect after boot (git-fixes).
• ALSA: hda: Reinstate runtime_allow() for all hda controllers (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for MODX (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for Qu-16 (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2 (git-fixes).
• ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices (git-fixes).
• arm64: bpf: Fix branch offset in JIT (git-fixes).
• arm64: dts:…

This update for xen fixes the following issues:

• bsc#1178963 - stack corruption from XSA-346 change (XSA-355)
• bsc#1177409 - CVE-2020-27674: x86 PV guest INVLPG-like flushes may leave stale TLB entries (XSA-286)
• bsc#1177412 - CVE-2020-27672: Race condition in Xen mapping code (XSA-345)
• bsc#1177413 - CVE-2020-27671: undue deferral of IOMMU TLB flushes (XSA-346)
• bsc#1177414 - CVE-2020-27670: unsafe AMD IOMMU page table updates (XSA-347)
• bsc#1178591 - CVE-2020-28368: Intel RAPL sidechannel attack aka PLATYPUS attack aka XSA-351

This update for xen fixes the following issues:

• CVE-2021-3308: VUL-0: xen: IRQ vector leak on x86 (bsc#1181254, XSA-360)
• CVE-2021-28687: VUL-0: xen: HVM soft-reset crashes toolstack (bsc#1183072, XSA-368)
• CVE-2021-20257: VUL-0: xen: infinite loop issue in the e1000 NIC emulator (bsc#1182846)
• CVE-2020-28368: VUL-0: xen: Intel RAPL sidechannel attack aka PLATYPUS attack aka (bsc#1178591, XSA-351)
• L3: conring size for XEN HV's with huge memory to small. Inital Xen logs cut (bsc#1177204)
• Kdump of HVM fails, soft-reset not handled by libxl (bsc#1179148)
• OpenQA job causes libvirtd to dump core when running kdump inside domain (bsc#1181989)
• Allow restart of xenwatchdogd, enable tuning of keep-alive interval and timeout options via XENWATCHDOGD_ARGS= (bsc#1178736)
• The receiving side did detect holes in a to-be-allocated superpage, but allocated a superpage anyway. This resulted to over-allocation (bsc#1177112)
• The receiving side may punch holes incorrectly into optimistically allocated superpages. Also reduce overhead in bitmap handling (bsc#1177112)
• Upstream bug fixes (bsc#1027519)

This update for xen fixes the following issues:

• CVE-2020-28368: Intel RAPL sidechannel attack aka PLATYPUS attack (bsc#1178591, XSA-351)
• CVE-2021-3308: IRQ vector leak on x86 (bsc#1181254, XSA-360)
• CVE-2021-28687: HVM soft-reset crashes toolstack (bsc#1183072, XSA-368)
• L3: conring size for XEN HV's with huge memory to small (bsc#1177204).
• kdump of HVM fails, soft-reset not handled by libxl (bsc#1179148)
• openQA job causes libvirtd to dump core when running kdump inside domain (bsc#1181989).
• Upstream bug fixes (bsc#1027519)