Security update for libvirt SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0936-1 Final 1 1 2019-04-12T07:06:33Z current 2019-04-12T07:06:33Z 2019-04-12T07:06:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libvirt This update for libvirt provides the following fixes: Security issue fixed: - CVE-2019-3840: Fixed a null pointer dereference vulnerability in virJSONValueObjectHasKey function which could have resulted in a remote denial of service via the guest agent (bsc#1127458). Other issues addressed: - apparmor: reintroduce upstream lxc mount rules (bsc#1130129). - hook: encode incoming XML to UTF-8 before passing to lxml etree from string method (bsc#1123642). - supportconfig: collect rotated logs in /var/log/libvirt/* (bsc#1124667). - libxl: support Xen's max_grant_frames setting with maxGrantFrames attribute on the xenbus controller (bsc#1126325). - conf: added new 'xenbus' controller type - util: skip RDMA detection for non-PCI network devices (bsc#1112182). - qemu: don't use CAP_DAC_OVERRIDE capability if non-root (bsc#1125665). - qemu: fix issues related to restricted permissions on /dev/sev(bsc#1102604). - apparmor: add support for named profiles (bsc#1118952). - libxl: save current memory value after successful balloon (bsc#1120813). - apparmor: Fix ptrace rules. (bsc#1117058) - libxl: Add support for soft reset. (bsc#1081516) - libxl: Fix VM migration on busy hosts. (bsc#1108086) - qemu: Add support for SEV guests. (fate#325817) - util: Don't check for parallel iteration in hash-related functions. (bsc#1106420) - spec: Don't restart libvirt-guests when updating libvirt-client. (bsc#1104662) - Fix virNodeGetSEVInfo API crashing libvirtd on AMD SEV enabled hosts. (bsc#1108395) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-936,SUSE-SLE-Module-Basesystem-15-2019-936,SUSE-SLE-Module-Development-Tools-OBS-15-2019-936,SUSE-SLE-Module-Server-Applications-15-2019-936 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190936-1/ Link for SUSE-SU-2019:0936-1 https://lists.suse.com/pipermail/sle-security-updates/2019-April/005330.html E-Mail link for SUSE-SU-2019:0936-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1081516 SUSE Bug 1081516 https://bugzilla.suse.com/1102604 SUSE Bug 1102604 https://bugzilla.suse.com/1104662 SUSE Bug 1104662 https://bugzilla.suse.com/1106420 SUSE Bug 1106420 https://bugzilla.suse.com/1108086 SUSE Bug 1108086 https://bugzilla.suse.com/1108395 SUSE Bug 1108395 https://bugzilla.suse.com/1112182 SUSE Bug 1112182 https://bugzilla.suse.com/1117058 SUSE Bug 1117058 https://bugzilla.suse.com/1118952 SUSE Bug 1118952 https://bugzilla.suse.com/1120813 SUSE Bug 1120813 https://bugzilla.suse.com/1123642 SUSE Bug 1123642 https://bugzilla.suse.com/1124667 SUSE Bug 1124667 https://bugzilla.suse.com/1125665 SUSE Bug 1125665 https://bugzilla.suse.com/1126325 SUSE Bug 1126325 https://bugzilla.suse.com/1127458 SUSE Bug 1127458 https://bugzilla.suse.com/1130129 SUSE Bug 1130129 https://www.suse.com/security/cve/CVE-2019-3840/ SUSE CVE CVE-2019-3840 page SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Server Applications 15 libvirt-4.0.0-9.16.7 libvirt-admin-4.0.0-9.16.7 libvirt-client-4.0.0-9.16.7 libvirt-daemon-4.0.0-9.16.7 libvirt-daemon-config-network-4.0.0-9.16.7 libvirt-daemon-config-nwfilter-4.0.0-9.16.7 libvirt-daemon-driver-interface-4.0.0-9.16.7 libvirt-daemon-driver-libxl-4.0.0-9.16.7 libvirt-daemon-driver-lxc-4.0.0-9.16.7 libvirt-daemon-driver-network-4.0.0-9.16.7 libvirt-daemon-driver-nodedev-4.0.0-9.16.7 libvirt-daemon-driver-nwfilter-4.0.0-9.16.7 libvirt-daemon-driver-qemu-4.0.0-9.16.7 libvirt-daemon-driver-secret-4.0.0-9.16.7 libvirt-daemon-driver-storage-4.0.0-9.16.7 libvirt-daemon-driver-storage-core-4.0.0-9.16.7 libvirt-daemon-driver-storage-disk-4.0.0-9.16.7 libvirt-daemon-driver-storage-iscsi-4.0.0-9.16.7 libvirt-daemon-driver-storage-logical-4.0.0-9.16.7 libvirt-daemon-driver-storage-mpath-4.0.0-9.16.7 libvirt-daemon-driver-storage-rbd-4.0.0-9.16.7 libvirt-daemon-driver-storage-scsi-4.0.0-9.16.7 libvirt-daemon-hooks-4.0.0-9.16.7 libvirt-daemon-lxc-4.0.0-9.16.7 libvirt-daemon-qemu-4.0.0-9.16.7 libvirt-daemon-xen-4.0.0-9.16.7 libvirt-devel-4.0.0-9.16.7 libvirt-devel-32bit-4.0.0-9.16.7 libvirt-devel-64bit-4.0.0-9.16.7 libvirt-doc-4.0.0-9.16.7 libvirt-libs-4.0.0-9.16.7 libvirt-lock-sanlock-4.0.0-9.16.7 libvirt-nss-4.0.0-9.16.7 wireshark-plugin-libvirt-4.0.0-9.16.7 libvirt-libs-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Basesystem 15 libvirt-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-admin-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-client-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-config-network-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-config-nwfilter-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-interface-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-libxl-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-lxc-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-network-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-nodedev-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-nwfilter-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-qemu-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-secret-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-storage-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-storage-core-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-storage-disk-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-storage-iscsi-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-storage-logical-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-storage-mpath-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-storage-rbd-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-driver-storage-scsi-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-hooks-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-lxc-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-qemu-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-daemon-xen-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-devel-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-doc-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-lock-sanlock-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 libvirt-nss-4.0.0-9.16.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service. CVE-2019-3840 SUSE Linux Enterprise Module for Basesystem 15:libvirt-libs-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-admin-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-client-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-config-network-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-config-nwfilter-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-interface-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-libxl-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-lxc-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-network-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-nodedev-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-nwfilter-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-qemu-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-secret-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-storage-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-storage-core-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-storage-disk-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-storage-iscsi-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-storage-logical-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-storage-mpath-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-storage-rbd-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-driver-storage-scsi-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-hooks-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-lxc-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-qemu-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-daemon-xen-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-devel-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-doc-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-lock-sanlock-4.0.0-9.16.7 SUSE Linux Enterprise Module for Server Applications 15:libvirt-nss-4.0.0-9.16.7 moderate 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190936-1/ https://www.suse.com/security/cve/CVE-2019-3840.html CVE-2019-3840 https://bugzilla.suse.com/1127458 SUSE Bug 1127458