<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for xen</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2018:2409-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2018-08-17T11:42:30Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2018-08-17T11:42:30Z</InitialReleaseDate>
    <CurrentReleaseDate>2018-08-17T11:42:30Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for xen</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for xen fixes the following security issues:

- CVE-2018-3646: Systems with microprocessors utilizing speculative execution
  and address translations may have allowed unauthorized disclosure of
  information residing in the L1 data cache to an attacker with local user access
  with guest OS privilege via a terminal page fault and a side-channel analysis
  (bsc#1091107, bsc#1027519).
- Incorrect MSR_DEBUGCTL handling let guests enable BTS allowing a malicious or
  buggy guest administrator can lock up the entire host (bsc#1103276)
  </Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-SLE-Module-Basesystem-15-2018-1663,SUSE-SLE-Module-Server-Applications-15-2018-1663</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20182409-1/</URL>
      <Description>Link for SUSE-SU-2018:2409-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2018-August/004464.html</URL>
      <Description>E-Mail link for SUSE-SU-2018:2409-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1027519</URL>
      <Description>SUSE Bug 1027519</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1091107</URL>
      <Description>SUSE Bug 1091107</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1103276</URL>
      <Description>SUSE Bug 1103276</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-3646/</URL>
      <Description>SUSE CVE CVE-2018-3646 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Basesystem 15">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15" CPE="cpe:/o:suse:sle-module-basesystem:15">SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Server Applications 15">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Server Applications 15">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15" CPE="cpe:/o:suse:sle-module-server-applications:15">SUSE Linux Enterprise Module for Server Applications 15</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="xen-libs-4.10.1_08-3.6.1">
      <FullProductName ProductID="xen-libs-4.10.1_08-3.6.1">xen-libs-4.10.1_08-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-tools-domU-4.10.1_08-3.6.1">
      <FullProductName ProductID="xen-tools-domU-4.10.1_08-3.6.1">xen-tools-domU-4.10.1_08-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-4.10.1_08-3.6.1">
      <FullProductName ProductID="xen-4.10.1_08-3.6.1">xen-4.10.1_08-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-devel-4.10.1_08-3.6.1">
      <FullProductName ProductID="xen-devel-4.10.1_08-3.6.1">xen-devel-4.10.1_08-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xen-tools-4.10.1_08-3.6.1">
      <FullProductName ProductID="xen-tools-4.10.1_08-3.6.1">xen-tools-4.10.1_08-3.6.1</FullProductName>
    </Branch>
    <Relationship ProductReference="xen-libs-4.10.1_08-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.1_08-3.6.1">xen-libs-4.10.1_08-3.6.1 as a component of SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-domU-4.10.1_08-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.1_08-3.6.1">xen-tools-domU-4.10.1_08-3.6.1 as a component of SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-4.10.1_08-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Server Applications 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.1_08-3.6.1">xen-4.10.1_08-3.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-devel-4.10.1_08-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Server Applications 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.1_08-3.6.1">xen-devel-4.10.1_08-3.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="xen-tools-4.10.1_08-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Server Applications 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.1_08-3.6.1">xen-tools-4.10.1_08-3.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis.</Note>
    </Notes>
    <CVE>CVE-2018-3646</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:xen-libs-4.10.1_08-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:xen-tools-domU-4.10.1_08-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15:xen-4.10.1_08-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15:xen-devel-4.10.1_08-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15:xen-tools-4.10.1_08-3.6.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.7</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:N/C:C/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.6</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20182409-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-3646.html</URL>
        <Description>CVE-2018-3646</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1087078</URL>
        <Description>SUSE Bug 1087078</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1087081</URL>
        <Description>SUSE Bug 1087081</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1089343</URL>
        <Description>SUSE Bug 1089343</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1091107</URL>
        <Description>SUSE Bug 1091107</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1099306</URL>
        <Description>SUSE Bug 1099306</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104365</URL>
        <Description>SUSE Bug 1104365</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104894</URL>
        <Description>SUSE Bug 1104894</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1106548</URL>
        <Description>SUSE Bug 1106548</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1113534</URL>
        <Description>SUSE Bug 1113534</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1136865</URL>
        <Description>SUSE Bug 1136865</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178658</URL>
        <Description>SUSE Bug 1178658</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1201877</URL>
        <Description>SUSE Bug 1201877</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
