This update for xen fixes several issues.
These security issues were fixed:
- CVE-2017-10911: blkif responses leaked backend stack data, which allowed
unprivileged guest to obtain sensitive information from the host or
other guests (XSA-216, bsc#1042863)
- CVE-2017-10912: Page transfer might have allowed PV guest to elevate
privilege (XSA-217, bsc#1042882)
- CVE-2017-10913, CVE-2017-10914: Races in the grant table unmap code
allowed for informations leaks and potentially privilege escalation
(XSA-218, bsc#1042893)
- CVE-2017-10915: Insufficient reference counts during shadow emulation
allowed a malicious pair of guest to elevate their privileges to the
privileges that XEN runs under (XSA-219, bsc#1042915)
- CVE-2017-10917: Missing NULL pointer check in event channel poll allows
guests to DoS the host (XSA-221, bsc#1042924)
- CVE-2017-10918: Stale P2M mappings due to insufficient error checking
allowed malicious guest to leak information or elevate privileges
(XSA-222, bsc#1042931)
- CVE-2017-10922, CVE-2017-10921, CVE-2017-10920: Grant table operations
mishandled reference counts allowing malicious guests to escape
(XSA-224, bsc#1042938)
- CVE-2017-10916: PKRU and BND* leakage between vCPU-s might have leaked
information to other guests (XSA-220, bsc#1042923)
- CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users
to cause a denial of service (infinite loop) by leveraging an incorrect
return value (bsc#1042160)
- CVE-2017-8309: Memory leak in the audio/audio.c allowed remote attackers
to cause a denial of service (memory consumption) by repeatedly starting
and stopping audio capture (bsc#1037243)
- CVE-2017-8112: hw/scsi/vmw_pvscsi.c allowed local guest OS privileged
users to cause a denial of service (infinite loop and CPU consumption)
via the message ring page count (bsc#1036470)
- CVE-2017-8905: Xen a failsafe callback, which might have allowed PV
guest OS users to execute arbitrary code on the host OS (XSA-215,
bsc#1034845).
- CVE-2017-9503: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation
support was vulnerable to a null pointer dereference issue which allowed
a privileged user inside guest to crash the Qemu process on the host
resulting in DoS (bsc#1043297)
- CVE-2017-9374: Missing free of ‘s->ipacket’, causes a host memory leak,
allowing for DoS (bsc#1043074)
These non-security issues were fixed:
- bsc#1031460: Fixed DomU Live Migration
- bsc#1014136: Fixed kdump SLES12-SP2
- bsc#1026236: Equalized paravirtualized vs. fully virtualized migration
speed