USN-3561-1: libvirt update
It was discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. An attacker in the guest could use this to expose sensitive guest information, including kernel memory. This update allows libvirt to expose new CPU features added by microcode updates to guests. On amd64 and i386, new CPU models that match the updated microcode features were added with an -IBRS suffix. Certain environments will require guests to be switched manually to the new CPU models after microcode updates have been applied to the host.
Affected Software
Frequently Asked Questions
What is the vulnerability ID for this security update?
The vulnerability ID for this security update is CVE-2017-5715.
What is the severity of CVE-2017-5715?
The severity of CVE-2017-5715 is high.
Which software is affected by CVE-2017-5715?
The libvirt-bin and libvirt0 packages on Ubuntu 17.10, 16.04, and 14.04 are affected by CVE-2017-5715.
How can an attacker exploit CVE-2017-5715?
An attacker in the guest could use CVE-2017-5715 to expose sensitive guest information, including kernel memory.
What is the recommended remedy for CVE-2017-5715?
The recommended remedy for CVE-2017-5715 is to update to version 3.6.0-1ubuntu6.2 for libvirt-bin or version 3.6.0-1ubuntu6.2 for libvirt0, depending on the affected package.