<security-notice xmlns="http://security.libvirt.org/xmlns/security-notice/1.0">
  <id>2018-0005</id>

  <summary>Speculative Store Bypass</summary>

  <description>
    <![CDATA[This is not a vulnerability in libvirt, rather it is
	     a set of changes in libvirt to enable mitigation of
	     the Speculative Store Bypass hardware flaws by providing
	     extra CPU features "ssbd" and "virt-ssbd".
	     Refer to https://access.redhat.com/security/vulnerabilities/ssbd
	     for further background information.]]>
  </description>

  <credits>
    <reporter>
      <name>Ken Johnson (Microsoft Security Response Center)</name>
    </reporter>
    <reporter>
      <name>Jann Horn (Google Project Zero)</name>
    </reporter>
    <patcher>
      <name>Daniel Berrange</name>
      <email>berrange@redhat.com</email>
    </patcher>
  </credits>

  <lifecycle>
    <reported>20180509</reported>
    <published>20180521</published>
    <fixed>20180521</fixed>
  </lifecycle>

  <reference>
    <advisory type="CVE" id="2018-3639"/>
  </reference>

  <product name="libvirt">
    <repository>libvirt.git</repository>
    <branch>
      <name>master</name>
      <tag state="vulnerable">v0.2.0</tag>
      <tag state="vulnerable">v0.2.1</tag>
      <tag state="vulnerable">v0.2.2</tag>
      <tag state="vulnerable">v0.2.3</tag>
      <tag state="vulnerable">v0.3.0</tag>
      <tag state="vulnerable">v0.3.1</tag>
      <tag state="vulnerable">v0.3.2</tag>
      <tag state="vulnerable">v0.3.3</tag>
      <tag state="vulnerable">v0.4.1</tag>
      <tag state="vulnerable">v0.4.2</tag>
      <tag state="vulnerable">v0.4.4</tag>
      <tag state="vulnerable">v0.4.6</tag>
      <tag state="vulnerable">v0.5.0</tag>
      <tag state="vulnerable">v0.5.1</tag>
      <tag state="vulnerable">v0.6.0</tag>
      <tag state="vulnerable">v0.6.1</tag>
      <tag state="vulnerable">v0.6.2</tag>
      <tag state="vulnerable">v0.6.3</tag>
      <tag state="vulnerable">v0.6.4</tag>
      <tag state="vulnerable">v0.6.5</tag>
      <tag state="vulnerable">v0.7.0</tag>
      <tag state="vulnerable">v0.7.1</tag>
      <tag state="vulnerable">v0.7.2</tag>
      <tag state="vulnerable">v0.7.3</tag>
      <tag state="vulnerable">v0.7.4</tag>
      <tag state="vulnerable">v0.7.5</tag>
      <tag state="vulnerable">v0.7.6</tag>
      <tag state="vulnerable">v0.7.7</tag>
      <tag state="vulnerable">v0.8.0</tag>
      <tag state="vulnerable">v0.8.1</tag>
      <tag state="vulnerable">v0.8.2</tag>
      <tag state="vulnerable">v0.8.3</tag>
      <tag state="vulnerable">v0.8.4</tag>
      <tag state="vulnerable">v0.8.5</tag>
      <tag state="vulnerable">v0.8.6</tag>
      <tag state="vulnerable">v0.8.7</tag>
      <tag state="vulnerable">v0.8.8</tag>
      <tag state="vulnerable">v0.9.0</tag>
      <tag state="vulnerable">v0.9.1</tag>
      <tag state="vulnerable">v0.9.2</tag>
      <tag state="vulnerable">v0.9.3</tag>
      <tag state="vulnerable">v0.9.4</tag>
      <tag state="vulnerable">v0.9.5</tag>
      <tag state="vulnerable">v0.9.6</tag>
      <tag state="vulnerable">v0.9.7</tag>
      <tag state="vulnerable">v0.9.8</tag>
      <tag state="vulnerable">v0.9.9</tag>
      <tag state="vulnerable">v0.9.10</tag>
      <tag state="vulnerable">v0.9.11</tag>
      <tag state="vulnerable">v0.9.12</tag>
      <tag state="vulnerable">v0.9.13</tag>
      <tag state="vulnerable">v0.10.0</tag>
      <tag state="vulnerable">v0.10.1</tag>
      <tag state="vulnerable">v0.10.2</tag>
      <tag state="vulnerable">v1.0.0</tag>
      <tag state="vulnerable">v1.0.1</tag>
      <tag state="vulnerable">v1.0.2</tag>
      <tag state="vulnerable">v1.0.3</tag>
      <tag state="vulnerable">v1.0.4</tag>
      <tag state="vulnerable">v1.0.5</tag>
      <tag state="vulnerable">v1.0.6</tag>
      <tag state="vulnerable">v1.1.0</tag>
      <tag state="vulnerable">v1.1.1</tag>
      <tag state="vulnerable">v1.1.2</tag>
      <tag state="vulnerable">v1.1.3</tag>
      <tag state="vulnerable">v1.1.4</tag>
      <tag state="vulnerable">v1.2.0</tag>
      <tag state="vulnerable">v1.2.1</tag>
      <tag state="vulnerable">v1.2.2</tag>
      <tag state="vulnerable">v1.2.3</tag>
      <tag state="vulnerable">v1.2.4</tag>
      <tag state="vulnerable">v1.2.5</tag>
      <tag state="vulnerable">v1.2.6</tag>
      <tag state="vulnerable">v1.2.7</tag>
      <tag state="vulnerable">v1.2.8</tag>
      <tag state="vulnerable">v1.2.9</tag>
      <tag state="vulnerable">v1.2.10</tag>
      <tag state="vulnerable">v1.2.11</tag>
      <tag state="vulnerable">v1.2.12</tag>
      <tag state="vulnerable">v1.2.13</tag>
      <tag state="vulnerable">v1.2.14</tag>
      <tag state="vulnerable">v1.2.15</tag>
      <tag state="vulnerable">v1.2.16</tag>
      <tag state="vulnerable">v1.2.17</tag>
      <tag state="vulnerable">v1.2.18</tag>
      <tag state="vulnerable">v1.2.19</tag>
      <tag state="vulnerable">v1.2.20</tag>
      <tag state="vulnerable">v1.2.21</tag>
      <tag state="vulnerable">v1.3.0</tag>
      <tag state="vulnerable">v1.3.1</tag>
      <tag state="vulnerable">v1.3.2</tag>
      <tag state="vulnerable">v1.3.3</tag>
      <tag state="vulnerable">v1.3.4</tag>
      <tag state="vulnerable">v1.3.5</tag>
      <tag state="vulnerable">v2.0.0</tag>
      <tag state="vulnerable">v2.1.0</tag>
      <tag state="vulnerable">v2.2.0</tag>
      <tag state="vulnerable">v2.3.0</tag>
      <tag state="vulnerable">v2.4.0</tag>
      <tag state="vulnerable">v2.5.0</tag>
      <tag state="vulnerable">v3.0.0</tag>
      <tag state="vulnerable">v3.1.0</tag>
      <tag state="vulnerable">v3.2.0</tag>
      <tag state="vulnerable">v3.3.0</tag>
      <tag state="vulnerable">v3.4.0</tag>
      <tag state="vulnerable">v3.5.0</tag>
      <tag state="vulnerable">v3.6.0</tag>
      <tag state="vulnerable">v3.7.0</tag>
      <tag state="vulnerable">v3.8.0</tag>
      <tag state="vulnerable">v3.9.0</tag>
      <tag state="vulnerable">v3.10.0</tag>
      <tag state="vulnerable">v4.0.0</tag>
      <tag state="vulnerable">v4.1.0</tag>
      <tag state="vulnerable">v4.2.0</tag>
      <tag state="vulnerable">v4.3.0</tag>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
      <tag state="fixed">v4.4.0</tag>
      <change state="fixed">1dbca2eccad58d91a5fd33962854f1a653638182</change>
      <change state="fixed">9267342206ce17f6933d57a3128cdc504d5945c9</change>
    </branch>
    <branch>
      <name>v0.8.3-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v0.9.6-maint</name>
      <tag state="vulnerable">v0.9.6.1</tag>
      <tag state="vulnerable">v0.9.6.2</tag>
      <tag state="vulnerable">v0.9.6.3</tag>
      <tag state="vulnerable">v0.9.6.4</tag>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v0.9.11-maint</name>
      <tag state="vulnerable">v0.9.11.1</tag>
      <tag state="vulnerable">v0.9.11.2</tag>
      <tag state="vulnerable">v0.9.11.3</tag>
      <tag state="vulnerable">v0.9.11.4</tag>
      <tag state="vulnerable">v0.9.11.5</tag>
      <tag state="vulnerable">v0.9.11.6</tag>
      <tag state="vulnerable">v0.9.11.7</tag>
      <tag state="vulnerable">v0.9.11.8</tag>
      <tag state="vulnerable">v0.9.11.9</tag>
      <tag state="vulnerable">v0.9.11.10</tag>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v0.9.12-maint</name>
      <tag state="vulnerable">v0.9.12.1</tag>
      <tag state="vulnerable">v0.9.12.2</tag>
      <tag state="vulnerable">v0.9.12.3</tag>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v0.10.2-maint</name>
      <tag state="vulnerable">v0.10.2.1</tag>
      <tag state="vulnerable">v0.10.2.2</tag>
      <tag state="vulnerable">v0.10.2.3</tag>
      <tag state="vulnerable">v0.10.2.4</tag>
      <tag state="vulnerable">v0.10.2.5</tag>
      <tag state="vulnerable">v0.10.2.6</tag>
      <tag state="vulnerable">v0.10.2.7</tag>
      <tag state="vulnerable">v0.10.2.8</tag>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.0.0-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.0.1-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.0.2-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.0.3-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.0.4-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.0.5-maint</name>
      <tag state="vulnerable">v1.0.5.1</tag>
      <tag state="vulnerable">v1.0.5.2</tag>
      <tag state="vulnerable">v1.0.5.3</tag>
      <tag state="vulnerable">v1.0.5.4</tag>
      <tag state="vulnerable">v1.0.5.5</tag>
      <tag state="vulnerable">v1.0.5.6</tag>
      <tag state="vulnerable">v1.0.5.7</tag>
      <tag state="vulnerable">v1.0.5.8</tag>
      <tag state="vulnerable">v1.0.5.9</tag>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.0.6-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.1.0-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.1.1-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.1.2-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.1.3-maint</name>
      <tag state="vulnerable">v1.1.3.1</tag>
      <tag state="vulnerable">v1.1.3.2</tag>
      <tag state="vulnerable">v1.1.3.3</tag>
      <tag state="vulnerable">v1.1.3.4</tag>
      <tag state="vulnerable">v1.1.3.5</tag>
      <tag state="vulnerable">v1.1.3.6</tag>
      <tag state="vulnerable">v1.1.3.7</tag>
      <tag state="vulnerable">v1.1.3.8</tag>
      <tag state="vulnerable">v1.1.3.9</tag>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.1.4-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.0-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.1-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.2-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.3-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.4-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.5-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.6-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.7-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.8-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.9-maint</name>
      <tag state="vulnerable">v1.2.9.1</tag>
      <tag state="vulnerable">v1.2.9.2</tag>
      <tag state="vulnerable">v1.2.9.3</tag>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.10-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.11-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.12-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.13-maint</name>
      <tag state="vulnerable">v1.2.13.1</tag>
      <tag state="vulnerable">v1.2.13.2</tag>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.14-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.15-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.16-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.17-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.18-maint</name>
      <tag state="vulnerable">v1.2.18.1</tag>
      <tag state="vulnerable">v1.2.18.2</tag>
      <tag state="vulnerable">v1.2.18.3</tag>
      <tag state="vulnerable">v1.2.18.4</tag>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.19-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.20-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.2.21-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.3.0-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.3.1-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.3.2-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.3.3-maint</name>
      <tag state="vulnerable">v1.3.3.1</tag>
      <tag state="vulnerable">v1.3.3.2</tag>
      <tag state="vulnerable">v1.3.3.3</tag>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.3.4-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v1.3.5-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v2.0-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v2.1-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v2.2-maint</name>
      <tag state="vulnerable">v2.2.1</tag>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v3.0-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v3.2-maint</name>
      <tag state="vulnerable">v3.2.1</tag>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v3.7-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
    <branch>
      <name>v4.1-maint</name>
      <change state="vulnerable">23ad665cb05ef9ce7d298cc34bff5efb95ef6948</change>
    </branch>
  </product>

</security-notice>
