{"id":"USN-3561-1","summary":"libvirt update","details":"It was discovered that microprocessors utilizing speculative execution\nand branch prediction may allow unauthorized memory reads via sidechannel\nattacks. This flaw is known as Spectre. An attacker in the guest could use\nthis to expose sensitive guest information, including kernel memory.\n\nThis update allows libvirt to expose new CPU features added by microcode\nupdates to guests. On amd64 and i386, new CPU models that match the updated\nmicrocode features were added with an -IBRS suffix. Certain environments\nwill require guests to be switched manually to the new CPU models after\nmicrocode updates have been applied to the host.\n","modified":"2026-04-22T09:43:48.015743Z","published":"2018-02-07T16:43:01Z","related":["UBUNTU-CVE-2017-5715"],"upstream":["CVE-2017-5715","UBUNTU-CVE-2017-5715"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-3561-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-5715"}],"affected":[{"package":{"name":"libvirt","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/libvirt@1.2.2-0ubuntu13.1.25?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-0ubuntu13.1.25"}]}],"versions":["1.1.1-0ubuntu8","1.1.1-0ubuntu9","1.1.4-0ubuntu2","1.1.4-0ubuntu3","1.1.4-0ubuntu4","1.1.4-0ubuntu5","1.2.0-0ubuntu1","1.2.0-0ubuntu2","1.2.0-0ubuntu3","1.2.1-0ubuntu1","1.2.1-0ubuntu2","1.2.1-0ubuntu3","1.2.1-0ubuntu4","1.2.1-0ubuntu5","1.2.1-0ubuntu7","1.2.1-0ubuntu8","1.2.1-0ubuntu9","1.2.1-0ubuntu10","1.2.2-0ubuntu1","1.2.2-0ubuntu2","1.2.2-0ubuntu3","1.2.2-0ubuntu4","1.2.2-0ubuntu5","1.2.2-0ubuntu6","1.2.2-0ubuntu7","1.2.2-0ubuntu8","1.2.2-0ubuntu9","1.2.2-0ubuntu10","1.2.2-0ubuntu11","1.2.2-0ubuntu12","1.2.2-0ubuntu13","1.2.2-0ubuntu13.1","1.2.2-0ubuntu13.1.1","1.2.2-0ubuntu13.1.2","1.2.2-0ubuntu13.1.4","1.2.2-0ubuntu13.1.5","1.2.2-0ubuntu13.1.6","1.2.2-0ubuntu13.1.7","1.2.2-0ubuntu13.1.8","1.2.2-0ubuntu13.1.9","1.2.2-0ubuntu13.1.10","1.2.2-0ubuntu13.1.12","1.2.2-0ubuntu13.1.14","1.2.2-0ubuntu13.1.16","1.2.2-0ubuntu13.1.17","1.2.2-0ubuntu13.1.20","1.2.2-0ubuntu13.1.21","1.2.2-0ubuntu13.1.22","1.2.2-0ubuntu13.1.23"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"libvirt-bin","binary_version":"1.2.2-0ubuntu13.1.25"},{"binary_name":"libvirt0","binary_version":"1.2.2-0ubuntu13.1.25"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3561-1.json","cves_map":{"ecosystem":"Ubuntu:14.04:LTS","cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"},{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"},{"type":"Ubuntu","score":"high"}],"id":"CVE-2017-5715"}]}}},{"package":{"name":"libvirt","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/libvirt@1.3.1-1ubuntu10.17?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1ubuntu10.17"}]}],"versions":["1.2.16-2ubuntu11","1.2.16-2ubuntu12","1.2.16-2ubuntu13","1.2.16-2ubuntu14","1.2.21-2ubuntu1","1.2.21-2ubuntu3","1.2.21-2ubuntu4","1.2.21-2ubuntu5","1.2.21-2ubuntu7","1.2.21-2ubuntu8","1.2.21-2ubuntu9","1.2.21-2ubuntu10","1.3.1-1ubuntu1","1.3.1-1ubuntu2","1.3.1-1ubuntu3","1.3.1-1ubuntu4","1.3.1-1ubuntu6","1.3.1-1ubuntu9","1.3.1-1ubuntu10","1.3.1-1ubuntu10.1","1.3.1-1ubuntu10.2","1.3.1-1ubuntu10.3","1.3.1-1ubuntu10.5","1.3.1-1ubuntu10.6","1.3.1-1ubuntu10.7","1.3.1-1ubuntu10.8","1.3.1-1ubuntu10.10","1.3.1-1ubuntu10.11","1.3.1-1ubuntu10.12","1.3.1-1ubuntu10.13","1.3.1-1ubuntu10.14","1.3.1-1ubuntu10.15"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"libvirt-bin","binary_version":"1.3.1-1ubuntu10.17"},{"binary_name":"libvirt0","binary_version":"1.3.1-1ubuntu10.17"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3561-1.json","cves_map":{"ecosystem":"Ubuntu:16.04:LTS","cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"},{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"},{"type":"Ubuntu","score":"high"}],"id":"CVE-2017-5715"}]}}}],"schema_version":"1.7.5"}