SB2018011406 - Gentoo update for Xen
Published: January 14, 2018 Updated: January 15, 2018
Security Bulletin ID
SB2018011406
Severity
Medium
Patch available
YES
Number of vulnerabilities
25
Exploitation vector
Adjecent network
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 25 secuirty vulnerabilities.
1) Privilege escalation (CVE-ID: CVE-2017-12134)
The vulnerability allows a local attacker on a Linux-based guest system to gain elevated privileges on the host system.The weakness exists due to aa flaw in merging adjacent block IO requests. A local attacker on the guest system can incorrectly access memory during block stream processing to obtain potentially sensitive information or gain elevated privileges on the host system.
2) Privilege escalation (CVE-ID: CVE-2017-12135)
The vulnerability allows a local attacker on the guest system to gain elevated privileges on the host system.The weakness exists due to flaws in the processing of transitive grants. A local attacker on the guest system can escalate privileges on the host system.
3) Privilege escalation (CVE-ID: CVE-2017-12136)
The vulnerability allows a local administrative attacker on the guest system to gain elevated privileges on the host system.The weakness exists due to a race condition in the grant table allocator maptrack entry list processing code. A local attacker on the guest system can cause the host system to crash or gain elevated privileges on the host system.
4) Privilege escalation (CVE-ID: CVE-2017-12137)
The vulnerability allows a local attacker on a PV guest system to gain elevated privileges on the host system.The weakness exists due to a flaw in the processing of guest-nominated L1 pagetable entries when mapping a grant reference. A local attacker on a PV guest system supply specially crafted data and execute arbitrary code on the host system.
5) Race condition (CVE-ID: CVE-2017-15588)
The vulnerability allows an adjacent attacker to gain elevated privileges on the target system.The weakness exists due to page type release race. An adjacent attacker can supply a stale TLB entry, trigger race condition and execute arbitrary code with elevated privileges.
6) Race condition (CVE-ID: CVE-2017-15588)
The vulnerability allows an adjacent attacker to gain unauthorized access to system memory.The weakness exists on x86 PV guest systems due to improper handling of references in memory tables. An adjacent attacker can trigger a race condition while sending a translation lookaside buffer (TLB) flush request that involves an interprocessor interrupt (IPI) to a CPU, access all the system memory and possibly cause the system to crash.
Successful exploitation of the vulnerability may result in denial of service.
7) Memory leak (CVE-ID: CVE-2017-15589)
The vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.The weakness exists due to hypervisor stack leak in x86 I/O intercept code. An adjacent attacker can write data from uninitialized hypervisor stack memory and read arbitrary information.
8) Information disclosure (CVE-ID: CVE-2017-15589)
The vulnerability allows an adjacent attacker to obtain potentially sensitive information.The weakness exists in the I/O intercept code on x86 HVM systems due to improper security restrictions during I/O operations. During I/O operations, a write path where data is stored in an internal structure could contain bits from an uninitialized Hypervisor stack slot that allows adjacent attacker to access arbitrary data.
Successful exploitation of the vulnerability may result in further attack.
9) Improper access control (CVE-ID: CVE-2017-15590)
The vulnerability allows an adjacent attacker to cause DoS conditions on the target system.The weakness exists due to an error with the setup of PCI MSI interrupts. An adjacent attacker can supply MSI and cause the hypervisor to crash.
10) Denial of service (CVE-ID: CVE-2017-15590)
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.The weakness exists in x86 systems due to multiple mapping issues in the setup of Peripheral Component Interconnect (PCI) Message Signaled Interrupts (MSI). An adjacent attacker can and cause the system to crash.
Successful exploitation of the vulnerability may result in denial of service.
11) Improper input validation (CVE-ID: CVE-2017-15591)
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.The weakness exists in x86 systems due to improper request processing. An adjacent attacker can use a domain that controls a guest system and cause the system to crash.
Successful exploitation of the vulnerability may result in denial of service.
12) Privilege escalation (CVE-ID: CVE-2017-15592)
The vulnerability allows an adjacent attacker to cause DoS conditions or gain elevated privileges on the target system.The weakness exists due to mishandling of self-linear shadow mappings for translated guests. An adjacent attacker can supply self-linear shadow mappings and cause the hypervisor to crash or possibly gain elevated privileges.
13) Memory corruption (CVE-ID: CVE-2017-15592)
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.The weakness exists in HVM guest systems due to insufficient memory processing. An adjacent attacker can trigger memory corruption and cause the system to crash.
Successful exploitation of the vulnerability may result in denial of service.
14) Memory leak (CVE-ID: CVE-2017-15593)
The vulnerability allows an adjacent attacker to cause DoS conditions on the target system.The weakness exists due to mishandling of reference counts. An adjacent attacker can trigger memory leak and cause the service to crash.
15) Memory corruption (CVE-ID: CVE-2017-15593)
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.The weakness exists in x86 PV guest systems due to insufficient memory processing. An adjacent attacker can trigger excessive memory consumption and cause the system to crash.
Successful exploitation of the vulnerability may result in denial of service.
16) Privilege escalation (CVE-ID: CVE-2017-15594)
The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.The weakness exists due to mishandling of IDT settings during CPU hotplugging. An adjacent attacker can gain elevated privileges or cause hypervisor crash.
17) Privilege escalation (CVE-ID: CVE-2017-15594)
The vulnerability allows an adjacent attacker to gain elevated privileges on the target system.The weakness exists in x86 PV guest systems using SVM due to improper handling of Interrupt Descriptor Table (IDT) settings when a new CPU is hot-plugged and brought online. An adjacent attacker can gain elevated privileges and possibly cause the system to crash.
Successful exploitation of the vulnerability may result in denial of service.
18) Resource exhaustion (CVE-ID: CVE-2017-15595)
The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.The weakness exists due to improper input validation. An adjacent attacker can supply specially crafted page-table stacking, trigger unbounded recursion, stack consumption, gain elevated privileges or cause hypervisor crash.
19) Infinite loop (CVE-ID: CVE-2017-17044)
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.The weakness exists due to an infinite loop. An adjacent attacker can trigger an error handling flaw in the processing of errors from the Populate on Demand (PoD) code and cause the service to crash.
20) Privilege escalation (CVE-ID: CVE-2017-17045)
The vulnerability allows an adjacent attacker to gain elevated privileges on the target system.The weakness exists due to improper privileges control. An adjacent attacker can trigger a p2m error checking flaw in the Populate on Demand (PoD) code and gain write access to freed memory and gain elevated privileges on the host system.
21) Information disclosure (CVE-ID: CVE-2017-17046)
The vulnerability allows an adjacent attacker to obtain potentially sensitive information.The weakness exists in ARM systems due to the improper scrubbing of DRAM content during reboots when memory is in disjoint blocks or when the first block isn't at physical address 0. An adjacent attacker gain access to arbitrary data on the target system.
22) Memory corruption (CVE-ID: CVE-2017-17563)
The vulnerability allows an adjacent attacker to gain elevated privileges or cause a denial of service (DoS) condition on a targeted host system.The weakness exists due to insufficient reference count overflow checking. An adjacent attacker can use a mask that is larger than the reference count that is set on a targeted system, trigger memory corruption and cause the hypervisor to crash or gain elevated privileges.
23) Denial of service (CVE-ID: CVE-2017-17564)
The vulnerability allows an adjacent attacker to cause DoS condition or gain elevated privileges.The weakness exists due to improper error handling for reference counts. A remote attacker can trigger memory corruption, cause the hypervisor to crash or gain elevated privileges on the target system.
24) Denial of service (CVE-ID: CVE-2017-17565)
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.The weakness exists due to improper assertion related to machine-to-physical (M2P) translation table entries. A remote attacker can cause the system to crash.
25) Denial of service (CVE-ID: CVE-2017-17566)
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.The weakness exists due to improper auxiliary page mapping. A remote attacker can cause the system to crash.
Remediation
Install update from vendor's website.