SB2018031522 - SUSE Linux update for xen

Description

This security bulletin contains information about 14 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2017-11334)

The vulnerability allows an adjacent authenticated attacker to cause DoS condition on the target system.

The weakness exists due to out-of-bounds read. An adjacent attacker can cause the service to crash by leveraging use of qemu_map_ram_ptr to access guest ram block area.

2) Resource exhaustion (CVE-ID: CVE-2017-15595)

The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.

The weakness exists due to improper input validation. An adjacent attacker can supply specially crafted page-table stacking, trigger unbounded recursion, stack consumption, gain elevated privileges or cause hypervisor crash.

3) Memory corruption (CVE-ID: CVE-2017-17563)

The vulnerability allows an adjacent attacker to gain elevated privileges or cause a denial of service (DoS) condition on a targeted host system.

The weakness exists due to insufficient reference count overflow checking. An adjacent attacker can use a mask that is larger than the reference count that is set on a targeted system, trigger memory corruption and cause the hypervisor to crash or gain elevated privileges.

4) Denial of service (CVE-ID: CVE-2017-17564)

The vulnerability allows an adjacent attacker to cause DoS condition or gain elevated privileges.

The weakness exists due to improper error handling for reference counts. A remote attacker can trigger memory corruption, cause the hypervisor to crash or gain elevated privileges on the target system.

5) Denial of service (CVE-ID: CVE-2017-17565)

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists due to improper assertion related to machine-to-physical (M2P) translation table entries. A remote attacker can cause the system to crash.

6) Denial of service (CVE-ID: CVE-2017-17566)

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists due to improper auxiliary page mapping. A remote attacker can cause the system to crash.

7) Out-of-bounds read (CVE-ID: CVE-2017-18030)

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists in the cirrus_invalidate_region function in hw/display/cirrus_vga.c due to out-of-bounds read. A remote attacker can use vectors related to negative pitch, trigger memory error and cause QEMU process to crash.

8) Information disclosure (CVE-ID: CVE-2017-5715)

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists in Intel CPU hardware due to improper implementation of the speculative execution of instructions. A local attacker can utilize branch target injection, execute arbitrary code, perform a side-channel attack and read sensitive memory information.

9) Information disclosure (CVE-ID: CVE-2017-5753)

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists in Intel CPU hardware due to improper implementation of the speculative execution of instructions. A local attacker can perform a bounds check bypass, execute arbitrary code, conduct a side-channel attack and read sensitive memory information.

10) Information disclosure (CVE-ID: CVE-2017-5754)

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists in Intel CPU hardware due to side-channel attacks, which are also referred to as Meltdown attacks. A local attacker can execute arbitrary code, perform a side-channel analysis of the data cache and gain access to sensitive information including memory from the CPU cache.

11) Integer overflow (CVE-ID: CVE-2017-5898)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c due to integer overflow when built with the CCID Card device emulator support. A local attacker can cause the service to crash via a large Application Protocol Data Units (APDU) unit

12) Out-of-bounds read (CVE-ID: CVE-2018-5683)

The vulnerability allows an adjacent low-privileged attacker to cause DoS condition on the target system.

The weakness exists in the vga_draw_text function due to out-of-bounds read. A remote attacker can leverage improper memory address validation, trigger memory error and cause QEMU process to crash.

13) Resource exhaustion (CVE-ID: CVE-2018-7540)

The vulnerability allows an adjacent authenticated attacker to cause a DoS condition on the target system.

The weakness exists due to non-preemptable L3/L4 pagetable freeing. An adjacent attacker can exhaust all available CPU resources and cause the service to crash.

14) Memory corruption (CVE-ID: CVE-2018-7541)

The vulnerability allows an adjacent attacker to cause DoS condition and gain elevated privileges on the target system.

The weakness exists due to an error when transitioning from v2 to v1. An adjacent attacker can trigger memory corruption, cause the service to crash and gain root privileges.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2018-03/msg00035.html