SUSE update for xen

Published: 2022-02-04

Risk	Low
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2022-23033 CVE-2022-23034 CVE-2022-23035
CWE-ID	CWE-863 CWE-191 CWE-459
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Linux Enterprise Desktop Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Manager Proxy Operating systems & Components / Operating system SUSE Linux Enterprise Micro Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications Operating systems & Components / Operating system SUSE Linux Enterprise Module for Basesystem Operating systems & Components / Operating system SUSE Linux Enterprise Module for Server Applications Operating systems & Components / Operating system xen-tools-domU-debuginfo Operating systems & Components / Operating system package or component xen-tools-domU Operating systems & Components / Operating system package or component xen-libs-debuginfo Operating systems & Components / Operating system package or component xen-libs Operating systems & Components / Operating system package or component xen-tools-xendomains-wait-disk Operating systems & Components / Operating system package or component xen-tools-debuginfo Operating systems & Components / Operating system package or component xen-tools Operating systems & Components / Operating system package or component xen-devel Operating systems & Components / Operating system package or component xen-debugsource Operating systems & Components / Operating system package or component xen Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Incorrect authorization

EUVDB-ID: #VU63797

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23033

CWE-ID: CWE-863 - Incorrect Authorization

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to guest_physmap_remove_page() function does not remove p2m mappings. A local user issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, can cause information leaks, Denial of Service (DoS), or escalate privileges on the system.

Mitigation

Update the affected package xen to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 15-SP3-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS

SUSE Linux Enterprise Desktop: 15-SP3

SUSE Manager Server: 4.2

SUSE Manager Proxy: 4.2

SUSE Linux Enterprise Micro: 5.1

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Basesystem: 15-SP3

SUSE Linux Enterprise Module for Server Applications: 15-SP3

xen-tools-domU-debuginfo: before 4.14.3_06-150300.3.18.2

xen-tools-domU: before 4.14.3_06-150300.3.18.2

xen-libs-debuginfo: before 4.14.3_06-150300.3.18.2

xen-libs: before 4.14.3_06-150300.3.18.2

xen-tools-xendomains-wait-disk: before 4.14.3_06-150300.3.18.2

xen-tools-debuginfo: before 4.14.3_06-150300.3.18.2

xen-tools: before 4.14.3_06-150300.3.18.2

xen-devel: before 4.14.3_06-150300.3.18.2

xen-debugsource: before 4.14.3_06-150300.3.18.2

xen: before 4.14.3_06-150300.3.18.2

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220333-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer underflow

EUVDB-ID: #VU63798

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23034

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user can perform a denial of service attack.

The vulnerability exists due to integer underflow when unmapping a grant to address XSA-380. A local user can request two forms of mappings to perform a denial of service attack.

Mitigation

Update the affected package xen to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 15-SP3-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS

SUSE Linux Enterprise Desktop: 15-SP3

SUSE Manager Server: 4.2

SUSE Manager Proxy: 4.2

SUSE Linux Enterprise Micro: 5.1

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Basesystem: 15-SP3

SUSE Linux Enterprise Module for Server Applications: 15-SP3

xen-tools-domU-debuginfo: before 4.14.3_06-150300.3.18.2

xen-tools-domU: before 4.14.3_06-150300.3.18.2

xen-libs-debuginfo: before 4.14.3_06-150300.3.18.2

xen-libs: before 4.14.3_06-150300.3.18.2

xen-tools-xendomains-wait-disk: before 4.14.3_06-150300.3.18.2

xen-tools-debuginfo: before 4.14.3_06-150300.3.18.2

xen-tools: before 4.14.3_06-150300.3.18.2

xen-devel: before 4.14.3_06-150300.3.18.2

xen-debugsource: before 4.14.3_06-150300.3.18.2

xen: before 4.14.3_06-150300.3.18.2

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220333-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Incomplete cleanup

EUVDB-ID: #VU63800

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23035

CWE-ID: CWE-459 - Incomplete cleanup

Exploit availability: No

Description

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to insufficient cleanup of passed-through device IRQs. An attacker with physical access can cause a Denial of Service (DoS) and escalate privileges on the system.

Mitigation

Update the affected package xen to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 15-SP3-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS

SUSE Linux Enterprise Desktop: 15-SP3

SUSE Manager Server: 4.2

SUSE Manager Proxy: 4.2

SUSE Linux Enterprise Micro: 5.1

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Basesystem: 15-SP3

SUSE Linux Enterprise Module for Server Applications: 15-SP3

xen-tools-domU-debuginfo: before 4.14.3_06-150300.3.18.2

xen-tools-domU: before 4.14.3_06-150300.3.18.2

xen-libs-debuginfo: before 4.14.3_06-150300.3.18.2

xen-libs: before 4.14.3_06-150300.3.18.2

xen-tools-xendomains-wait-disk: before 4.14.3_06-150300.3.18.2

xen-tools-debuginfo: before 4.14.3_06-150300.3.18.2

xen-tools: before 4.14.3_06-150300.3.18.2

xen-devel: before 4.14.3_06-150300.3.18.2

xen-debugsource: before 4.14.3_06-150300.3.18.2

xen: before 4.14.3_06-150300.3.18.2

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220333-1/

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.