SUSE update for xen
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2022-23033 CVE-2022-23034 CVE-2022-23035 |
| CWE-ID | CWE-863 CWE-191 CWE-459 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
SUSE Linux Enterprise Server for SAP Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system SUSE CaaS Platform Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system xen-tools-domU-debuginfo Operating systems & Components / Operating system package or component xen-tools-domU Operating systems & Components / Operating system package or component xen-tools-debuginfo Operating systems & Components / Operating system package or component xen-tools Operating systems & Components / Operating system package or component xen-libs-debuginfo Operating systems & Components / Operating system package or component xen-libs Operating systems & Components / Operating system package or component xen-devel Operating systems & Components / Operating system package or component xen-debugsource Operating systems & Components / Operating system package or component xen Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Incorrect authorization
EUVDB-ID: #VU63797
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-23033
CWE-ID:
CWE-863 - Incorrect Authorization
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to guest_physmap_remove_page() function does not remove p2m mappings. A local user issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, can cause information leaks, Denial of Service (DoS), or escalate privileges on the system.
MitigationUpdate the affected package xen to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP1-LTSS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS
xen-tools-domU-debuginfo: before 4.12.4_18-3.60.2
xen-tools-domU: before 4.12.4_18-3.60.2
xen-tools-debuginfo: before 4.12.4_18-3.60.2
xen-tools: before 4.12.4_18-3.60.2
xen-libs-debuginfo: before 4.12.4_18-3.60.2
xen-libs: before 4.12.4_18-3.60.2
xen-devel: before 4.12.4_18-3.60.2
xen-debugsource: before 4.12.4_18-3.60.2
xen: before 4.12.4_18-3.60.2
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-ESPOS:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:
http://www.suse.com/support/update/announcement/2022/suse-su-20220468-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Integer underflow
EUVDB-ID: #VU63798
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-23034
CWE-ID:
CWE-191 - Integer underflow
Exploit availability: No
DescriptionThe vulnerability allows a local user can perform a denial of service attack.
The vulnerability exists due to integer underflow when unmapping a grant to address XSA-380. A local user can request two forms of mappings to perform a denial of service attack.
MitigationUpdate the affected package xen to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP1-LTSS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS
xen-tools-domU-debuginfo: before 4.12.4_18-3.60.2
xen-tools-domU: before 4.12.4_18-3.60.2
xen-tools-debuginfo: before 4.12.4_18-3.60.2
xen-tools: before 4.12.4_18-3.60.2
xen-libs-debuginfo: before 4.12.4_18-3.60.2
xen-libs: before 4.12.4_18-3.60.2
xen-devel: before 4.12.4_18-3.60.2
xen-debugsource: before 4.12.4_18-3.60.2
xen: before 4.12.4_18-3.60.2
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-ESPOS:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:
http://www.suse.com/support/update/announcement/2022/suse-su-20220468-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Incomplete cleanup
EUVDB-ID: #VU63800
Risk: Low
CVSSv3.1: 5.9 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-23035
CWE-ID:
CWE-459 - Incomplete cleanup
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to escalate privileges on the system.
The vulnerability exists due to insufficient cleanup of passed-through device IRQs. An attacker with physical access can cause a Denial of Service (DoS) and escalate privileges on the system.
MitigationUpdate the affected package xen to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP1-LTSS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS
xen-tools-domU-debuginfo: before 4.12.4_18-3.60.2
xen-tools-domU: before 4.12.4_18-3.60.2
xen-tools-debuginfo: before 4.12.4_18-3.60.2
xen-tools: before 4.12.4_18-3.60.2
xen-libs-debuginfo: before 4.12.4_18-3.60.2
xen-libs: before 4.12.4_18-3.60.2
xen-devel: before 4.12.4_18-3.60.2
xen-debugsource: before 4.12.4_18-3.60.2
xen: before 4.12.4_18-3.60.2
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-ESPOS:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:
http://www.suse.com/support/update/announcement/2022/suse-su-20220468-1/
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
