Ubuntu update for xen

1) Information disclosure

EUVDB-ID: #VU28928

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-0543

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to incomplete cleanup from specific special register read operations in some Intel(R) Processors. A local user can gain unauthorized access to sensitive information on the system.

Mitigation

Update the affected package xen to the latest version.

Vulnerable software versions

Ubuntu: 20.04

libxenevtchn1 (Ubuntu package): before 4.11.3+24-g14b62ab3e5-1ubuntu2.3

xen-utils-common (Ubuntu package): before 4.11.3+24-g14b62ab3e5-1ubuntu2.3

xen-hypervisor-4.11-arm64 (Ubuntu package): before 4.11.3+24-g14b62ab3e5-1ubuntu2.3

xen-utils-4.11 (Ubuntu package): before 4.11.3+24-g14b62ab3e5-1ubuntu2.3

xenstore-utils (Ubuntu package): before 4.11.3+24-g14b62ab3e5-1ubuntu2.3

libxendevicemodel1 (Ubuntu package): before 4.11.3+24-g14b62ab3e5-1ubuntu2.3

libxenmisc4.11 (Ubuntu package): before 4.11.3+24-g14b62ab3e5-1ubuntu2.3

xen-hypervisor-4.11-armhf (Ubuntu package): before 4.11.3+24-g14b62ab3e5-1ubuntu2.3

xen-hypervisor-4.11-amd64 (Ubuntu package): before 4.11.3+24-g14b62ab3e5-1ubuntu2.3

libxengnttab1 (Ubuntu package): before 4.11.3+24-g14b62ab3e5-1ubuntu2.3

CPE2.3

cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:

External links

http://ubuntu.com/security/notices/USN-5617-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU31973

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-11739

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the "critical" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS).