SB2024081461 - Multiple vulnerabilities in Xen

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Resource management error (CVE-ID: CVE-2024-31146)

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to improper management of shared resources when using PCI pass-through. A malicious guest can escalate privileges on the system.

2) Improper error handling (CVE-ID: CVE-2024-31145)

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to improper error handling in x86 IOMMU identity mapping. A malicious guest can access memory regions related to other guests or the hypervisor.

Remediation

Install update from vendor's website.

References

• https://xenbits.xen.org/xsa/advisory-461.html
• https://xenbits.xen.org/xsa/advisory-460.html