SB2024092549 - Gentoo update for Xen
Published: September 25, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 20 secuirty vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2022-42336)
The vulnerability allows a remote guest to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow in SSBD imlementation. A remote guest can mislead other guests into observing SSBD active when it is not.
2) Information disclosure (CVE-ID: CVE-2023-28746)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors. A local user can gain access to sensitive information.
3) Buffer overflow (CVE-ID: CVE-2023-34319)
The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in netback when processing certain packets. A malicious guest can send specially crafted packets to the backend, trigger memory corruption and crash the hypervisor.
4) Deadlock (CVE-ID: CVE-2023-34320)
The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.
The vulnerability exists due to a coding error in code for Cortex-A77 cores (r0p0 and r1p0). A malicious guest can trigger a deadlock and perform a denial of service (DoS) attack.
5) Information disclosure (CVE-ID: CVE-2023-34321)
The vulnerability allows a malicious guest to gain access to potentially sensitive information.
The vulnerability exists due to an error when cleaning cache on arm32 systems. A malicious guest can read sensitive data from memory of another guest.
6) Resource management error (CVE-ID: CVE-2023-34322)
The vulnerability allows a malicious guest to escalate privileges on the system.
The vulnerability exists due to improper management of internal resources when running PV guests in shadow paging mode. A malicious guest can run a specially crafted application on the system that causes shortage of memory in the associated with the domain shadow pool and forces Xen to tear down page tables. This can result in memory leak, denial of service or privilege escalation.
The vulnerability can be exploited by 64-bit PV guests on x86 systems.
7) Reachable Assertion (CVE-ID: CVE-2023-34323)
The vulnerability allows a remote guest to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion when handling negative quota values in C Xenstored. A malicious guest can craft a transaction that forces C Xenstored to check quota value and perform a denial of service attack.
8) Deadlock (CVE-ID: CVE-2023-34324)
The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.
The vulnerability exists due to improper event handling in Linux kernel. A malicious guest can disable paravirtualized device to cause a deadlock in a backend domain (other than dom0).
9) Stack-based buffer overflow (CVE-ID: CVE-2023-34325)
The vulnerability allows a remote guest to escalate privileges on the system.
10) State Issues (CVE-ID: CVE-2023-34327)
The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.
The vulnerability exists due to improper validation of guest state when using Debug Masks in HVM vCPU. A malicious guest can perform a denial of service (DoS) attack against the guest OS.
11) State Issues (CVE-ID: CVE-2023-34328)
The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.
The vulnerability exists due to improper validation of guest state in PV vCPU. A malicious guest place a breakpoint over the live GDT and perform a denial of service (DoS) attack against the host.12) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-46835)
The vulnerability allows a remote guest to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions caused by a mismatch in IOMMU quarantine page table levels. A device in quarantine mode can access data from previous quarantine page table usages, possibly leaking data used by previous domains that also had the device assigned.
13) Security features bypass (CVE-ID: CVE-2023-46836)
The vulnerability allows a remote guest to bypass implemented security restrictions.
The vulnerability exists due to improper implementation of mitigations against BTC/SRSO. A malicious guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack against Xen, which can result in memory access to other guests.
14) Resource management error (CVE-ID: CVE-2023-46837)
The vulnerability allows a malicious guest to gain access to sensitive information.
The vulnerability exists due to improper management of internal resources on arm32 processors caused by improper invalidation of cache. A malicious guest can read sensitive data from memory of another guest.
15) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-46839)
The vulnerability allows a malicious guest to gain access to sensitive information.
The vulnerability exists due to an error in phantom functions implementation for PCI devices. Under certain circumstances a malicious guest assigned a PCI device with phantom functions may be able to access memory from a previous owner of the device.
16) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-46840)
The vulnerability allows a malicious guest to bypass implemented security restrictions.
The vulnerability exists due to incorrect placement of a preprocessor directive in source code, which results in a logic error when support for HVM guests is compiled out of Xen and CONFIG_HVM is disabled at Xen's build time. When a device is removed from a domain, it is not properly quarantined and retains its access to the domain to which it was previously assigned. An attacker with control over a malicious guest can retain access to the domain after it has been removed from it.
17) Resource management error (CVE-ID: CVE-2023-46841)
The vulnerability allows a remote guest to perform a denial of service (DoS) attack.
The vulnerability exists due to incorrect implementation of the Shadow Stacks (CET-SS) feature. An unprivileged guest can cause a hypervisor crash, causing a Denial of Service (DoS) of the entire host.
18) Input validation error (CVE-ID: CVE-2023-46842)
The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of register values when invoking a hypercall. A malicious HVM or PVH guest can pass specially crafted input to the hypervisor and perform a denial of service (DoS) attack.
19) Race condition (CVE-ID: CVE-2024-2193)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a speculative race condition. A local user can exploit the race and gain unauthorized access to contents of arbitrary host memory, including memory assigned to other guests.
The vulnerability was dubbed GhostRace.
20) Type confusion (CVE-ID: CVE-2024-31142)
The vulnerability allows a malicious guest to escalate privileges on the system.
The vulnerability exists due to a logical error caused by a branch type confusion when implementing fixes for the following vulnerabilities:
#VU65219 (CVE-2022-23816)
#VU65204 (CVE-2022-23825)
#VU65205 (CVE-2022-29900)
#VU79263 (CVE-2023-20569)
A malicious guest can gain access to sensitive information and escalate privileges on the system.
Remediation
Install update from vendor's website.