SB2025061058 - SUSE update for xen 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025061058

SB2025061058 - SUSE update for xen

Published: June 10, 2025

Security Bulletin ID SB2025061058
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 33% Medium 33% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Resource management error (CVE-ID: CVE-2024-28956)

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to an error in the hardware support for prediction-domain isolation dubbed "Indirect Target Selection". A malicious guest can infer the contents of arbitrary host memory, including memory assigned to other guests.


2) Processor optimization removal or modification of security-critical code (CVE-ID: CVE-2024-53241)

The vulnerability allows a malicious guest to gain access to sensitive information.

The vulnerability exists due to implemented mitigations for hardware vulnerabilities related to Xen hypercall page implementation the guest OS is relying on to work might not be fully functional, resulting in e.g. guest user processes being able to read data they ought not have access to.


3) Deadlock (CVE-ID: CVE-2025-1713)

The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking when handling legacy PCI devices pass-through. A malicious low-privileged guest can crash the entire host. 

Successful exploitation of the vulnerability requires Intel IOMMU hardware (VT-d).


Remediation

Install update from vendor's website.

References