Important: kernel

Issue Overview: A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor implements its device control API. While creating a device via kvmioctlcreatedevice, the device holds a reference to a VM object, later this reference is transferred to the caller's file descript...

Citrix XenServer Multiple Security Updates

Description of Problem A number of security vulnerabilities have been identified in Citrix XenServer that, depending on configuration, may allow a malicious user of a PV guest VM to crash or compromise the host. These vulnerabilities affect all currently supported versions of Citrix XenServer up ...

x86: PV kernel context switch corruption

ISSUE DESCRIPTION On hardware supporting the fsgsbase feature, 64bit PV guests can set and clear the applicable control bit in its virtualised %cr4, but the feature remains fully active in hardware. Therefore, the associated instructions are actually usable. Linux, which does not currently suppor...

x86 shadow: Insufficient TLB flushing when using PCID

ISSUE DESCRIPTION Use of Process Context Identifiers PCID was introduced into Xen in order to improve performance after XSA-254 and in particular its Meltdown sub-issue. This enablement implied changes to the TLB flushing logic. One aspect which was overlooked is the safety of switching between...

x86: steal_page violates page_struct access discipline

ISSUE DESCRIPTION Xen's reference counting rules were designed to allow pages to change owner and state without requiring a global lock. Each page has a page structure, and a very specific set of access disciplines must be observed to ensure that pages are freed properly, and that no writable...

race with pass-through device hotplug

ISSUE DESCRIPTION When adding a passed-through PCI device to a domain after it was already started, IOMMU page tables may need constructing on the fly. For PV guests the decision whether a page ought to have a mapping is based on whether the page is writable, to prevent IOMMU access to things lik...

x86: insufficient TLB flushing when using PCID

ISSUE DESCRIPTION Use of Process Context Identifiers PCID was introduced into Xen in order to improve performance after XSA-254 and in particular its Meltdown sub-issue. This enablement implied changes to the TLB flushing logic. The particular case of context switch to a vCPU of a PCID-enabled...

Security update for spice (important)

openSUSE Security Update: Security update for spice Announcement ID: openSUSE-SU-2019:0167-1 Rating: important References: 1109044 1122706 Cross-References: CVE-2019-3813 Affected Products: openSUSE Leap 15.0 An update that solves one vulnerability and has one errata is now available. Description...

CVE-2019-7221

A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor emulates a preemption timer for L2 guests when nested =1 virtualization is enabled. This high resolution timerhrtimer runs when a L2 guest is active. After VM exit, the syncvmcs12 timer object is stopped. The...

SUSE SLES15 Security Update : spice (SUSE-SU-2019:0242-1)

This update for spice fixes the following issues : Security issue fixed : CVE-2019-3813: Fixed a out-of-bounds read in the memslotgetvirt function that could lead to denial-of-service or code-execution bsc1122706. Non-security issue fixed: Include spice-server tweak to compensate for performance...

SUSE-SU-2019:0242-1 Security update for spice

This update for spice fixes the following issues: Security issue fixed: - CVE-2019-3813: Fixed a out-of-bounds read in the memslotgetvirt function that could lead to denial-of-service or code-execution bsc1122706. Non-security issue fixed: - Include spice-server tweak to compensate for performanc...

FreeBSD : Gitlab -- Multiple vulnerabilities (467b7cbe-257d-11e9-8573-001b217b3468)

Gitlab reports : Remote Command Execution via GitLab Pages Covert Redirect to Steal GitHub/Bitbucket Tokens Remote Mirror Branches Leaked by Git Transfer Refs Denial of Service with Markdown Guests Can View List of Group Merge Requests Guest Can View Merge Request Titles via System Notes Persiste...

Important: Red Hat Security Advisory: spice-server security update

An update for spice-server is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

openSUSE Security Update : virtualbox (openSUSE-2019-84)

This update for virtualbox version 5.2.24 fixes the following issues : Update fixes multiple vulnerabilities : CVE-2019-2500, CVE-2019-2524, CVE-2019-2552, CVE-2018-3309, CVE-2019-2520 CVE-2019-2521, CVE-2019-2522, CVE-2019-2523, CVE-2019-2526, CVE-2019-2548 CVE-2018-11763, CVE-2019-2511,...

EulerOS 2.0 SP3 : kernel (EulerOS-SA-2018-1433)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that paravirtpatchcall/jump functions in the arch/x86/kernel/paravirt.c in the Linux kernel mishandles certain indirect calls, whic...

Xen Project x86 IOREQ Server Resource Accounting DoS (XSA-276)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a guest-to-host denial of service vulnerability. An attacker located on a guest virtual machine may be able to exploit this vulnerability to affect the availability of the host system. Th...

Xen Project INVPCID with Non-Canonical Addresses DoS (XSA-279)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a guest-to-host denial of service vulnerability. An attacker located on a guest virtual machine may be able to exploit this vulnerability to affect the availability of the host system. On...

DEBIAN-CVE-2018-19965

An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service host OS crash because GP0 can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 aka Meltdown mitigation...

UBUNTU-CVE-2018-19966

An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service host OS crash or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorre...

Marriott hotel data breach: Sensitive data of 500 million guests stolen

By Waqas Marriott has announced that it has suffered a massive data breach after attackers hacked its guest reservation system at Starwood hotels, a group of hotels the company took over in 2016 - These hotels include Sheraton, St. Regis, Westin and W Hotels. The breach was discovered last week...