CVE-2020-15565

Root cause: CVE-2020-15565 arises from insufficient cache write-back under VT-d when page tables are shared between IOMMU and CPU, requiring flushing of both CPU and IOMMU TLBs. A backport/backing fixes missed a necessary cache flush, leaving IOMMU updates potentially non-coherent. Affected produ...

CVE-2020-15563

An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HV...

CVE-2020-15563

An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HV...

CVE-2020-15563

CVE-2020-15563 – Xen inverted code path DoS (XSA-319) Affected: Xen hypervisor (versions 4.8 and newer; 4.7 and older are not affected). Only x86 HVM guests using shadow paging are vulnerable; x86 PV guests and HAP-backed guests are not. The issue arises from an inverted conditional in x86 HVM gu...

CVE-2020-15563

An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HV...

inverted code paths in x86 dirty VRAM tracking

ISSUE DESCRIPTION An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. IMPACT A malicious or buggy HVM guest may cause the hypervisor to crash, resulting in Denial of Service DoS...

insufficient cache write-back under VT-d

ISSUE DESCRIPTION When page tables are shared between IOMMU and CPU, changes to them require flushing of both TLBs. Furthermore, IOMMUs may be non-coherent, and hence prior to flushing IOMMU TLBs CPU cached also needs writing back to memory after changes were made. Such writing back of cached dat...

non-atomic modification of live EPT PTE

ISSUE DESCRIPTION When mapping guest EPT nested paging tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially-written PTE to the hardware, which an attacker might be able ...

PT-2020-14494

Name of the Vulnerable Software and Affected Versions Xen versions 4.8 through 4.13.x Description An issue in Xen allows x86 HVM guest OS users to cause a hypervisor crash due to an inverted conditional in the dirty video RAM tracking code. This enables malicious or buggy HVM guests to make Xen...

CVE-2020-15565: Uncontrolled Resource Consumption

An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain privileges because of insufficient cache write-back under VT-d. When page tables are shared between IOMMU and CPU, changes to them require flushing of both...

CVE-2020-15563: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HV...

SUSE SLES12 Security Update : qemu (SUSE-SU-2020:1538-1)

This update for qemu fixes the following issues : Security issues fixed : CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code bsc1166240. CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation bsc1146873. CVE-2020-1983: Fixed a use-after-free in the ipreass...

Privilege Escalation

kernel is vulnerable to privilege escalation. The vulnerability exists as a flaw was found in the Xen PAL emulation on Intel 64 platforms. A guest Hardware-assisted virtual machine HVM could read the arbitrary physical memory of the host system, which could make information available to...

Updated xen packages fix security vulnerability

- Updated from 4.12.0 to 4.12.1 - Device quarantine for alternate pci assignment methods XSA-306 - x86: Machine Check Error on Page Size Change DoS XSA-304, CVE-2018-12207 - TSX Asynchronous Abort speculative side channel XSA-305, CVE-2019-11135 - VCPUOPinitialise DoS XSA-296, CVE-2019-18420...

Fedora 31 : xen (2019-6aad703290)

denial of service in findnextbit XSA-307, CVE-2019-19581, CVE-2019-19582 1782211 denial of service in HVM/PVH guest userspace code XSA-308, CVE-2019-19583 1782206 privilege escalation due to malicious PV guest XSA-309, CVE-2019-19578 1782210 Further issues with restartable PV type change operatio...

SUSE SLES12 Security Update : xen (SUSE-SU-2019:3296-1)

This update for xen fixes the following issues : CVE-2019-19581: Fixed a potential out of bounds on 32-bit Arm bsc1158003 XSA-307. CVE-2019-19582: Fixed a potential infinite loop when x86 accesses to bitmaps with a compile time known size of 64 bsc1158003 XSA-307. CVE-2019-19583: Fixed improper...

SUSE SLES12 Security Update : xen (SUSE-SU-2019:3297-1)

This update for xen fixes the following issues : CVE-2019-19581: Fixed a potential out of bounds on 32-bit Arm bsc1158003 XSA-307. CVE-2019-19582: Fixed a potential infinite loop when x86 accesses to bitmaps with a compile time known size of 64 bsc1158003 XSA-307. CVE-2019-19583: Fixed improper...

CVE-2019-19583

An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service guest OS crash because VMX VMEntry checks mishandle a certain case. Please see XSA-260 for background on the MovSS shadow. Please see XSA-156 for background on the need for DB...

ALPINE-CVE-2019-19583

An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service guest OS crash because VMX VMEntry checks mishandle a certain case. Please see XSA-260 for background on the MovSS shadow. Please see XSA-156 for background on the need for DB...

DEBIAN-CVE-2019-19577

An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of service or possibly gain privileges by triggering data-structure access during pagetable-height updates. When running on AMD systems with an IOMMU, Xen attempted to dynamically adapt the number ...