grant table v2 status pages may remain accessible after de-allocation

ISSUE DESCRIPTION Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched back from v2 to v1. The freeing of such...

Xen Paging Tables Race Condition (XSA-328)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an issue allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT nested paging tables, X...

Fedora 32 : kernel (2021-8d45d297c6)

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-8d45d297c6 advisory. - An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant...

FreeBSD -- Xen grant mapping error handling issues

Problem Description: Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on...

CVE-2021-26932

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then...

Design/Logic Flaw

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then...

CVE-2021-26932

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then...

stack corruption from XSA-346 change

ISSUE DESCRIPTION One of the two changes for XSA-346 introduced an on-stack array. The check for guarding against overrunning this array was off by one, allowing for corruption of the first stack slot immediately following this array. IMPACT A malicious or buggy HVM or PVH guest can cause Xen to...

CVE-2020-27672

A race condition flaw was found in the Xen code responsible for handling the updating of the hypervisor's own page tables. This flaw allows a malicious guest to cause a denial of service, host data corruption, or potential privilege escalation. The highest threat from this vulnerability is to...

CVE-2020-27671

An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service data corruption, cause a data leak, or possibly gain privileges because coalescing of per-page IOMMU TLB flushes is mishandled...

CVE-2020-27671

CVE-2020-27671 affects Xen 4.14.x and earlier on x86 HVM/PVH guests. The issue arises from mishandling coalescing of per-page IOMMU TLB flushes in the Xen IOMMU path, enabling a guest OS user to cause denial of service (data corruption), data leaks, or potentially a privilege escalation. Connecte...

PT-2020-16760

Name of the Vulnerable Software and Affected Versions Xen versions through 4.14.x Description An issue in Xen allows x86 HVM and PVH guest OS users to cause a denial of service, including data corruption, cause a data leak, or possibly gain privileges. This is due to the mishandling of coalescing...

undue deferral of IOMMU TLB flushes

ISSUE DESCRIPTION To efficiently change the physical to machine address mappings of a larger range of addresses for fully virtualized guests, Xen contains an optimization to coalesce per-page IOMMU TLB flushes into a single, wider flush after all adjustments have been made. While this is fine to ...

x86: Race condition in Xen mapping code

ISSUE DESCRIPTION The Xen code handling the updating of the hypervisor's own pagetables tries to use 2MiB and 1GiB superpages as much as possible to maximize TLB efficiency. Some of the operations for checking and coalescing superpages take non-negligible amount of time; to avoid potential lock...

CVE-2020-25596

A flaw was found in Xen. One of Xen's sanitization paths injects a GP fault and incorrectly delivers it twice to the guest. This flaw allows malicious or buggy user space to crash the guest kernel, resulting in a VM denial of service. Mitigation Running only x86 PVH/HVM guests avoids the...

CVE-2020-15567

An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT nested paging tables, Xen would in some circumstances use a series of non-atomic bitfield write...

Design/Logic Flaw

An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT nested paging tables, Xen would in some circumstances use a series of non-atomic bitfield write...

non-atomic modification of live EPT PTE

ISSUE DESCRIPTION When mapping guest EPT nested paging tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially-written PTE to the hardware, which an attacker might be able ...

Fedora 31 : xen (2019-6aad703290)

denial of service in findnextbit XSA-307, CVE-2019-19581, CVE-2019-19582 1782211 denial of service in HVM/PVH guest userspace code XSA-308, CVE-2019-19583 1782206 privilege escalation due to malicious PV guest XSA-309, CVE-2019-19578 1782210 Further issues with restartable PV type change operatio...

SUSE SLES12 Security Update : xen (SUSE-SU-2019:3296-1)

This update for xen fixes the following issues : CVE-2019-19581: Fixed a potential out of bounds on 32-bit Arm bsc1158003 XSA-307. CVE-2019-19582: Fixed a potential infinite loop when x86 accesses to bitmaps with a compile time known size of 64 bsc1158003 XSA-307. CVE-2019-19583: Fixed improper...