SUSE SLES12 Security Update : xen (SUSE-SU-2019:0827-1)

This update for xen fixes the following issues : Security issues fixed : CVE-2019-6778: Fixed a heap buffer overflow in tcpemu found in slirp bsc1123157. CVE-2017-13672: Fixed an out of bounds read access during display update bsc1056336. Fixed an issue which could allow malicious or buggy guests...

SUSE-SU-2019:0825-1 Security update for xen

This update for xen fixes the following issues: Security issues fixed: - CVE-2018-18849: Fixed an out of bounds memory access issue that was found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a message in lsidomsgin. It could occur during migration if the 'msglen' field has an...

openSUSE Security Update : xen (openSUSE-2019-1046) (Foreshadow)

This update for xen fixes the following issues : Update to Xen 4.10.2 bug fix release bsc1027519. Security vulnerabilities fixed : - CVE-2018-19961, CVE-2018-19962: Fixed an issue related to insufficient TLB flushing with AMD IOMMUs, which potentially allowed a guest to escalate its privileges, m...

Fedora 28 : xen (2019-bce6498890)

xen: various flaws 1685577 grant table transfer issues on large hosts XSA-284 race with pass-through device hotplug XSA-285 x86: stealpage violates pagestruct access discipline XSA-287 x86: Inconsistent PV IOMMU discipline XSA-288 missing preemption in x86 PV page table unvalidation XSA-290 x86/P...

Xen Project Process Context Identifiers TLB Flushing Multiple Vulnerabilities (XSA-292)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by multiple vulnerabilities including denial of service, information disclosure, and privilege escalation. Only x86 systems are affected. Note that Nessus has checked the changeset versions...

Fedora 29 : xen (2019-3e89502cb1)

xen: various flaws 1685577 grant table transfer issues on large hosts XSA-284 race with pass-through device hotplug XSA-285 x86: stealpage violates pagestruct access discipline XSA-287 x86: Inconsistent PV IOMMU discipline XSA-288 missing preemption in x86 PV page table unvalidation XSA-290 x86/P...

x86 shadow: Insufficient TLB flushing when using PCID

ISSUE DESCRIPTION Use of Process Context Identifiers PCID was introduced into Xen in order to improve performance after XSA-254 and in particular its Meltdown sub-issue. This enablement implied changes to the TLB flushing logic. One aspect which was overlooked is the safety of switching between...

x86: insufficient TLB flushing when using PCID

ISSUE DESCRIPTION Use of Process Context Identifiers PCID was introduced into Xen in order to improve performance after XSA-254 and in particular its Meltdown sub-issue. This enablement implied changes to the TLB flushing logic. The particular case of context switch to a vCPU of a PCID-enabled...

Taking a page from the kernel's book: A TLB issue in mremap()

Posted by Jann Horn, Project Zero This is a technical blog post about TLB flushing bugs in kernels, intended for people interested in kernel security and memory management. Introduction: Bugs in Memory Management code There have been some pretty scary bugs in memory management in the past, like:...

SUSE SLES11 Security Update : xen (SUSE-SU-2019:13921-1)

This update for xen fixes the following issues : Security vulnerabilities fixed : CVE-2018-19961, CVE-2018-19962: Fixed an issue related to insufficient TLB flushing with AMD IOMMUs, which potentially allowed a guest to escalate its privileges, may cause a Denial of Service DoS affecting the enti...

SUSE SLES12 Security Update : xen (SUSE-SU-2019:0020-1)

This update for xen fixes the following issues : Security vulnerabilities fixed : CVE-2018-19961, CVE-2018-19962: Fixed an issue related to insufficient TLB flushing with AMD IOMMUs, which potentially allowed a guest to escalate its privileges, may cause a Denial of Service DoS affecting the enti...

SUSE-SU-2019:0020-1 Security update for xen

This update for xen fixes the following issues: Security vulnerabilities fixed: - CVE-2018-19961, CVE-2018-19962: Fixed an issue related to insufficient TLB flushing with AMD IOMMUs, which potentially allowed a guest to escalate its privileges, may cause a Denial of Service DoS affecting the enti...

Fedora 29 : xen (2018-2fde555d91)

insufficient TLB flushing / improper large page mappings with AMD IOMMUs XSA-275 1651665 resource accounting issues in x86 IOREQ server handling XSA-276 x86: incorrect error handling for guest p2m page removals XSA-277 x86: DoS from attempting to use INVPCID with a non-canonical addresses XSA-279...

SUSE-SU-2019:0003-1 Security update for xen

This update for xen fixes the following issues: - Update to Xen 4.11.1 bug fix release bsc1027519 - CVE-2018-17963: Fixed an integer overflow issue in the QEMU emulator, which could occur when a packet with large packet size is processed. A user inside a guest could have used this flaw to crash t...

SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2018:4300-1) (Foreshadow)

This update for xen fixes the following issues : Update to Xen 4.10.2 bug fix release bsc1027519. Security vulnerabilities fixed : CVE-2018-19961, CVE-2018-19962: Fixed an issue related to insufficient TLB flushing with AMD IOMMUs, which potentially allowed a guest to escalate its privileges, may...

CVE-2018-19965

An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service host OS crash because GP0 can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 aka Meltdown mitigation...

openSUSE Security Update : xen (openSUSE-2018-1530)

This update for xen fixes the following issues : Security issues fixed : - CVE-2018-18849: Fixed an out of bounds memory access issue was found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a message in lsidomsgin bsc1114423. - CVE-2018-18883: Fixed a NULL pointer dereference th...

Xen Project Insufficient TLB Flushing Vulnerability (XSA-275)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a vulnerability allowing a guest system to potentially elevate privileges, access protected information, and perform a DoS against the host. Only AMD systems with IOMMU enabled are...

openSUSE: Security Advisory for xen (openSUSE-SU-2018:4111-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2018-19965

An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service host OS crash because GP0 can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 aka Meltdown mitigation...