x86 64-bit bit test instruction emulation broken

ISSUE DESCRIPTION The x86 instructions BT, BTC, BTR, and BTS, when used with a destination memory operand and a source register rather than an immediate operand, access a memory location offset from that specified by the memory operand as specified by the high bits of the register source. When Xe...

x86 software interrupt injection mis-handled

ISSUE DESCRIPTION There are two closely-related bugs. When Xen emulates instructions which generate software interrupts it needs to perform a privilege check involving an IDT lookup. This check is sometimes erroneously conducted as if the IDT had the format for a 32-bit guest, when in fact it is ...

xen-kernel -- x86 segment base write emulation lacking canonical address checks

The Xen Project reports: Both writes to the FS and GS register base MSRs as well as the WRFSBASE and WRGSBASE instructions require their input values to be canonical, or a GP fault will be raised. When the use of those instructions by the hypervisor was enabled, the previous guard against GP faul...

xen-kernel -- x86 64-bit bit test instruction emulation broken

The Xen Project reports: The x86 instructions BT, BTC, BTR, and BTS, when used with a destination memory operand and a source register rather than an immediate operand, access a memory location offset from that specified by the memory operand as specified by the high bits of the register source. ...

Fedora 25 : xen (2016-1d8429b89f)

fix build problem with glibc 2.24 x86: Disallow L3 recursive pagetable for 32-bit PV guests XSA-185, CVE-2016-7092 x86: Mishandling of instruction pointer truncation during emulation XSA-186, CVE-2016-7093 x86 HVM: Overflow of shctxt-segreg XSA-187, CVE-2016-7094 pandoc documentation has dependen...

Oracle Linux 7 : qemu-kvm (ELSA-2016-2585)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2585 advisory. - Resolves: bz1359729 CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS rhel-7.3 - Resolves: bz1340929...

USN-3125-1: QEMU vulnerabilities

Zhenhao Hong discovered that QEMU incorrectly handled the Virtio module. A privileged attacker inside the guest could use this issue to cause QEMU to consume resources, resulting in a denial of service. CVE-2016-5403 Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network card...

RedHat Update for qemu-kvm RHSA-2016:2585-02

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Qemu: net: e1000 infinite loop in start_xmit and e1000_receive_iov routines

An infinite loop flaw was found in the way QEMU's e1000 NIC emulation implementation processed data using transmit or receive descriptors under certain conditions. A privileged user inside a guest could use this flaw to crash the QEMU instance...

Unified Diagnostic Services Simulator: UDSim

Unified Diagnostic Services Simulator The UDSim is a graphical simulator that can emulate different modules in a vehicle and respond to UDS request. It was designed as a training tool to run alongside of ICSim. It also has some unique learning features and can even be used to security test...

Debian DLA-678-1 : qemu security update

Multiple vulnerabilities have been found in QEMU : CVE-2016-8576 Quick Emulator Qemu built with the USB xHCI controller emulation support is vulnerable to an infinite loop issue. It could occur while processing USB command ring in 'xhciringfetch'. CVE-2016-8577 Quick Emulator Qemu built with the...

QEUM Denial of Service Vulnerability (CNVD-2016-10301)

QEMU is a set of analog processors written by Fabrice Bellard that distributes source code under the GPL license and is widely used on the GNU/Linux platform. The QEMU RTL8139 Ethernet Controller Emulation Support Triggerable Dead Loop contains a security vulnerability that can be exploited by...

DLA-679-1 qemu-kvm - security update

Bulletin has no description...

[SECURITY] Fedora 24 Update: qemu-2.6.2-2.fc24

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

DEBIAN-CVE-2016-7423

The mptsasprocessscsiiorequest function in QEMU aka Quick Emulator, when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service out-of-bounds write and QEMU process crash via vectors involving MPTSASRequest objects...

CVE-2016-7423

The mptsasprocessscsiiorequest function in QEMU aka Quick Emulator, when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service out-of-bounds write and QEMU process crash via vectors involving MPTSASRequest objects...

UBUNTU-CVE-2016-7777

Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it...

CVE-2016-7093

Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation...

Design/Logic Flaw

Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation...

UBUNTU-CVE-2016-7093

Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation...