CVE-2017-12136

CVE-2017-12136 affects Xen 4.6.x–4.9.x. The issue is a race condition in grant table maptrack free list handling, enabling a malicious guest administrator to crash the host or escalate privileges to the host. Public advisories (GLSA 201801-14; SUSE SU-2017:2327-2) document the fix as Xen upgrades...

CVE-2017-12136

Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denial of service free list corruption and host crash or gain privileges on the host via vectors involving maptrack free list handling...

Xen map_grant_ref elevation of privilege vulnerability

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. A security vulnerability in Xen mapgrantref allows attackers to submit a specially crafted request to gain host privileges and perform unauthorized operations...

ALPINE-CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

DEBIAN-CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

UBUNTU-CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

CVE-2017-12855

CVE-2017-12855 affects Xen grant table handling: premature clearing of GTF_writing/GTF_reading bits can misinform a guest that a grant is no longer in use, potentially allowing reuse of a granted frame containing sensitive data while the other domain is still using it. Affected Xen versions inclu...

CVE-2017-12136

Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denial of service free list corruption and host crash or gain privileges on the host via vectors involving maptrack free list handling...

grant_table: Race conditions with maptrack free list handling

ISSUE DESCRIPTION The grant table code in Xen has a bespoke semi-lockfree allocator for recording grant mappings "maptrack" entries. This allocator has a race which allows the free list to be corrupted. Specifically: the code for removing an entry from the free list, prior to use, assumes without...

linux: Fix Xen block IO merge-ability calculation

ISSUE DESCRIPTION The block layer in Linux may choose to merge adjacent block IO requests. When Linux is running as a Xen guest, the default merging algorithm is replaced with a Xen-specific one. When Linux is running as an x86 PV guest, some BIO's are erroneously merged, corrupting the data stre...

grant_table: possibly premature clearing of GTF_writing / GTF_reading

ISSUE DESCRIPTION Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, X...

FTC Releases Alert on Government Grant Scams

The Federal Trade Commission FTC has released an alert on government grant scams. In these schemes, scammers pose as government officials to get consumers to send them money. Anytime someone asks you to pay money to get money, stop and think twice. US-CERT encourages consumers to refer to the FTC...

The vulnerability of the grant-table component in the Xen hypervisor allows a perpetrator to obtain confidential information or enhance their privileges.

The vulnerability of the grant-table component in the Xen hypervisor is related to incorrect handling of information regarding certain simultaneous unmap calls. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information or enhance their...

The vulnerability of the grant-table component in the Xen hypervisor allows a attacker to trigger a service failure or gain privileged access to the host.

The vulnerability of the grant-table component in the Xen hypervisor is related to deficiencies in access control for GNTMAPdevicemap and GNTMAPhostmap. Exploiting this vulnerability could allow a malicious actor to trigger a service failure memory corruption or gain privileged access to the host...

openSUSE: Security Advisory for xen (openSUSE-SU-2017:1826-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Dasan Networks GPON ONT WiFi Router H64X Series - Privilege Escalation

Dasan Networks GPON ONT WiFi Router H64X Series Privilege Escalation Vendor: Dasan Networks Product web page: http://www.dasannetworks.com | http://www.dasannetworks.eu Affected version: Model: H640GR-02 H640GV-03 H640GW-02 H640RW-02 H645G Firmware: 2.77-1115 2.76-9999 2.76-1101 2.67-1070 2.45-10...

Dasan Networks GPON ONT WiFi Router H64X Series - Privilege Escalation

Dasan Networks GPON ONT WiFi Router H64X Series - Privilege Escalation Dasan Networks GPON ONT WiFi Router H64X Series Privilege Escalation Vendor: Dasan Networks Product web page: http://www.dasannetworks.com | http://www.dasannetworks.eu Affected version: Model: H640GR-02 H640GV-03 H640GW-02...