Racy interactions between dirty vram tracking and paging log dirty hypercalls

ISSUE DESCRIPTION Activation of log dirty mode done by XENDMOPtrackdirtyvram was named HVMOPtrackdirtyvram before Xen 4.9 is racy with ongoing log dirty hypercalls. A suitably timed call to XENDMOPtrackdirtyvram can enable log dirty while another CPU is still in the process of tearing down the...

CVE-2022-26356

CVE-2022-26356 describes a race in Xen between log-dirty tracking and log-dirty hypercalls. Activation of log-dirty via XEN_DMOP_track_dirty_vram can race with tearing down structures from a prior log-dirty mode, causing entries to be written into freed slots and resulting in a memory leak. Vulne...

CVE-2022-26356

Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XENDMOPtrackdirtyvram was named HVMOPtrackdirtyvram before Xen 4.9 is racy with ongoing log dirty hypercalls. A suitably timed call to XENDMOPtrackdirtyvram can enable log dirty whil...

CVE-2022-26356

Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XENDMOPtrackdirtyvram was named HVMOPtrackdirtyvram before Xen 4.9 is racy with ongoing log dirty hypercalls. A suitably timed call to XENDMOPtrackdirtyvram can enable log dirty whil...

Citrix Hypervisor Security Update

Description of Problem Two issues have been identified in Citrix Hypervisor that may, if exploited, allow privileged code in an HVM guest VM to compromise or crash the host. These issues only apply in specific configurations; furthermore, Citrix believes that there would be significant difficulty...

openSUSE Security Update : xen (openSUSE-2020-985)

This update for xen fixes the following issues : - CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking bsc1173377. - CVE-2020-15565: Fixed insufficient cache write-back under VT-d bsc1173378. - CVE-2020-15566: Fixed incorrect error handling in event channel port allocation...

Security update for xen (important)

openSUSE Security Update: Security update for xen Announcement ID: openSUSE-SU-2020:0985-1 Rating: important References: 1027519 1172205 1173376 1173377 1173378 1173380 Cross-References: CVE-2020-0543 CVE-2020-15563 CVE-2020-15565 CVE-2020-15566 CVE-2020-15567 Affected Products: openSUSE Leap 15....

Fedora 32 : xen (2020-fbc13516af)

incorrect error handling in event channel port allocation leads to DoS XSA-317, CVE-2020-15566 1854465 inverted code paths in x86 dirty VRAM tracking leads to DoS XSA-319, CVE-2020-15563 1854463 xen: insufficient cache write-back under VT-d leads to DoS XSA-321, CVE-2020-15565 1854467 missing...

OPENSUSE-SU-2020:0965-1 Security update for xen

This update for xen fixes the following issues: - CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking bsc1173377. - CVE-2020-15565: Fixed insufficient cache write-back under VT-d bsc1173378. - CVE-2020-15566: Fixed incorrect error handling in event channel port allocation...

SUSE SLES12 Security Update : xen (SUSE-SU-2020:1886-1)

This update for xen fixes the following issues : CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking bsc1173377. CVE-2020-15565: Fixed insufficient cache write-back under VT-d bsc1173378. CVE-2020-15567: Fixed non-atomic modification of live EPT PTE bsc1173380. Note that Tenable...

SUSE-SU-2020:1889-1 Security update for xen

This update for xen fixes the following issues: - CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking bsc1173377. - CVE-2020-15565: Fixed insufficient cache write-back under VT-d bsc1173378. - CVE-2020-15566: Fixed incorrect error handling in event channel port allocation...

SUSE-SU-2020:1886-1 Security update for xen

This update for xen fixes the following issues: - CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking bsc1173377. - CVE-2020-15565: Fixed insufficient cache write-back under VT-d bsc1173378. - CVE-2020-15567: Fixed non-atomic modification of live EPT PTE bsc1173380...

Arbitrary Code Execution

QEMU is vulnerable to arbitray code execution. A local guest user is able to write arbitrary data outside of VRAM-allocated buffer boundaries in the host's application address space due to insufficient checks in the Cirrus blit region, leading to execution of arbitrary code...

VirtualBox 5.2.6.r120293 - VM Escape Exploit

Exploit for linux platform in category local exploits Oracle fixed some of the issues I reported in VirtualBox during the Oracle Critical Patch Update - April 2018. CVE-2018-2844 was an interesting double fetch vulnerability in VirtualBox Video Acceleration VBVA feature affecting Linux hosts. VBV...

VirtualBox 5.2.6.r120293 - VM Escape

VirtualBox 5.2.6.r120293 - VM Escape Oracle fixed some of the issues I reported in VirtualBox during the Oracle Critical Patch Update - April 2018. CVE-2018-2844 was an interesting double fetch vulnerability in VirtualBox Video Acceleration VBVA feature affecting Linux hosts. VBVA feature works o...

Security update for virtualbox (important)

This update for virtualbox to version 5.1.32 fixes the following issues: The following vulnerabilities were fixed boo1076372: - CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacke...

openSUSE Security Update : virtualbox (openSUSE-2018-75) (Spectre)

This update for virtualbox to version 5.1.32 fixes the following issues : The following vulnerabilities were fixed boo1076372 : - CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an...

openSUSE Security Update : virtualbox (openSUSE-2016-1087)

Virtualbox was updated to 5.0.26 to fix the following issues : This update fixes various security issues. - CVE-2016-3612: An unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 5.0.22 allowed remote attackers to affect confidentiality via...

CVE-2011-1016

CVE-2011-1016 concerns the Linux kernel Radeon GPU drivers and their DRM subsystem. The affected component is the Radeon GPU driver (radeon/kms) in kernels before 2.6.38-rc5, where data related to the AA resolve registers was not properly validated. This could allow a local user to write to arbit...