Debian Xen vulnerabilities

CVE-2015-3259 [MEDIUM] CVE-2015-3259: xen - Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through ... Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configuration argument. Scope: local bookworm: resolved (fixed in 4.6.0-1) bullseye: resolved (fixed in 4.6.0-1) forky: resolved (fixed in 4.6.0-1) sid: resolved (fixed in 4.6.0-1) trixie: resolved (fixed in 4.6.0-1)

CVE-2021-28694 [MEDIUM] CVE-2021-28694: xen - IOMMU page mapping issues on x86 T[his CNA information record relates to multipl... IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typicall

CVE-2021-28695 [MEDIUM] CVE-2021-28695: xen - IOMMU page mapping issues on x86 T[his CNA information record relates to multipl... IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typicall

CVE-2021-28696 [MEDIUM] CVE-2021-28696: xen - IOMMU page mapping issues on x86 T[his CNA information record relates to multipl... IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typicall

CVE-2022-23825 [MEDIUM] CVE-2022-23825: xen - Aliases in the branch predictor may cause some AMD processors to predict the wro... Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure. Scope: local bookworm: resolved (fixed in 4.16.2-1) bullseye: resolved (fixed in 4.14.5+24-g87d90d511c-1) forky: resolved (fixed in 4.16.2-1) sid: resolved (fixed in 4.16.2-1) trixie: resolved (fixed in 4.16.2-1)

CVE-2020-15566 [MEDIUM] CVE-2020-15566: xen - An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause ... An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: (1) port is already in use, (2) the memory allocation failed, or (3) the port we try to allocate is higher than what is supported by

CVE-2020-29483 [MEDIUM] CVE-2020-29483: xen - An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate ... An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specific protocol. When a guest violates this protocol, xenstored will drop the connection to that guest. Unfortunately, this is done by just removing the guest from xenstored's internal management, resulting in the same actions as if the guest had been des

CVE-2017-17046 [MEDIUM] CVE-2017-17046: xen - An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest ... An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest OS users to obtain sensitive information from DRAM after a reboot, because disjoint blocks, and physical addresses that do not start at zero, are mishandled. Scope: local bookworm: resolved (fixed in 4.8.2+xsa245-0+deb9u1) bullseye: resolved (fixed in 4.8.2+xsa245-0+deb9u1) forky: resolved

CVE-2022-42321 [MEDIUM] CVE-2022-42321: xen - Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using... Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With sufficiently deep nesting levels this can result in stack exhaustion on xenstored, leading to a crash of xenstored. Scope: local bookworm: resolved (fixed in 4.16.2+90-g0d39a6d1ae-1) bullseye: re

CVE-2022-42334 [HIGH] CVE-2022-42334: xen - x86/HVM pinned cache attributes mis-handling T[his CNA information record relate... x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected

CVE-2014-8594 [MEDIUM] CVE-2014-8594: xen - The do_mmu_update function in arch/x86/mm.c in Xen 4.x through 4.4.x does not pr... The do_mmu_update function in arch/x86/mm.c in Xen 4.x through 4.4.x does not properly restrict updates to only PV page tables, which allows remote PV guests to cause a denial of service (NULL pointer dereference) by leveraging hardware emulation services for HVM guests using Hardware Assisted Paging (HAP). Scope: local bookworm: resolved (fixed in 4.4.1-4) bullseye: re

CVE-2018-12126 [MEDIUM] CVE-2018-12126: intel-microcode - Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some mic... Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-

CVE-2021-26313 [MEDIUM] CVE-2021-26313: xen - Potential speculative code store bypass in all supported CPU products, in conjun... Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data leakage. Scope: local bookworm: resolved (fixed in 4.14.2+25-gb6a8c4f72d-1) bullseye: resolved (fixed in 4.14.2+25-gb6a8c4f72d-1) f

CVE-2020-27674 [MEDIUM] CVE-2020-27674: xen - An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to ... An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique. Scope: local bookworm: resolved (fixed in 4.14.0+80-gd101b417b7-1) bullseye: resolved (fixed in 4.14.0+80-gd101b417b7-1) forky: res

CVE-2019-17343 [MEDIUM] CVE-2019-17343: xen - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to ... An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains. Scope: local bookworm: resolved (fixed in 4.11.1+92-g6c33308a8d-1) bullseye: resolved (fixed in 4.11.1+92-g6c33308a8d-1) forky: resolved (fixed in 4.11.1+92-g6c33308a8d-1) si

CVE-2020-15563 [MEDIUM] CVE-2020-15563: xen - An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users t... An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HVM guest may cause the hypervisor to crash, resulting in Denial of Service

CVE-2020-15564 [MEDIUM] CVE-2020-15564: xen - An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to ca... An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOP_register_vcpu_info. The hypercall VCPUOP_register_vcpu_info is used by a guest to register a shared region with the hypervisor. The region will be mapped into Xen address space so it can be directly accessed. On Arm, the

CVE-2016-9384 [MEDIUM] CVE-2016-9384: xen - Xen 4.7 allows local guest OS users to obtain sensitive host information by load... Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table. Scope: local bookworm: resolved (fixed in 4.8.0-1) bullseye: resolved (fixed in 4.8.0-1) forky: resolved (fixed in 4.8.0-1) sid: resolved (fixed in 4.8.0-1) trixie: resolved (fixed in 4.8.0-1)

CVE-2020-25597 [MEDIUM] CVE-2020-25597: xen - An issue was discovered in Xen through 4.14.x. There is mishandling of the const... An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that an event channel, once valid, will not become invalid over the life time of a guest. However, operations like the resetting of all event channels may involve dec

CVE-2021-0089 [MEDIUM] CVE-2021-0089: xen - Observable response discrepancy in some Intel(R) Processors may allow an authori... Observable response discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. Scope: local bookworm: resolved (fixed in 4.14.2+25-gb6a8c4f72d-1) bullseye: resolved (fixed in 4.14.2+25-gb6a8c4f72d-1) forky: resolved (fixed in 4.14.2+25-gb6a8c4f72d-1) sid: resolved (fixed in 4.14.2+25-gb6a8c4f72d-1)