Debian Xen vulnerabilities

CVE-2018-12891 [MEDIUM] CVE-2018-12891: xen - An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may tak... An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypas

CVE-2018-12130 [MEDIUM] CVE-2018-12130: intel-microcode - Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some micro... Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-in

CVE-2018-10471 [MEDIUM] CVE-2018-10471: xen - An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to ... An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754. Scope: local bookworm: resolved (fixed in 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6) bullseye: resolved (fixed in 4.8.3+xsa262+shim4.10.0

CVE-2018-19964 [MEDIUM] CVE-2018-19964: xen - An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a den... An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a denial of service (host OS hang) because the p2m lock remains unavailable indefinitely in certain error conditions. Scope: local bookworm: resolved (fixed in 4.11.1-1) bullseye: resolved (fixed in 4.11.1-1) forky: resolved (fixed in 4.11.1-1) sid: resolved (fixed in 4.11.1-1) trixie: resolved

CVE-2018-12893 [MEDIUM] CVE-2018-12893: xen - An issue was discovered in Xen through 4.10.x. One of the fixes in XSA-260 added... An issue was discovered in Xen through 4.10.x. One of the fixes in XSA-260 added some safety checks to help prevent Xen livelocking with debug exceptions. Unfortunately, due to an oversight, at least one of these safety checks can be triggered by a guest. A malicious PV guest can crash Xen, leading to a Denial of Service. All Xen systems which have applied the XSA-260

CVE-2018-19965 [MEDIUM] CVE-2018-19965: xen - An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users ... An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation. Scope: local bookworm: resolved (fixed in 4.11.1-1) bullseye: res

CVE-2018-3639 [MEDIUM] CVE-2018-3639: intel-microcode - Systems with microprocessors utilizing speculative execution and speculative exe... Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. Scope: local bookworm: resolved (fix

CVE-2018-3646 [MEDIUM] CVE-2018-3646: intel-microcode - Systems with microprocessors utilizing speculative execution and address transla... Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis. Scope: local bookworm: resolved (fixed in 3.20180703.1) bullseye: resolved (fi

CVE-2018-7542 [MEDIUM] CVE-2018-7542: xen - An issue was discovered in Xen 4.8.x through 4.10.x allowing x86 PVH guest OS us... An issue was discovered in Xen 4.8.x through 4.10.x allowing x86 PVH guest OS users to cause a denial of service (NULL pointer dereference and hypervisor crash) by leveraging the mishandling of configurations that lack a Local APIC. Scope: local bookworm: resolved (fixed in 4.8.3+comet2+shim4.10.0+comet3-1+deb9u5) bullseye: resolved (fixed in 4.8.3+comet2+shim4.10.0+com

CVE-2018-10472 [MEDIUM] CVE-2018-10472: xen - An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users (i... An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users (in certain configurations) to read arbitrary dom0 files via QMP live insertion of a CDROM, in conjunction with specifying the target file as the backing file of a snapshot. Scope: local bookworm: resolved (fixed in 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6) bullseye: resolved (fixed in 4.8.3+

CVE-2018-12127 [MEDIUM] CVE-2018-12127: intel-microcode - Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microproc... Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-inform

CVE-2018-15469 [MEDIUM] CVE-2018-15469: xen - An issue was discovered in Xen through 4.11.x. ARM never properly implemented gr... An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest can still request v2 grant tables; they will simply not be properly set up, resulting in subsequent grant-related hypercalls hitting BUG() checks. An unprivileged guest can cause a BUG() check in the hypervisor

CVE-2018-15468 [MEDIUM] CVE-2018-15468: xen - An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several... An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Un

CVE-2018-10981 [MEDIUM] CVE-2018-10981: xen - An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to... An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (host OS infinite loop) in situations where a QEMU device model attempts to make invalid transitions between states of a request. Scope: local bookworm: resolved (fixed in 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6) bullseye: resolved (fixed in 4.8.3+xsa262+shim4.10

CVE-2018-12126 [MEDIUM] CVE-2018-12126: intel-microcode - Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some mic... Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-

CVE-2018-7540 [MEDIUM] CVE-2018-7540: xen - An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to ... An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (host OS CPU hang) via non-preemptable L3/L4 pagetable freeing. Scope: local bookworm: resolved (fixed in 4.8.3+comet2+shim4.10.0+comet3-1+deb9u5) bullseye: resolved (fixed in 4.8.3+comet2+shim4.10.0+comet3-1+deb9u5) forky: resolved (fixed in 4.8.3+comet2+shim4.10.0

CVE-2018-15470 [MEDIUM] CVE-2018-15470: xen - An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handl... An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of evaluation of expressions making up a tuple. As indicated in section 7.7.3 "Operations on data structures" of the OCaml manual, the order of evaluation of subexpressions is not specified. In practice, different implementations behave differently. Thus, o

CVE-2018-5244 [MEDIUM] CVE-2018-5244: xen - In Xen 4.10, new infrastructure was introduced as part of an overhaul to how MSR... In Xen 4.10, new infrastructure was introduced as part of an overhaul to how MSR emulation happens for guests. Unfortunately, one tracking structure isn't freed when a vcpu is destroyed. This allows guest OS administrators to cause a denial of service (host OS memory consumption) by rebooting many times. Scope: local bookworm: resolved bullseye: resolved forky: resolved

CVE-2017-10917 [CRITICAL] CVE-2017-10917: xen - Xen through 4.8.x does not validate the port numbers of polled event channel por... Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) or possibly obtain sensitive information, aka XSA-221. Scope: local bookworm: resolved (fixed in 4.8.1-1+deb9u3) bullseye: resolved (fixed in 4.8.1-1+deb9u3) forky: resolved (fixed i

CVE-2017-10920 [CRITICAL] CVE-2017-10920: xen - The grant-table feature in Xen through 4.8.x mishandles a GNTMAP_device_map and ... The grant-table feature in Xen through 4.8.x mishandles a GNTMAP_device_map and GNTMAP_host_map mapping, when followed by only a GNTMAP_host_map unmapping, which allows guest OS users to cause a denial of service (count mismanagement and memory corruption) or obtain privileged host OS access, aka XSA-224 bug 1. Scope: local bookworm: resolved (fixed in 4.8.1-1+deb9u