Debian Xen vulnerabilities

CVE-2019-17348 [MEDIUM] CVE-2019-17348: xen - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to ... An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service because of an incompatibility between Process Context Identifiers (PCID) and shadow-pagetable switching. Scope: local bookworm: resolved (fixed in 4.11.1+92-g6c33308a8d-1) bullseye: resolved (fixed in 4.11.1+92-g6c33308a8d-1) forky: resolved (fixed in 4.11.1+92-g6

CVE-2022-33746 [MEDIUM] CVE-2022-33746: xen - P2M pool freeing may take excessively long The P2M pool backing second level add... P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing may take more time than is reasonable without intermediate preemption checks. Such checking for the need to preempt was so far missing. Scope: local bookworm: resolved (fixed in 4.16.2+90-g0d39a6d1ae-1) bullseye:

CVE-2020-29571 [MEDIUM] CVE-2020-29571: xen - An issue was discovered in Xen through 4.14.x. A bounds check common to most ope... An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO event channels depends on the CPU observing consistent state. While the producer side uses appropriately ordered writes, the consumer side isn't protected against re-ordered reads, and may hence end up de-referencing a NULL pointer. Malicious or buggy

CVE-2020-29567 [MEDIUM] CVE-2020-29567: xen - An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribu... An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling, IRQ vectors are dynamically allocated and de-allocated on the relevant CPUs. De-allocation has to happen when certain constraints are met. If these conditions are not met when first checked, the checking CPU may send an interrupt to itself, in the expectation t

CVE-2020-29486 [MEDIUM] CVE-2020-29486: xen - An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownersh... An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownership. In oxenstored, a owner could give a node away. However, node ownership has quota implications. Any guest can run another guest out of quota, or create an unbounded number of nodes owned by dom0, thus running xenstored out of memory A malicious guest administrator can cause a denial of

CVE-2022-23824 [MEDIUM] CVE-2022-23824: xen - IBPB may not prevent return branch predictions from being specified by pre-IBPB ... IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure. Scope: local bookworm: resolved (fixed in 4.16.2+90-g0d39a6d1ae-1) bullseye: resolved (fixed in 4.14.5+94-ge49571868d-1) forky: resolved (fixed in 4.16.2+90-g0d39a6d1ae-1) sid: resolved (fixed in 4.16.2+90-g0d39a6d1ae-1) trixie:

CVE-2020-29566 [MEDIUM] CVE-2020-29566: xen - An issue was discovered in Xen through 4.14.x. When they require assistance from... An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must be temporarily de-scheduled. The device model will signal Xen when it has completed its operation, via an event channel, so that the relevant vCPU is rescheduled. If the device model were to signal Xen without having actually completed the operation,

CVE-2021-28693 [MEDIUM] CVE-2021-28693: xen - xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.... xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must "scrub" them before handing the page over to the allocator. Unfortunately, it was discovered that modules will not be scrubbed

CVE-2021-28687 [MEDIUM] CVE-2021-28687: xen - HVM soft-reset crashes toolstack libxl requires all data structures passed acros... HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline, but not all of them. When the "soft reset" feature was implemented, the libxl__domain_susp

CVE-2015-8615 [MEDIUM] CVE-2015-8615: xen - The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limi... The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ). Scope: local bookworm: resolved (fixed in 4.8.0~rc3-1) bullseye: res

CVE-2023-34328 [CRITICAL] CVE-2023-34328: xen - [This CNA information record relates to multiple CVEs; the text explains which a... [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of the guest state, leading to denials of service. 1) CVE-2023-34327 -

CVE-2023-34327 [CRITICAL] CVE-2023-34327: xen - [This CNA information record relates to multiple CVEs; the text explains which a... [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of the guest state, leading to denials of service. 1) CVE-2023-34327 -

CVE-2023-46836 [MEDIUM] CVE-2023-46836: xen - The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return St... The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was

CVE-2012-6036 [MEDIUM] CVE-2012-6036: xen - The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restor... The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 do not check for negative id pools, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or possibly execute arbitrary code via unspecified vectors. NOTE: this issue

CVE-2012-6034 [MEDIUM] CVE-2012-6034: xen - The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and t... The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspe

CVE-2016-9815 [MEDIUM] CVE-2016-9815: xen - Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (... Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host panic) by sending an asynchronous abort. Scope: local bookworm: resolved (fixed in 4.8.0-1) bullseye: resolved (fixed in 4.8.0-1) forky: resolved (fixed in 4.8.0-1) sid: resolved (fixed in 4.8.0-1) trixie: resolved (fixed in 4.8.0-1)

CVE-2017-15591 [MEDIUM] CVE-2017-15591: xen - An issue was discovered in Xen 4.5.x through 4.9.x allowing attackers (who contr... An issue was discovered in Xen 4.5.x through 4.9.x allowing attackers (who control a stub domain kernel or tool stack) to cause a denial of service (host OS crash) because of a missing comparison (of range start to range end) within the DMOP map/unmap implementation. Scope: local bookworm: resolved (fixed in 4.8.2+xsa245-0+deb9u1) bullseye: resolved (fixed in 4.8.2+xs

CVE-2020-11742 [HIGH] CVE-2020-11742: xen - An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause ... An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of bad continuation handling in GNTTABOP_copy. Grant table operations are expected to return 0 for success, and a negative number for errors. The fix for CVE-2017-12135 introduced a path through grant copy handling where success may be returned to the caller witho

CVE-2014-7155 [MEDIUM] CVE-2014-7155: xen - The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 4.4.x and ... The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 4.4.x and earlier does not properly check supervisor mode permissions, which allows local HVM users to cause a denial of service (guest crash) or gain guest kernel mode privileges via vectors involving an (1) HLT, (2) LGDT, (3) LIDT, or (4) LMSW instruction. Scope: local bookworm: resolved (fixed in 4

CVE-2020-29482 [MEDIUM] CVE-2020-29482: xen - An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths... An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full pathname, or via a relative path, which implicitly includes /local/domain/$DOMID for their own domain id. Management tools must access paths in guests' namespaces, necessarily using absolute paths. oxenstored imposes a pathname limit that is applied so