Debian Xen vulnerabilities

CVE-2020-25602 [MEDIUM] CVE-2020-25602: xen - An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a hos... An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a host OS crash when handling guest access to MSR_MISC_ENABLE. When a guest accesses certain Model Specific Registers, Xen first reads the value from hardware to use as the basis for auditing the guest access. For the MISC_ENABLE MSR, which is an Intel specific MSR, this MSR read is performed w

CVE-2020-25600 [MEDIUM] CVE-2020-25600: xen - An issue was discovered in Xen through 4.14.x. Out of bounds event channels are ... An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level event channel model imposes different limits on the number of usable event channels for 32-bit x86 domains vs 64-bit or Arm (either bitness) ones. 32-bit x86 domains can use only 1023 channels, due to limited space in their shared (bet

CVE-2020-25601 [MEDIUM] CVE-2020-25601: xen - An issue was discovered in Xen through 4.14.x. There is a lack of preemption in ... An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchn_reset() / evtchn_destroy(). In particular, the FIFO event channel model allows guests to have a large number of event channels active at a time. Closing all of these (when resetting all event channels or when cleaning up after the guest) may take extended periods of time. So far, th

CVE-2021-3308 [MEDIUM] CVE-2021-3308: xen - An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. ... An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the MSI(-X) entries that the guest might had enabled, and hence wi

CVE-2020-29485 [MEDIUM] CVE-2020-29485: xen - An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XS_R... An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XS_RESET_WATCHES request, not all tracking information is freed. A guest can cause unbounded memory usage in oxenstored. This can lead to a system-wide DoS. Only systems using the Ocaml Xenstored implementation are vulnerable. Systems using the C Xenstored implementation are not vulnerable. Sc

CVE-2021-28699 [MEDIUM] CVE-2021-28699: xen - inadequate grant-v2 status frames array bounds check The v2 grant table interfac... inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, when operating in this mode, a guest has two tables. As a result, guests also need to be able to retrieve the addresses that the new status tracking table can be accessed through. For 32-bit guests on x86, translation of requests has

CVE-2022-42326 [MEDIUM] CVE-2022-42326: xen - Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA... Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encou

CVE-2022-42325 [MEDIUM] CVE-2022-42325: xen - Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA... Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encou

CVE-2022-42310 [MEDIUM] CVE-2022-42310: xen - Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes i... Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made perma

CVE-2023-34323 [MEDIUM] CVE-2023-34323: xen - When a transaction is committed, C Xenstored will first check the quota is corre... When a transaction is committed, C Xenstored will first check the quota is correct before attempting to commit any nodes. It would be possible that accounting is temporarily negative if a node has been removed outside of the transaction. Unfortunately, some versions of C Xenstored are assuming that the quota cannot be negative and are using assert() to confirm it. Thi

CVE-2023-34320 [MEDIUM] CVE-2023-34320: xen - Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412 where software,... Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of either a load to device or non-cacheable memory, and either a store exclusive or register read of the Physical Address Register (PAR_EL1) in close proximity. Scope: local bookworm: resolved (fixed in 4.17.2+76-ge1f

CVE-2014-3672 [MEDIUM] CVE-2014-3672: xen - The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS us... The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr. Scope: local bookworm: resolved (fixed in 4.4.0-1) bullseye: resolved (fixed in 4.4.0-1) forky: resolved (fixed in 4.4.0-1) sid: resolved (fixed in 4.4.0-1) trixie: resolved (fixed in 4.4.0-1)

CVE-2016-9817 [MEDIUM] CVE-2016-9817: xen - Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (... Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving a (1) data or (2) prefetch abort with the ESR_EL2.EA bit set. Scope: local bookworm: resolved (fixed in 4.8.0-1) bullseye: resolved (fixed in 4.8.0-1) forky: resolved (fixed in 4.8.0-1) sid: resolved (fixed in 4.8.0-1) trixie: resolved (fixed in 4.8.0-1)

CVE-2017-15593 [MEDIUM] CVE-2017-15593: xen - An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to c... An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (memory leak) because reference counts are mishandled. Scope: local bookworm: resolved (fixed in 4.8.2+xsa245-0+deb9u1) bullseye: resolved (fixed in 4.8.2+xsa245-0+deb9u1) forky: resolved (fixed in 4.8.2+xsa245-0+deb9u1) sid: resolved (fixed in 4.8.2+xsa245-0+deb9u

CVE-2018-7542 [MEDIUM] CVE-2018-7542: xen - An issue was discovered in Xen 4.8.x through 4.10.x allowing x86 PVH guest OS us... An issue was discovered in Xen 4.8.x through 4.10.x allowing x86 PVH guest OS users to cause a denial of service (NULL pointer dereference and hypervisor crash) by leveraging the mishandling of configurations that lack a Local APIC. Scope: local bookworm: resolved (fixed in 4.8.3+comet2+shim4.10.0+comet3-1+deb9u5) bullseye: resolved (fixed in 4.8.3+comet2+shim4.10.0+com

CVE-2018-19964 [MEDIUM] CVE-2018-19964: xen - An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a den... An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a denial of service (host OS hang) because the p2m lock remains unavailable indefinitely in certain error conditions. Scope: local bookworm: resolved (fixed in 4.11.1-1) bullseye: resolved (fixed in 4.11.1-1) forky: resolved (fixed in 4.11.1-1) sid: resolved (fixed in 4.11.1-1) trixie: resolved

CVE-2020-29570 [MEDIUM] CVE-2020-29570: xen - An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control... An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into the control block is reversed. The consumer assumes, seeing the former initialized, that the latter are also ready for use. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system. Sc

CVE-2018-19965 [MEDIUM] CVE-2018-19965: xen - An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users ... An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation. Scope: local bookworm: resolved (fixed in 4.11.1-1) bullseye: res

CVE-2020-11743 [MEDIUM] CVE-2020-11743: xen - An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause ... An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant table operations are expected to return 0 for success, and a negative number for errors. Some misplaced brackets cause one error path to return 1 instead of a negative value. The grant table code in Linux treats t

CVE-2020-25596 [MEDIUM] CVE-2020-25596: xen - An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experien... An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. This causes the guest kernel to observe a kernel-privilege #GP fault (t