SB2015060207 - Fedora 22 update for xen

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-4103)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-4104)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors.

3) Resource management error (CVE-ID: CVE-2015-4105)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service (host disk consumption) via certain invalid operations.

4) Improper access control (CVE-ID: CVE-2015-4106)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2015-9456