SB2017101207 - Multiple vulnerabilities in Xen

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017101207

SB2017101207 - Multiple vulnerabilities in Xen

Published: October 16, 2017

Security Bulletin ID SB2017101207
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Adjecent network
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Race condition (CVE-ID: CVE-2017-15588)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to gain unauthorized access to system memory.

The weakness exists on x86 PV guest systems due to improper handling of references in memory tables. An adjacent attacker can trigger a race condition while sending a translation lookaside buffer (TLB) flush request that involves an interprocessor interrupt (IPI) to a CPU, access all the system memory and possibly cause the system to crash.

Successful exploitation of the vulnerability may result in denial of service.

2) Information disclosure (CVE-ID: CVE-2017-15589)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to obtain potentially sensitive information.

The weakness exists in the I/O intercept code on x86 HVM systems due to improper security restrictions during I/O operations. During I/O operations, a write path where data is stored in an internal structure could contain bits from an uninitialized Hypervisor stack slot that allows adjacent attacker to access arbitrary data.

Successful exploitation of the vulnerability may result in further attack.

3) Privilege escalation (CVE-ID: CVE-2017-15594)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to gain elevated privileges on the target system.

The weakness exists in x86 PV guest systems using SVM due to improper handling of Interrupt Descriptor Table (IDT) settings when a new CPU is hot-plugged and brought online. An adjacent attacker can gain elevated privileges and possibly cause the system to crash.

Successful exploitation of the vulnerability may result in denial of service.

4) Memory corruption (CVE-ID: CVE-2017-15592)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists in HVM guest systems due to insufficient memory processing. An adjacent attacker can trigger memory corruption and cause the system to crash.

Successful exploitation of the vulnerability may result in denial of service.

5) Improper input validation (CVE-ID: CVE-2017-15591)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists in x86 systems due to improper request processing. An adjacent attacker can use a domain that controls a guest system and cause the system to crash.

Successful exploitation of the vulnerability may result in denial of service.

6) Memory corruption (CVE-ID: CVE-2017-15593)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists in x86 PV guest systems due to insufficient memory processing. An adjacent attacker can trigger excessive memory consumption and cause the system to crash.

Successful exploitation of the vulnerability may result in denial of service.

7) Denial of service (CVE-ID: CVE-2017-15590)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists in x86 systems due to multiple mapping issues in the setup of Peripheral Component Interconnect (PCI) Message Signaled Interrupts (MSI). An adjacent attacker can and cause the system to crash.

Successful exploitation of the vulnerability may result in denial of service.

Remediation

Install update from vendor's website.

References