SB2017101211 - Multiple vulnerabilities in Xen

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017101211

SB2017101211 - Multiple vulnerabilities in Xen

Published: October 12, 2017 Updated: November 29, 2017

Security Bulletin ID SB2017101211
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Adjecent network
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Race condition (CVE-ID: CVE-2017-15588)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to gain elevated privileges on the target system.

The weakness exists due to page type release race. An adjacent attacker can supply a stale TLB entry, trigger race condition and execute arbitrary code with elevated privileges.

2) Memory leak (CVE-ID: CVE-2017-15589)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.

The weakness exists due to hypervisor stack leak in x86 I/O intercept code. An adjacent attacker can write data from uninitialized hypervisor stack memory and read arbitrary information.

3) Improper access control (CVE-ID: CVE-2017-15590)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to cause DoS conditions on the target system.

The weakness exists due to an error with the setup of PCI MSI interrupts. An adjacent attacker can supply MSI and cause the hypervisor to crash.

4) Privilege escalation (CVE-ID: CVE-2017-15592)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to cause DoS conditions or gain elevated privileges on the target system.

The weakness exists due to mishandling of self-linear shadow mappings for translated guests. An adjacent attacker can supply self-linear shadow mappings and cause the hypervisor to crash or possibly gain elevated privileges.

5) Memory leak (CVE-ID: CVE-2017-15593)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to cause DoS conditions on the target system.

The weakness exists due to mishandling of reference counts. An adjacent attacker can trigger memory leak and cause the service to crash.

6) Privilege escalation (CVE-ID: CVE-2017-15594)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.

The weakness exists due to mishandling of IDT settings during CPU hotplugging. An adjacent attacker can gain elevated privileges or cause hypervisor crash.

7) Resource exhaustion (CVE-ID: CVE-2017-15595)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.

The weakness exists due to improper input validation. An adjacent attacker can supply specially crafted page-table stacking, trigger unbounded recursion, stack consumption, gain elevated privileges or cause hypervisor crash.

Remediation

Install update from vendor's website.

References