Fedora 25 update for xen

1) Resource exhaustion

EUVDB-ID: #VU9452

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15595

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.

The weakness exists due to improper input validation. An adjacent attacker can supply specially crafted page-table stacking, trigger unbounded recursion, stack consumption, gain elevated privileges or cause hypervisor crash.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Privilege escalation

EUVDB-ID: #VU9449

Risk: Low

CVSSv4.0: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15592

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS conditions or gain elevated privileges on the target system.

The weakness exists due to mishandling of self-linear shadow mappings for translated guests. An adjacent attacker can supply self-linear shadow mappings and cause the hypervisor to crash or possibly gain elevated privileges.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory corruption

EUVDB-ID: #VU8832

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15592

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists in HVM guest systems due to insufficient memory processing. An adjacent attacker can trigger memory corruption and cause the system to crash.

Successful exploitation of the vulnerability may result in denial of service.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Race condition

EUVDB-ID: #VU9446

Risk: Low

CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15588

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to gain elevated privileges on the target system.

The weakness exists due to page type release race. An adjacent attacker can supply a stale TLB entry, trigger race condition and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Race condition

EUVDB-ID: #VU8829

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15588

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to gain unauthorized access to system memory.

The weakness exists on x86 PV guest systems due to improper handling of references in memory tables. An adjacent attacker can trigger a race condition while sending a translation lookaside buffer (TLB) flush request that involves an interprocessor interrupt (IPI) to a CPU, access all the system memory and possibly cause the system to crash.

Successful exploitation of the vulnerability may result in denial of service.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Memory leak

EUVDB-ID: #VU9447

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15589

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.

The weakness exists due to hypervisor stack leak in x86 I/O intercept code. An adjacent attacker can write data from uninitialized hypervisor stack memory and read arbitrary information.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Information disclosure

EUVDB-ID: #VU8830

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15589

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to obtain potentially sensitive information.

The weakness exists in the I/O intercept code on x86 HVM systems due to improper security restrictions during I/O operations. During I/O operations, a write path where data is stored in an internal structure could contain bits from an uninitialized Hypervisor stack slot that allows adjacent attacker to access arbitrary data.

Successful exploitation of the vulnerability may result in further attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper access control

EUVDB-ID: #VU9448

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15590

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS conditions on the target system.

The weakness exists due to an error with the setup of PCI MSI interrupts. An adjacent attacker can supply MSI and cause the hypervisor to crash.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Denial of service

EUVDB-ID: #VU8835

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15590

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists in x86 systems due to multiple mapping issues in the setup of Peripheral Component Interconnect (PCI) Message Signaled Interrupts (MSI). An adjacent attacker can and cause the system to crash.

Successful exploitation of the vulnerability may result in denial of service.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper input validation

EUVDB-ID: #VU8833

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15591

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists in x86 systems due to improper request processing. An adjacent attacker can use a domain that controls a guest system and cause the system to crash.

Successful exploitation of the vulnerability may result in denial of service.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Memory leak

EUVDB-ID: #VU9450

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15593

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS conditions on the target system.

The weakness exists due to mishandling of reference counts. An adjacent attacker can trigger memory leak and cause the service to crash.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Memory corruption

EUVDB-ID: #VU8834

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15593

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists in x86 PV guest systems due to insufficient memory processing. An adjacent attacker can trigger excessive memory consumption and cause the system to crash.

Successful exploitation of the vulnerability may result in denial of service.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Privilege escalation

EUVDB-ID: #VU9451

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15594

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.

The weakness exists due to mishandling of IDT settings during CPU hotplugging. An adjacent attacker can gain elevated privileges or cause hypervisor crash.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Privilege escalation

EUVDB-ID: #VU8831

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15594

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to gain elevated privileges on the target system.

The weakness exists in x86 PV guest systems using SVM due to improper handling of Interrupt Descriptor Table (IDT) settings when a new CPU is hot-plugged and brought online. An adjacent attacker can gain elevated privileges and possibly cause the system to crash.

Successful exploitation of the vulnerability may result in denial of service.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

xen: before 4.7.3-9.fc25

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d09353c38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Low
Patch available	YES
Number of vulnerabilities	14
CVE-ID	CVE-2017-15595 CVE-2017-15592 CVE-2017-15588 CVE-2017-15589 CVE-2017-15590 CVE-2017-15591 CVE-2017-15593 CVE-2017-15594
CWE-ID	CWE-400 CWE-264 CWE-119 CWE-362 CWE-401 CWE-200 CWE-284 CWE-20
Exploitation vector	Local network
Public exploit	N/A
Vulnerable software	Fedora Operating systems & Components / Operating system xen Operating systems & Components / Operating system package or component
Vendor	Fedoraproject