SB2017112911 - Debian update for xen

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017112911

SB2017112911 - Debian update for xen

Published: November 29, 2017

Security Bulletin ID SB2017112911
Severity
High
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Adjecent network
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 secuirty vulnerabilities.


1) Out-of-bounds write (CVE-ID: CVE-2017-14316)

The vulnerability allows an adjacent attacker to execute arbitrary code on the host system.

The weakness exists due to out-of-bounds array access in the processing of NUMA node parameters. An adjacent attacker can invoke specially crafted hypercalls and execute arbitrary code with elevated privileges.

2) Race condition (CVE-ID: CVE-2017-14317)

The vulnerability allows an adjacent attacker to cause DoS condition on the host system.

The weakness exists due to race condition in cxenstored. An adjacent attacker can shut down a virtual machine with a stubdomain, trigger a double-free memory error and cause the xenstored daemon to crash.

The vulnerability is exploitable on the systems running the C version os xenstored ("xenstored") and running devicemodel stubdomains.

3) Null pointer dereference (CVE-ID: CVE-2017-14318)

The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS condition on the host system.

The weakness exists due to NULL pointer deference in certain GNTTABOP_cache_flush grant table operations. If exploited on x86-based PV guest systems without SMAP enabled, an adjacent attacker can gain elevated privileges. If exploited on ARM-based guest systems and x86-based PV guest systems that have SMAP enabled, an adjacent attacker can cause the host system to crash.

4) Privilege escalation (CVE-ID: CVE-2017-14319)

The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS condition on the host system.

The weakness exists due to a flaw in grant unmapping. A local attacker on an x86 PV guest system can gain elevated privileges on the host system or cause the hypervisor to crash.

5) Race condition (CVE-ID: CVE-2017-15588)

The vulnerability allows an adjacent attacker to gain elevated privileges on the target system.

The weakness exists due to page type release race. An adjacent attacker can supply a stale TLB entry, trigger race condition and execute arbitrary code with elevated privileges.

6) Memory leak (CVE-ID: CVE-2017-15589)

The vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.

The weakness exists due to hypervisor stack leak in x86 I/O intercept code. An adjacent attacker can write data from uninitialized hypervisor stack memory and read arbitrary information.

7) Improper access control (CVE-ID: CVE-2017-15590)

The vulnerability allows an adjacent attacker to cause DoS conditions on the target system.

The weakness exists due to an error with the setup of PCI MSI interrupts. An adjacent attacker can supply MSI and cause the hypervisor to crash.

8) Privilege escalation (CVE-ID: CVE-2017-15592)

The vulnerability allows an adjacent attacker to cause DoS conditions or gain elevated privileges on the target system.

The weakness exists due to mishandling of self-linear shadow mappings for translated guests. An adjacent attacker can supply self-linear shadow mappings and cause the hypervisor to crash or possibly gain elevated privileges.

9) Memory leak (CVE-ID: CVE-2017-15593)

The vulnerability allows an adjacent attacker to cause DoS conditions on the target system.

The weakness exists due to mishandling of reference counts. An adjacent attacker can trigger memory leak and cause the service to crash.

10) Privilege escalation (CVE-ID: CVE-2017-15594)

The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.

The weakness exists due to mishandling of IDT settings during CPU hotplugging. An adjacent attacker can gain elevated privileges or cause hypervisor crash.

11) Resource exhaustion (CVE-ID: CVE-2017-15595)

The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.

The weakness exists due to improper input validation. An adjacent attacker can supply specially crafted page-table stacking, trigger unbounded recursion, stack consumption, gain elevated privileges or cause hypervisor crash.

12) Race condition (CVE-ID: CVE-2017-15597)

The vulnerability allows an adjacent administrative attacker to cause DoS condition on the target system.

The weakness exists due to a race condition in certain grant copy operations. A local attacker can trigger a memory corruption error in the hypervisor and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Remediation

Install update from vendor's website.

References