SB2018022709 - Denial of service in Xen

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2018-7542)

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The vulnerability exists due to a NULL pointer dereference in multiple paths without the presence of a Local APIC. An adjacent attacker can crash the hypervisor and cause a denial of service.

2) Memory corruption (CVE-ID: CVE-2018-7541)

The vulnerability allows an adjacent attacker to cause DoS condition and gain elevated privileges on the target system.

The weakness exists due to an error when transitioning from v2 to v1. An adjacent attacker can trigger memory corruption, cause the service to crash and gain root privileges.

3) Resource exhaustion (CVE-ID: CVE-2018-7540)

The vulnerability allows an adjacent authenticated attacker to cause a DoS condition on the target system.

The weakness exists due to non-preemptable L3/L4 pagetable freeing. An adjacent attacker can exhaust all available CPU resources and cause the service to crash.

Remediation

Install update from vendor's website.

References

• http://xenbits.xen.org/xsa/advisory-256.html
• http://xenbits.xen.org/xsa/advisory-255.html
• http://xenbits.xen.org/xsa/advisory-252.html