SB2018080616 - OpenSUSE Linux update for xen

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018080616

SB2018080616 - OpenSUSE Linux update for xen

Published: August 6, 2018

Security Bulletin ID SB2018080616
Severity
Low
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Heap-based buffer overflow (CVE-ID: CVE-2018-11806)

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The vulnerability exists due to heap-based buffer overflow when insufficient input and validation checking of Slirp networking back-end processes by the m_cat function, as defined in the slirp/mbuf.c source code file. A remote attacker can send malformed, fragmented packets, trigger memory corruption and cause the QEMU process to crash.


2) Denial of service (CVE-ID: CVE-2018-12891)

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The vulnerability exists on x86 systems due to unspecified flaw. An adjacent attacker can invoke certain PV MMU operations to preempt the current vCPU, prevent use of a physical CPU and cause the system to crash.


3) Security restrictions bypass (CVE-ID: CVE-2018-12892)

The vulnerability allows an adjacent attacker with administrative privileges to bypass security restrictions on the target system.

The vulnerability exists on x86 systems due to a flaw in libxl. An adjacent attacker can bypass the read-only restrictions on a SCSI disk image in certain cases.


4) Denial of service (CVE-ID: CVE-2018-12893)

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The vulnerability exists on x86 systems due to unspecified flaw. An adjacent attacker can invoke hardware debugging facilities, trigger a debug exception and cause the system to crash.


5) Side-channel attack (CVE-ID: CVE-2018-3665)

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to utilizing the Lazy FP state restore technique for floating point state when context switching between application processes. A local attacker can conduct cache side-channel attacks and determine register values of other processes.

Note: This vulnerability is known as LazyFP.


Remediation

Install update from vendor's website.

References