Debian update for xen



Published: 2022-04-19
Risk Low
Patch available YES
Number of vulnerabilities 9
CVE-ID CVE-2022-23033
CVE-2022-23034
CVE-2022-23035
CVE-2022-26356
CVE-2022-26357
CVE-2022-26358
CVE-2022-26359
CVE-2022-26360
CVE-2022-26361
CWE-ID CWE-863
CWE-191
CWE-459
CWE-401
CWE-362
CWE-400
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe 		Debian Linux
Operating systems & Components / Operating system

xen (Debian package)
Operating systems & Components / Operating system package or component

Vendor Debian

Security Bulletin

This security bulletin contains information about 9 vulnerabilities.

1) Incorrect authorization

EUVDB-ID: #VU63797

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23033

CWE-ID: CWE-863 - Incorrect Authorization

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to guest_physmap_remove_page() function does not remove p2m mappings. A local user issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, can cause information leaks, Denial of Service (DoS), or escalate privileges on the system.

Mitigation

Update xen package to version 4.14.4+74-gd7b22226b5-1.

Vulnerable software versions

Debian Linux: All versions

xen (Debian package): before 4.14.4+74-gd7b22226b5-1

External links

http://www.debian.org/security/2022/dsa-5117


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer underflow

EUVDB-ID: #VU63798

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23034

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user can perform a denial of service attack.

The vulnerability exists due to integer underflow when unmapping a grant to address XSA-380. A local user can request two forms of mappings to perform a denial of service attack.

Mitigation

Update xen package to version 4.14.4+74-gd7b22226b5-1.

Vulnerable software versions

Debian Linux: All versions

xen (Debian package): before 4.14.4+74-gd7b22226b5-1

External links

http://www.debian.org/security/2022/dsa-5117


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Incomplete cleanup

EUVDB-ID: #VU63800

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23035

CWE-ID: CWE-459 - Incomplete cleanup

Exploit availability: No

Description

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to insufficient cleanup of passed-through device IRQs. An attacker with physical access can cause a Denial of Service (DoS) and escalate privileges on the system.

Mitigation

Update xen package to version 4.14.4+74-gd7b22226b5-1.

Vulnerable software versions

Debian Linux: All versions

xen (Debian package): before 4.14.4+74-gd7b22226b5-1

External links

http://www.debian.org/security/2022/dsa-5117


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Memory leak

EUVDB-ID: #VU63435

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26356

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due to racy interactions between dirty vram tracking and paging log dirty hypercalls. A local user can force the application to leak memory and perform denial of service attack.

Mitigation

Update xen package to version 4.14.4+74-gd7b22226b5-1.

Vulnerable software versions

Debian Linux: All versions

xen (Debian package): before 4.14.4+74-gd7b22226b5-1

External links

http://www.debian.org/security/2022/dsa-5117


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Race condition

EUVDB-ID: #VU63438

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26357

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in the VT-d domain ID cleanup. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Mitigation

Update xen package to version 4.14.4+74-gd7b22226b5-1.

Vulnerable software versions

Debian Linux: All versions

xen (Debian package): before 4.14.4+74-gd7b22226b5-1

External links

http://www.debian.org/security/2022/dsa-5117


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU63439

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26358

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to RMRR (VT-d) and unity map (AMD-Vi) handling issues. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update xen package to version 4.14.4+74-gd7b22226b5-1.

Vulnerable software versions

Debian Linux: All versions

xen (Debian package): before 4.14.4+74-gd7b22226b5-1

External links

http://www.debian.org/security/2022/dsa-5117


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Resource exhaustion

EUVDB-ID: #VU63440

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26359

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to RMRR (VT-d) and unity map (AMD-Vi) handling issues. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update xen package to version 4.14.4+74-gd7b22226b5-1.

Vulnerable software versions

Debian Linux: All versions

xen (Debian package): before 4.14.4+74-gd7b22226b5-1

External links

http://www.debian.org/security/2022/dsa-5117


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Resource exhaustion

EUVDB-ID: #VU63441

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26360

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to RMRR (VT-d) and unity map (AMD-Vi) handling issues. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update xen package to version 4.14.4+74-gd7b22226b5-1.

Vulnerable software versions

Debian Linux: All versions

xen (Debian package): before 4.14.4+74-gd7b22226b5-1

External links

http://www.debian.org/security/2022/dsa-5117


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Resource exhaustion

EUVDB-ID: #VU63442

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26361

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to RMRR (VT-d) and unity map (AMD-Vi) handling issues. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update xen package to version 4.14.4+74-gd7b22226b5-1.

Vulnerable software versions

Debian Linux: All versions

xen (Debian package): before 4.14.4+74-gd7b22226b5-1

External links

http://www.debian.org/security/2022/dsa-5117


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###