SB2023092751 - SUSE update for xen 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023092751

SB2023092751 - SUSE update for xen

Published: September 27, 2023

Security Bulletin ID SB2023092751
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Division by zero (CVE-ID: CVE-2023-20588)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a divide by zero error that can return speculative data. A local user can gain access to potentially sensitive information.


2) Resource management error (CVE-ID: CVE-2023-34322)

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to improper management of internal resources when running PV guests in shadow paging mode. A malicious guest can run a specially crafted application on the system that causes shortage of memory in the associated with the domain shadow pool and forces Xen to tear down page tables. This can result in memory leak, denial of service or privilege escalation.

The vulnerability can be exploited by 64-bit PV guests on x86 systems.


Remediation

Install update from vendor's website.

References