Fedora 37 update for xen



Risk High
Patch available YES
Number of vulnerabilities 5
CVE-ID CVE-2023-34323
CVE-2023-34325
CVE-2023-34326
CVE-2023-34327
CVE-2023-34328
CWE-ID CWE-617
CWE-121
CWE-264
CWE-371
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Fedora
Operating systems & Components / Operating system

xen
Operating systems & Components / Operating system package or component

Vendor Fedoraproject

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Reachable Assertion

EUVDB-ID: #VU81895

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-34323

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

Description

The vulnerability allows a remote guest to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion when handling negative quota values in C Xenstored. A malicious guest can craft a transaction that forces C Xenstored to check quota value and perform a denial of service attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 37

xen: before 4.16.5-3.fc37

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2023-881672fdab


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stack-based buffer overflow

EUVDB-ID: #VU81886

Risk: High

CVSSv4.0: 2.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:U/U:Amber]

CVE-ID: CVE-2023-34325

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote guest to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input in libfsimage. A remote guest can use pygrab to trigger stack-based buffer overflow and execute arbitrary code on the host system.


Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 37

xen: before 4.16.5-3.fc37

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2023-881672fdab


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU81883

Risk: Medium

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-34326

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote guest to escalate privileges on the system.

The vulnerability exists due to missing IOMMU TLB flushing on x86/AMD systems. A malicious guest can access memory not owned by the guest and escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 37

xen: before 4.16.5-3.fc37

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2023-881672fdab


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) State Issues

EUVDB-ID: #VU81901

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-34327

CWE-ID: CWE-371 - State Issues

Exploit availability: No

Description

The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of guest state when using Debug Masks in HVM vCPU. A malicious guest can perform a denial of service (DoS) attack against the guest OS.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 37

xen: before 4.16.5-3.fc37

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2023-881672fdab


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) State Issues

EUVDB-ID: #VU81903

Risk: Medium

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:U/U:Green]

CVE-ID: CVE-2023-34328

CWE-ID: CWE-371 - State Issues

Exploit availability: No

Description

The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of guest state in PV vCPU. A malicious guest place a breakpoint over the live GDT and perform a denial of service (DoS) attack against the host.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 37

xen: before 4.16.5-3.fc37

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2023-881672fdab


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###