SB2023122124 - SUSE update for xen 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023122124

SB2023122124 - SUSE update for xen

Published: December 21, 2023

Security Bulletin ID SB2023122124
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-46835)

The vulnerability allows a remote guest to gain access to sensitive information.

The vulnerability exists due to improperly imposed security restrictions caused by a mismatch in IOMMU quarantine page table levels. A device in quarantine mode can access data from previous quarantine page table usages, possibly leaking data used by previous domains that also had the device assigned.


2) Security features bypass (CVE-ID: CVE-2023-46836)

The vulnerability allows a remote guest to bypass implemented security restrictions.

The vulnerability exists due to improper implementation of mitigations against BTC/SRSO. A malicious guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack against Xen, which can result in memory access to other guests.


Remediation

Install update from vendor's website.

References