Improper locking in Xen - CVE-2024-45818

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU100325

Improper locking in Xen - CVE-2024-45818

Published: November 12, 2024


Vulnerability identifier: #VU100325
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-45818
CWE-ID: CWE-667
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a malicious guest to perform a denial of service attack (DoS) on the target system.

The vulnerability exists due to improper locking in standard VGA implementation. A malicious guest can cause a deadlock and perform a denial of service attack against the entire host.


Affected software

Xen
Citrix Hypervisor
SUSE Linux Enterprise Desktop 15 SP4
Debian Linux
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP2
SUSE Linux Enterprise High Performance Computing 15 SP2
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Server 12 SP5 LTSS
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
Server Applications Module
openSUSE Leap
Fedora
PowerStore 9200T
PowerStore 9000T
PowerStore 7000T
PowerStore 5200T
PowerStore 5000T
PowerStore 3200T
PowerStore 3200Q
PowerStore 3000T
PowerStore 1200T
PowerStore 1000T
PowerStore 500T
PowerStoreT OS
Cloud Tiering Appliance
SmartFabric Manager
Citrix XenServer
xen-libs
xen-tools-domU
xen-tools-debuginfo
xen-libs-debuginfo
xen-libs-debuginfo-32bit
xen-tools-domU-debuginfo
xen-tools
xen-debugsource
xen-doc-html
xen-libs-32bit
xen
xen-tools-xendomains-wait-disk
xen-devel
xen-libs-64bit-debuginfo
xen-libs-32bit-debuginfo
xen-libs-64bit
xen (Debian package)

How to mitigate CVE-2024-45818

Install updates from vendor's website.

SmartFabric Manager - update to 1.2.0
Citrix Hypervisor - update to CTX691830
PowerStoreT OS - update to 4.0.1.3-2494147
xen-libs - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-tools-domU - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-tools-debuginfo - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-libs-debuginfo - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-libs-debuginfo-32bit - update to 4.12.4_58-3.124.1
xen-tools-domU-debuginfo - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-tools - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-debugsource - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-doc-html - addressed in versions 4.12.4_58-3.124.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-libs-32bit - addressed in versions 4.12.4_58-3.124.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-tools-xendomains-wait-disk - addressed in versions 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-devel - addressed in versions 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-libs-64bit-debuginfo - addressed in versions 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-libs-32bit-debuginfo - addressed in versions 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-libs-64bit - addressed in versions 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen - addressed in versions 4.17.5-3.fc39, 4.18.3-3.fc40, 4.19.1-3.fc41
xen (Debian package) - update to 4.17.5+23-ga4e5191dc0-1
Cloud Tiering Appliance - update to 13.2.0.2.33

External References

Related Security Bulletins