Memory leak in Xen - CVE-2024-45819

Vulnerability identifier: #VU100327

CSH Severity: Medium

CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N]

CVE-ID: CVE-2024-45819

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a malicious guest to gain access to sensitive information.

The vulnerability exists due data leak in libxl related to how PBH guests work with ACPI tables. A malicious guest can access sensitive information pertaining to the host, control domain, or other guests.

Xen
PowerStore 9200T
PowerStore 500T
PowerStore 1000T
PowerStore 1200T
PowerStore 3000T
PowerStore 3200Q
PowerStore 3200T
PowerStore 5000T
PowerStore 5200T
PowerStore 7000T
PowerStore 9000T
PowerStoreT OS
Cloud Tiering Appliance
SUSE Linux Enterprise High Performance Computing 15 SP2
SUSE Linux Enterprise Server 15 SP2
SUSE Linux Enterprise Desktop 15 SP4
SUSE Linux Enterprise Server 15 SP4
Debian Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
SUSE Linux Enterprise Server 12 SP5 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
Server Applications Module
openSUSE Leap
Fedora
SmartFabric Manager
xen-tools-debuginfo
xen-libs-debuginfo
xen-libs-debuginfo-32bit
xen-tools-domU-debuginfo
xen-tools
xen-debugsource
xen-doc-html
xen-libs-32bit
xen-tools-domU
xen
xen-libs
xen-devel
xen-tools-xendomains-wait-disk
xen-libs-64bit-debuginfo
xen-libs-32bit-debuginfo
xen-libs-64bit
xen (Debian package)

Install updates from vendor's website.

SmartFabric Manager - update to 1.2.0
PowerStoreT OS - update to 4.0.1.3-2494147
xen-tools-debuginfo - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-libs-debuginfo - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-libs-debuginfo-32bit - update to 4.12.4_58-3.124.1
xen-tools-domU-debuginfo - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-tools - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-debugsource - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-doc-html - addressed in versions 4.12.4_58-3.124.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-libs-32bit - addressed in versions 4.12.4_58-3.124.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-tools-domU - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-libs - addressed in versions 4.12.4_58-3.124.1, 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-devel - addressed in versions 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-tools-xendomains-wait-disk - addressed in versions 4.13.5_16-150200.3.99.1, 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-libs-64bit-debuginfo - addressed in versions 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-libs-32bit-debuginfo - addressed in versions 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen-libs-64bit - addressed in versions 4.14.6_22-150300.3.84.1, 4.16.6_06-150400.4.65.1, 4.17.5_06-150500.3.42.1, 4.18.3_06-150600.3.12.1
xen - addressed in versions 4.17.5-3.fc39, 4.18.3-3.fc40, 4.19.1-3.fc41
xen (Debian package) - update to 4.17.5+23-ga4e5191dc0-1
Cloud Tiering Appliance - update to 13.2.0.2.33

• https://xenbits.xen.org/xsa/advisory-464.html

• Information disclosure in Xen libxl
• SUSE update for xen
• SUSE update for xen
• SUSE update for xen
• Fedora 40 update for xen
• Fedora 39 update for xen
• SUSE update for xen
• SUSE update for xen
• SUSE update for xen
• Debian update for xen
• Fedora 41 update for xen
• Dell SmartFabric Manager update for third-party components
• Dell Cloud Tiering Appliance/VE update for third-party components
• Multiple vulnerabilities in Dell PowerStoreT OS