Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2017:2339-1

Опубликовано: 04 сент. 2017
Источник: suse-cvrf

Описание

Security update for xen

This update for xen fixes the following issues:

  • CVE-2017-12855: Premature clearing of GTF_writing / GTF_reading lead to potentially leaking sensitive information (XSA-230, bsc#1052686).
  • CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious guest to crash the host or potentially escalate privileges/leak information (XSA-226, bsc#1051787).
  • CVE-2017-12137: Incorrectly-aligned updates to pagetables allowed for privilege escalation (XSA-227, bsc#1051788).
  • CVE-2017-11334: The address_space_write_continue function in exec.c allowed local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area (bsc#1048920).
  • CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP options string (bsc#1049578).
  • CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt (bsc#1046637).

Список пакетов

SUSE Linux Enterprise Point of Sale 11 SP3
xen-kmp-default-4.2.5_21_3.0.101_0.47.105-45.5.1
xen-kmp-pae-4.2.5_21_3.0.101_0.47.105-45.5.1
xen-libs-4.2.5_21-45.5.1
xen-tools-domU-4.2.5_21-45.5.1
SUSE Linux Enterprise Server 11 SP3-LTSS
xen-4.2.5_21-45.5.1
xen-doc-html-4.2.5_21-45.5.1
xen-doc-pdf-4.2.5_21-45.5.1
xen-kmp-default-4.2.5_21_3.0.101_0.47.105-45.5.1
xen-kmp-pae-4.2.5_21_3.0.101_0.47.105-45.5.1
xen-libs-4.2.5_21-45.5.1
xen-libs-32bit-4.2.5_21-45.5.1
xen-tools-4.2.5_21-45.5.1
xen-tools-domU-4.2.5_21-45.5.1

Ссылки

Описание

qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.105-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.105-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.5.1
Ссылки

Описание

The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.105-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.105-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.5.1
Ссылки

Описание

The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.105-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.105-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.5.1
Ссылки

Описание

Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain privileges via vectors involving transitive grants.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.105-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.105-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.5.1
Ссылки

Описание

arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to map_grant_ref.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.105-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.105-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.5.1
Ссылки

Описание

Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-default-4.2.5_21_3.0.101_0.47.105-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-kmp-pae-4.2.5_21_3.0.101_0.47.105-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-libs-4.2.5_21-45.5.1
SUSE Linux Enterprise Point of Sale 11 SP3:xen-tools-domU-4.2.5_21-45.5.1
Ссылки
Уязвимость SUSE-SU-2017:2339-1