Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:3627-1

Опубликовано: 04 дек. 2020
Источник: suse-cvrf

Описание

Security update for xen

This update for xen fixes the following issues:

  • bsc#1178963 - VUL-0: xen: stack corruption from XSA-346 change (XSA-355)

Список пакетов

Image SLES15-EC2-CHOST-HVM-BYOS
xen-libs-4.10.4_22-3.50.1
xen-tools-domU-4.10.4_22-3.50.1
Image SLES15-EC2-HVM-BYOS
xen-libs-4.10.4_22-3.50.1
xen-tools-domU-4.10.4_22-3.50.1
Image SLES15-SAP-EC2-HVM
xen-libs-4.10.4_22-3.50.1
xen-tools-domU-4.10.4_22-3.50.1
Image SLES15-SAP-EC2-HVM-BYOS
xen-libs-4.10.4_22-3.50.1
xen-tools-domU-4.10.4_22-3.50.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS
xen-4.10.4_22-3.50.1
xen-devel-4.10.4_22-3.50.1
xen-libs-4.10.4_22-3.50.1
xen-tools-4.10.4_22-3.50.1
xen-tools-domU-4.10.4_22-3.50.1
SUSE Linux Enterprise High Performance Computing 15-LTSS
xen-4.10.4_22-3.50.1
xen-devel-4.10.4_22-3.50.1
xen-libs-4.10.4_22-3.50.1
xen-tools-4.10.4_22-3.50.1
xen-tools-domU-4.10.4_22-3.50.1
SUSE Linux Enterprise Server for SAP Applications 15
xen-4.10.4_22-3.50.1
xen-devel-4.10.4_22-3.50.1
xen-libs-4.10.4_22-3.50.1
xen-tools-4.10.4_22-3.50.1
xen-tools-domU-4.10.4_22-3.50.1

Ссылки

Описание

An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated.

Затронутые продукты
Image SLES15-EC2-CHOST-HVM-BYOS:xen-libs-4.10.4_22-3.50.1
Image SLES15-EC2-CHOST-HVM-BYOS:xen-tools-domU-4.10.4_22-3.50.1
Image SLES15-EC2-HVM-BYOS:xen-libs-4.10.4_22-3.50.1
Image SLES15-EC2-HVM-BYOS:xen-tools-domU-4.10.4_22-3.50.1
Ссылки

Описание

An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because coalescing of per-page IOMMU TLB flushes is mishandled.

Затронутые продукты
Image SLES15-EC2-CHOST-HVM-BYOS:xen-libs-4.10.4_22-3.50.1
Image SLES15-EC2-CHOST-HVM-BYOS:xen-tools-domU-4.10.4_22-3.50.1
Image SLES15-EC2-HVM-BYOS:xen-libs-4.10.4_22-3.50.1
Image SLES15-EC2-HVM-BYOS:xen-tools-domU-4.10.4_22-3.50.1
Ссылки

Описание

An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privileges by exploiting a race condition that leads to a use-after-free involving 2MiB and 1GiB superpages.

Затронутые продукты
Image SLES15-EC2-CHOST-HVM-BYOS:xen-libs-4.10.4_22-3.50.1
Image SLES15-EC2-CHOST-HVM-BYOS:xen-tools-domU-4.10.4_22-3.50.1
Image SLES15-EC2-HVM-BYOS:xen-libs-4.10.4_22-3.50.1
Image SLES15-EC2-HVM-BYOS:xen-tools-domU-4.10.4_22-3.50.1
Ссылки

Описание

An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique.

Затронутые продукты
Image SLES15-EC2-CHOST-HVM-BYOS:xen-libs-4.10.4_22-3.50.1
Image SLES15-EC2-CHOST-HVM-BYOS:xen-tools-domU-4.10.4_22-3.50.1
Image SLES15-EC2-HVM-BYOS:xen-libs-4.10.4_22-3.50.1
Image SLES15-EC2-HVM-BYOS:xen-tools-domU-4.10.4_22-3.50.1
Ссылки

Описание

Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.

Затронутые продукты
Image SLES15-EC2-CHOST-HVM-BYOS:xen-libs-4.10.4_22-3.50.1
Image SLES15-EC2-CHOST-HVM-BYOS:xen-tools-domU-4.10.4_22-3.50.1
Image SLES15-EC2-HVM-BYOS:xen-libs-4.10.4_22-3.50.1
Image SLES15-EC2-HVM-BYOS:xen-tools-domU-4.10.4_22-3.50.1
Ссылки
Уязвимость SUSE-SU-2020:3627-1