Описание
Security update for xen
This update for xen fixes the following issues:
Security issues fixed:
- CVE-2024-45818: xen: Deadlock in x86 HVM standard VGA handling (bsc#1232622)
- CVE-2024-45819: xen: libxl leaks data to PVH guests via ACPI tables (bsc#1232624)
Non-security issue fixed:
- Xen host hung at boot up with repeated '(XEN) APIC error on CPU on CPU53: 40(40), Received illegal vector' (bsc#1231046)
Список пакетов
Image SLES12-SP5-EC2-BYOS
Image SLES12-SP5-EC2-ECS-On-Demand
Image SLES12-SP5-EC2-On-Demand
Image SLES12-SP5-EC2-SAP-BYOS
Image SLES12-SP5-EC2-SAP-On-Demand
SUSE Linux Enterprise Server 12 SP5-LTSS
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2024:3979-1
- E-Mail link for SUSE-SU-2024:3979-1
- SUSE Security Ratings
- SUSE Bug 1231046
- SUSE Bug 1232622
- SUSE Bug 1232624
- SUSE CVE CVE-2024-45818 page
- SUSE CVE CVE-2024-45819 page
Описание
The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the (virtual) VGA is in "standard" mode. Locking involved there has an unusual discipline, leaving a lock acquired past the return from the function that acquired it. This behavior results in a problem when emulating an instruction with two memory accesses, both of which touch VGA memory (plus some further constraints which aren't relevant here). When emulating the 2nd access, the lock that is already being held would be attempted to be re-acquired, resulting in a deadlock. This deadlock was already found when the code was first introduced, but was analysed incorrectly and the fix was incomplete. Analysis in light of the new finding cannot find a way to make the existing locking discipline work. In staging, this logic has all been removed because it was discovered to be accidentally disabled since Xen 4.7. Therefore, we are fixing the locking problem by backporting the removal of most of the feature. Note that even with the feature disabled, the lock would still be acquired for any accesses to the VGA MMIO region.
Затронутые продукты
Ссылки
- CVE-2024-45818
- SUSE Bug 1232622
Описание
PVH guests have their ACPI tables constructed by the toolstack. The construction involves building the tables in local memory, which are then copied into guest memory. While actually used parts of the local memory are filled in correctly, excess space that is being allocated is left with its prior contents.
Затронутые продукты
Ссылки
- CVE-2024-45819
- SUSE Bug 1232624