CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19578 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-19578
11 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerate chains of linear pagetables, because of an incorrect fix for CVE-2017-15595. "Linear pagetables" is a technique which involves either pointing a pagetable at itself, or to another pagetable of the same or higher level. Xen has limited support for linear pagetables: A page may either point to itself, or point to another pagetable of the same level (i.e., L2 to L2, L3 to L3, and so on). XSA... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-682: Incorrect Calculation •
CVSS: 6.6EPSS: 1%CPEs: 2EXPL: 0CVE-2019-19580 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-19580
11 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations, because of an incomplete fix for CVE-2019-18421. XSA-299 addressed several critical issues in restartable PV type change operations. Despite extensive testing and auditing, some corner cases were missed. A malicious PV guest administrator may be able to escalate their privilege to that of the host. All security-supported version... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19579 – Debian Security Advisory 4602-1
https://notcve.org/view.php?id=CVE-2019-19579
04 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device (and assignable-add is not used), because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's "assignable-add" feature to prepare devices to be assigned to untrusted guests. Unfortunately, this is not considered a strictly required step for device assignment. The PCI passthrough documentation on the wiki describ... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 4%CPEs: 7EXPL: 0CVE-2019-18425 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-18425
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descriptors. There is missing descriptor table limit checking in x86 PV emulation. When emulating certain PV guest operations, descriptor table accesses are performed by the emulating code. Such accesses should respect the guest specified limits, unless otherwise guaranteed to fail in such a case. Without this, emulation of 32-bit guest user mode calls through call gates would ... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html • CWE-269: Improper Privilege Management •
CVSS: 6.9EPSS: 0%CPEs: 7EXPL: 0CVE-2019-18424 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-18424
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device. This occurs because passed through PCI devices may corrupt host memory after deassignment. When a PCI device is assigned to an untrusted domain, it is possible for that domain to program the device to DMA to an arbitrary address. The IOMMU is used to protect the host from malicious DMA by making sure that the device addresses can only t... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 3%CPEs: 6EXPL: 0CVE-2019-18422 – Debian Security Advisory 4602-1
https://notcve.org/view.php?id=CVE-2019-18422
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled without changing processor level, some interrupts are unconditionally enabled during exception entry. So exceptions which occur when interrupts are masked will effectively unmask the interrupts. A malicious guest mig... • http://www.openwall.com/lists/oss-security/2019/10/31/5 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.5EPSS: 2%CPEs: 7EXPL: 0CVE-2019-18421 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-18421
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations. There are issues with restartable PV type change operations. To avoid using shadow pagetables for PV guests, Xen exposes the actual hardware pagetables to the guest. In order to prevent the guest from modifying these page tables directly, Xen keeps track of how pages are used using a type system; pages must be "promoted" before ... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.5EPSS: 4%CPEs: 6EXPL: 0CVE-2019-18420 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-18420
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to interpret its parameters. Error handling for a bad format character was done using BUG(), which crashes Xen. One path, via the VCPUOP_initialise hypercall, has a bad format character. The BUG() can be hit if VCPUOP_initialise executes for a sufficiently long period of time ... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html • CWE-134: Use of Externally-Controlled Format String •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-17340 – Debian Security Advisory 4602-1
https://notcve.org/view.php?id=CVE-2019-17340
08 Oct 2019 — An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or gain privileges because grant-table transfer requests are mishandled. Se detectó un problema en Xen versiones hasta 4.11.x, permitiendo a usuarios del sistema operativo invitado de x86, causar una denegación de servicio u alcanzar privilegios porque las peticiones de transferencia grant-table son manejadas inapropiadamente. Multiple vulnerabilities have been discovered in the Xen hypervisor, which could... • http://www.openwall.com/lists/oss-security/2019/10/25/1 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-17341 – Debian Security Advisory 4602-1
https://notcve.org/view.php?id=CVE-2019-17341
08 Oct 2019 — An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI device. Se detectó un problema en Xen versiones hasta 4.11.x, permitiendo a usuarios del sistema operativo invitado PV de x86, causar una denegación de servicio u alcanzar privilegios mediante el aprovechamiento de una condición de carrera de escritura de página durante la adición de un dispositivo... • http://www.openwall.com/lists/oss-security/2019/10/25/6 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •