CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-11742 – Ubuntu Security Notice USN-5617-1
https://notcve.org/view.php?id=CVE-2020-11742
14 Apr 2020 — An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of bad continuation handling in GNTTABOP_copy. Grant table operations are expected to return 0 for success, and a negative number for errors. The fix for CVE-2017-12135 introduced a path through grant copy handling where success may be returned to the caller without any action taken. In particular, the status fields of individual operations are left uninitialised, and may result in errant behaviour in... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2020-11741 – Debian Security Advisory 4723-1
https://notcve.org/view.php?id=CVE-2020-11741
14 Apr 2020 — An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests, cause a denial of service, or possibly gain privileges. For guests for which "active" profiling was enabled by the administrator, the xenoprof code uses the standard Xen shared ring structure. Unfortunately, this code did not treat the guest as a potential adversary: it trusts the guest not to modify buffer size information or modify head / tail point... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html • CWE-909: Missing Initialization of Resource •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2020-11740 – Debian Security Advisory 4723-1
https://notcve.org/view.php?id=CVE-2020-11740
14 Apr 2020 — An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers, even if profiling has not been enabled for those guests. These buffers were not scrubbed. Se detectó un problema en xenoprof en Xen versiones hasta 4.13.x, permitiendo a usuarios invitados del Sistema Operativo (sin perfiles activos) obtener información confidencial sobre otros invitados. Los... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2020-11739 – Ubuntu Security Notice USN-5617-1
https://notcve.org/view.php?id=CVE-2020-11739
14 Apr 2020 — An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the "critical" section. As a consequence, it may be possible to ha... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19577 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-19577
11 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of service or possibly gain privileges by triggering data-structure access during pagetable-height updates. When running on AMD systems with an IOMMU, Xen attempted to dynamically adapt the number of levels of pagetables (the pagetable height) in the IOMMU according to the guest's address space size. The code to select and update the height had several bugs. Notably, the update was done without taking a lock ... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-401: Missing Release of Memory after Effective Lifetime CWE-662: Improper Synchronization •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19578 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-19578
11 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerate chains of linear pagetables, because of an incorrect fix for CVE-2017-15595. "Linear pagetables" is a technique which involves either pointing a pagetable at itself, or to another pagetable of the same or higher level. Xen has limited support for linear pagetables: A page may either point to itself, or point to another pagetable of the same level (i.e., L2 to L2, L3 to L3, and so on). XSA... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-682: Incorrect Calculation •
CVSS: 6.6EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19580 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-19580
11 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations, because of an incomplete fix for CVE-2019-18421. XSA-299 addressed several critical issues in restartable PV type change operations. Despite extensive testing and auditing, some corner cases were missed. A malicious PV guest administrator may be able to escalate their privilege to that of the host. All security-supported version... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19579 – Debian Security Advisory 4602-1
https://notcve.org/view.php?id=CVE-2019-19579
04 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device (and assignable-add is not used), because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's "assignable-add" feature to prepare devices to be assigned to untrusted guests. Unfortunately, this is not considered a strictly required step for device assignment. The PCI passthrough documentation on the wiki describ... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 6%CPEs: 7EXPL: 0CVE-2019-18425 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-18425
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descriptors. There is missing descriptor table limit checking in x86 PV emulation. When emulating certain PV guest operations, descriptor table accesses are performed by the emulating code. Such accesses should respect the guest specified limits, unless otherwise guaranteed to fail in such a case. Without this, emulation of 32-bit guest user mode calls through call gates would ... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html • CWE-269: Improper Privilege Management •
CVSS: 6.9EPSS: 0%CPEs: 7EXPL: 0CVE-2019-18424 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-18424
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device. This occurs because passed through PCI devices may corrupt host memory after deassignment. When a PCI device is assigned to an untrusted domain, it is possible for that domain to program the device to DMA to an arbitrary address. The IOMMU is used to protect the host from malicious DMA by making sure that the device addresses can only t... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •