CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 2CVE-2020-11743 – Debian Security Advisory 4723-1
https://notcve.org/view.php?id=CVE-2020-11743
14 Apr 2020 — An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant table operations are expected to return 0 for success, and a negative number for errors. Some misplaced brackets cause one error path to return 1 instead of a negative value. The grant table code in Linux treats this condition as success, and proceeds with incorrectly initialised state. A buggy or malicious guest can construct its grant table in such a ... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-11742 – Ubuntu Security Notice USN-5617-1
https://notcve.org/view.php?id=CVE-2020-11742
14 Apr 2020 — An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of bad continuation handling in GNTTABOP_copy. Grant table operations are expected to return 0 for success, and a negative number for errors. The fix for CVE-2017-12135 introduced a path through grant copy handling where success may be returned to the caller without any action taken. In particular, the status fields of individual operations are left uninitialised, and may result in errant behaviour in... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2020-11741 – Debian Security Advisory 4723-1
https://notcve.org/view.php?id=CVE-2020-11741
14 Apr 2020 — An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests, cause a denial of service, or possibly gain privileges. For guests for which "active" profiling was enabled by the administrator, the xenoprof code uses the standard Xen shared ring structure. Unfortunately, this code did not treat the guest as a potential adversary: it trusts the guest not to modify buffer size information or modify head / tail point... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html • CWE-909: Missing Initialization of Resource •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2020-11740 – Debian Security Advisory 4723-1
https://notcve.org/view.php?id=CVE-2020-11740
14 Apr 2020 — An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers, even if profiling has not been enabled for those guests. These buffers were not scrubbed. Se detectó un problema en xenoprof en Xen versiones hasta 4.13.x, permitiendo a usuarios invitados del Sistema Operativo (sin perfiles activos) obtener información confidencial sobre otros invitados. Los... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2020-11739 – Ubuntu Security Notice USN-5617-1
https://notcve.org/view.php?id=CVE-2020-11739
14 Apr 2020 — An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the "critical" section. As a consequence, it may be possible to ha... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19577 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-19577
11 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of service or possibly gain privileges by triggering data-structure access during pagetable-height updates. When running on AMD systems with an IOMMU, Xen attempted to dynamically adapt the number of levels of pagetables (the pagetable height) in the IOMMU according to the guest's address space size. The code to select and update the height had several bugs. Notably, the update was done without taking a lock ... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-401: Missing Release of Memory after Effective Lifetime CWE-662: Improper Synchronization •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19578 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-19578
11 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerate chains of linear pagetables, because of an incorrect fix for CVE-2017-15595. "Linear pagetables" is a technique which involves either pointing a pagetable at itself, or to another pagetable of the same or higher level. Xen has limited support for linear pagetables: A page may either point to itself, or point to another pagetable of the same level (i.e., L2 to L2, L3 to L3, and so on). XSA... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-682: Incorrect Calculation •
CVSS: 6.6EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19580 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-19580
11 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations, because of an incomplete fix for CVE-2019-18421. XSA-299 addressed several critical issues in restartable PV type change operations. Despite extensive testing and auditing, some corner cases were missed. A malicious PV guest administrator may be able to escalate their privilege to that of the host. All security-supported version... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19579 – Debian Security Advisory 4602-1
https://notcve.org/view.php?id=CVE-2019-19579
04 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device (and assignable-add is not used), because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's "assignable-add" feature to prepare devices to be assigned to untrusted guests. Unfortunately, this is not considered a strictly required step for device assignment. The PCI passthrough documentation on the wiki describ... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 6%CPEs: 7EXPL: 0CVE-2019-18425 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-18425
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descriptors. There is missing descriptor table limit checking in x86 PV emulation. When emulating certain PV guest operations, descriptor table accesses are performed by the emulating code. Such accesses should respect the guest specified limits, unless otherwise guaranteed to fail in such a case. Without this, emulation of 32-bit guest user mode calls through call gates would ... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html • CWE-269: Improper Privilege Management •