CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19581 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-19581
11 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-bounds access) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On 32-bit Arm accesses to bitmaps with bit a count which is a multiple of 32, an out of bounds access may occur. A malicious guest may cause a hypervisor crash... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19582 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-19582
11 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On x86 accesses to bitmaps with a compile time known size of 64 may incur undefined behavior, which may in particular result in infinite loops. A malicious guest may cause a... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 0CVE-2019-19583 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-19583
11 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest OS crash) because VMX VMEntry checks mishandle a certain case. Please see XSA-260 for background on the MovSS shadow. Please see XSA-156 for background on the need for #DB interception. The VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to ... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2019-19579 – Debian Security Advisory 4602-1
https://notcve.org/view.php?id=CVE-2019-19579
04 Dec 2019 — An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device (and assignable-add is not used), because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's "assignable-add" feature to prepare devices to be assigned to untrusted guests. Unfortunately, this is not considered a strictly required step for device assignment. The PCI passthrough documentation on the wiki describ... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 6%CPEs: 7EXPL: 0CVE-2019-18425 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-18425
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descriptors. There is missing descriptor table limit checking in x86 PV emulation. When emulating certain PV guest operations, descriptor table accesses are performed by the emulating code. Such accesses should respect the guest specified limits, unless otherwise guaranteed to fail in such a case. Without this, emulation of 32-bit guest user mode calls through call gates would ... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html • CWE-269: Improper Privilege Management •
CVSS: 6.9EPSS: 0%CPEs: 7EXPL: 0CVE-2019-18424 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-18424
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device. This occurs because passed through PCI devices may corrupt host memory after deassignment. When a PCI device is assigned to an untrusted domain, it is possible for that domain to program the device to DMA to an arbitrary address. The IOMMU is used to protect the host from malicious DMA by making sure that the device addresses can only t... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-18423 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-18423
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall. p2m->max_mapped_gfn is used by the functions p2m_resolve_translation_fault() and p2m_get_entry() to sanity check guest physical frame. The rest of the code in the two functions will assume that there is a valid root table and check that with BUG_ON(). The function p2m_get_root_pointer() will ignore the unused top bits of a guest physical frame. This means that the fun... • http://www.openwall.com/lists/oss-security/2019/10/31/4 • CWE-193: Off-by-one Error •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-18422 – Debian Security Advisory 4602-1
https://notcve.org/view.php?id=CVE-2019-18422
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled without changing processor level, some interrupts are unconditionally enabled during exception entry. So exceptions which occur when interrupts are masked will effectively unmask the interrupts. A malicious guest mig... • http://www.openwall.com/lists/oss-security/2019/10/31/5 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2019-18421 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-18421
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations. There are issues with restartable PV type change operations. To avoid using shadow pagetables for PV guests, Xen exposes the actual hardware pagetables to the guest. In order to prevent the guest from modifying these page tables directly, Xen keeps track of how pages are used using a type system; pages must be "promoted" before ... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2019-18420 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-18420
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to interpret its parameters. Error handling for a bad format character was done using BUG(), which crashes Xen. One path, via the VCPUOP_initialise hypercall, has a bad format character. The BUG() can be hit if VCPUOP_initialise executes for a sufficiently long period of time ... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html • CWE-134: Use of Externally-Controlled Format String •