{"id":39427,"date":"2019-10-31T22:32:37","date_gmt":"2019-10-31T19:32:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/10-uyazvimostej-v-gipervizore-xen\/"},"modified":"2019-10-31T22:32:37","modified_gmt":"2019-10-31T19:32:37","slug":"10-uyazvimostej-v-gipervizore-xen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/10-uyazvimostej-v-gipervizore-xen","title":{"rendered":"10 vulnerabilit\u0103\u021bi \u00een hipervizorul Xen","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/25\/\">Publicate<\/a><\/noindex> informa\u021bii despre 10 vulnerabilit\u0103\u021bi \u00een hypervisorul Xen, dintre care cinci (<noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/25\/6\">CVE-2019-17341<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/25\/2\">CVE-2019-17342<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/25\/1\">CVE-2019-17340<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/25\/5\">CVE-2019-17346<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/25\/10\">CVE-2019-17343<\/a><\/noindex>) permit poten\u021bial dep\u0103\u0219irea mediului virtual curent \u0219i cre\u0219terea privilegiilor, o vulnerabilitate (CVE-2019-17347) permite unui proces f\u0103r\u0103 privilegii s\u0103 preia controlul asupra proceselor altor utilizatori \u00een aceea\u0219i sistem virtual, restul de patru (CVE-2019-17344, CVE-2019-17345, CVE-2019-17348, CVE-2019-17351) vulnerabilit\u0103\u021bi permit provocarea unui refuz de serviciu (crash-ul mediului gazd\u0103). Problemele au fost remediate \u00een versiunile <noindex><a rel=\"nofollow\" href=\"https:\/\/xenproject.org\/downloads\/\">Xen 4.12.1, 4.11.2 \u0219i 4.10.4<\/a><\/noindex>.<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/25\/6\">CVE-2019-17341<\/a><\/noindex> \u2014 posibilitatea ca un sistem gazd\u0103 controlat de un atacator s\u0103 ob\u021bin\u0103 acces la nivelul hypervisor-ului. Problema apare doar pe sistemele x86 \u0219i poate fi realizat\u0103 din sistemele gazd\u0103 care func\u021bioneaz\u0103 \u00een modul paravirtualiz\u0103rii (PV), atunci c\u00e2nd se trece un nou dispozitiv PCI \u00eentr-un sistem gazd\u0103 activ. \u00cen sistemele gazd\u0103 care func\u021bioneaz\u0103 \u00een modurile HVM \u0219i PVH, vulnerabilitatea nu se manifest\u0103;\n<li class=\"l\">  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/25\/1\">CVE-2019-17340<\/a><\/noindex> \u2014 o scurgere de memorie, care permite poten\u021bial s\u0103 \u00ee\u0219i creasc\u0103 privilegii sau s\u0103 ob\u021bin\u0103 acces la datele altor sisteme gazd\u0103.<br \/>\nProblema apare doar pe gazde cu mai mult de 16 TB RAM \u00een sistemele pe 64 de bi\u021bi \u0219i 168 GB \u00een sistemele pe 32 de bi\u021bi.<br \/>\nVulnerabilitatea poate fi exploatat\u0103 doar din sistemele virtuale \u00een modul PV (\u00een modurile HVM \u0219i PVH vulnerabilitatea nu se manifest\u0103);<\/p>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/25\/5\">CVE-2019-17346<\/a><\/noindex> \u2014 o vulnerabilitate \u00een utilizarea PCID (Identificatori de Context de Proces) pentru a \u00eembun\u0103t\u0103\u021bi performan\u021ba protec\u021biei \u00eempotriva atacurilor.<br \/>\nMeltdown, permite accesul la datele altor sisteme virtuale \u0219i poate poten\u021bial s\u0103 creasc\u0103 privilegiile. Vulnerabilitatea poate fi exploatat\u0103 doar din sistemele virtuale \u00een modul PV pe sistemele x86 (problema nu se manifest\u0103 \u00een modurile HVM \u0219i PVH, precum \u0219i \u00een configura\u021biile care nu includ sisteme virtuale cu PCID activat (PCID este activat prin default));<\/p>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/25\/2\">CVE-2019-17342<\/a><\/noindex> \u2014 o problem\u0103 \u00een implementarea hypercall-ului XENMEM_exchange permite cre\u0219terea privilegiilor \u00een medii cu un singur sistem gazd\u0103. Vulnerabilitatea poate fi exploatat\u0103 doar din sistemele gazd\u0103 \u00een modul PV (\u00een modurile HVM \u0219i PVH, vulnerabilitatea nu se manifest\u0103);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/25\/10\">CVE-2019-17343<\/a><\/noindex> \u2014 o mapare incorect\u0103 \u00een IOMMU permite, \u00een cazul accesului dintr-un sistem gazd\u0103 la un dispozitiv fizic, utilizarea DMA pentru a modifica propria tabel\u0103 de pagini de memorie \u0219i a ob\u021bine acces la nivel de gazd\u0103. Vulnerabilitatea se manifest\u0103 doar \u00een sistemele gazd\u0103 \u00een modul PV, \u00een prezen\u021ba drepturilor pentru trecerea PCI-urilor.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Sursa: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51764\">opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0435 Xen, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u044f\u0442\u044c (CVE-2019-17341, CVE-2019-17342, CVE-2019-17340, CVE-2019-17346, CVE-2019-17343) \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-17347) \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u0442\u043e\u0439 \u0436\u0435 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0435\u0441\u044f \u0447\u0435\u0442\u044b\u0440\u0435 (CVE-2019-17344, CVE-2019-17345, CVE-2019-17348, CVE-2019-17351) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-39427","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0435 Xen, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u044f\u0442\u044c (\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/10-uyazvimostej-v-gipervizore-xen\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4710 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0435 Xen | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0435 Xen, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u044f\u0442\u044c (\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/10-uyazvimostej-v-gipervizore-xen\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:32:37+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:32:37+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4710 vulnerabilit\u0103\u021bi \u00een hypervisorul Xen | ProHoster","description":"Au fost publicate informa\u021bii despre 10 vulnerabilit\u0103\u021bi \u00een hypervisorul Xen, dintre care cinci (","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/10-uyazvimostej-v-gipervizore-xen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4710 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0435 Xen | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e 10 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0435 Xen, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u044f\u0442\u044c (","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/10-uyazvimostej-v-gipervizore-xen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:32:37+00:00","article:modified_time":"2019-10-31T19:32:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39427","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 01:57:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:50:24","updated":"2026-01-24 01:57:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/39427","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=39427"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/39427\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=39427"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=39427"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=39427"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}