10 sårbarheter i hypervisorn Xen

Publicerade information about 10 vulnerabilities in the Xen hypervisor, of which five (CVE-2019-17341, CVE-2019-17342, CVE-2019-17340, CVE-2019-17346, CVE-2019-17343) potentially allow escaping the current guest environment and elevating privileges, one vulnerability (CVE-2019-17347) allows an unprivileged process to gain control over other users' processes in the same guest system, the remaining four (CVE-2019-17344, CVE-2019-17345, CVE-2019-17348, CVE-2019-17351) vulnerabilities allow denial of service (crash of the host environment). The issues have been addressed in releases Xen 4.12.1, 4.11.2, and 4.10.4.

• CVE-2019-17341 — an attacker-controlled guest system can gain hypervisor-level access. The issue only manifests on x86 systems and can be exploited from guest systems operating in paravirtualization (PV) mode when attaching a new PCI device to a running guest system. The vulnerability does not appear in guest systems operating in HVM and PVH modes;
• CVE-2019-17340 — memory leak that could potentially elevate privileges or access data from other guest systems.
  The issue only manifests on hosts with more than 16 TB of RAM in 64-bit systems and 168 GB in 32-bit systems.
  The vulnerability can only be exploited from guest systems in PV mode (it does not manifest in HVM and PVH modes when working through libxl);
• CVE-2019-17346 — a vulnerability when using PCID (Process Context Identifiers) to enhance protection against attacks
  Meltdown allows access to data from other guest systems and potentially elevate privileges. The vulnerability can only be exploited from guest systems in PV mode on x86 systems (the issue does not manifest in HVM and PVH modes, nor in configurations without guest systems with PCID enabled (PCID is enabled by default));
• CVE-2019-17342 — a problem in the implementation of the hypercall XENMEM_exchange allows privilege escalation in environments with only one guest system. The vulnerability can only be exploited from guest systems in PV mode (it does not manifest in HVM and PVH modes);
• CVE-2019-17343 — en felaktig karta i IOMMU ger möjlighet, vid åtkomst från gästsystème till fysisk enhet, att använda DMA för att ändra sin egen minnestabell och få åtkomst på värdnivå. Sårbarheten uppträder endast i gästsysten i PV-läge när rättigheter för PCI-enhetspassering är närvarande.

Källa: opennet.ru