An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a compare-and-exchange operation.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by multiple denial of service (DoS) vulnerabilities :

  - A denial of service (DoS) vulnerability exists in the LoadExcl and StoreExcl operations due to a possible     infinite loop. An unauthenticated, local attacker can exploit this issue, by accessing a memory region     shared with the hypervisor while the hypervisor is performing an atomic operation on the same region, to     cause the system to stop responding. (CVE-2019-17349)

  - A denial of service (DoS) vulnerability exists in the compare-and-exchange operation due to a possible     infinite loop. An unauthenticated, local attacker can exploit this issue, by accessing a memory region     shared with the hypervisor while the hypervisor is performing an atomic operation on the same region, to     cause the system to stop responding. (CVE-2019-17350)

Only Arm processors are affected by these vulnerabilities. x86 processors are not vulnerable.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks.

In addition this update provides mitigations for the 'TSX Asynchronous Abort'speculative side channel attack. For additional information please refer to https://xenbits.xen.org/xsa/advisory-305.html

ID	Name	Product	Family	Severity
135292	Xen Project Denial of Service (XSA-295)	Nessus	Misc.	medium
132875	Debian DSA-4602-1 : xen - security update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-17350

medium

Tenable Plugins

medium

critical