An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the "critical" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5617-1 advisory.

    It was discovered that memory contents previously stored in microarchitectural special registers after     RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly     exposed to processes on the same or different processor cores. A local attacker could use this to expose     sensitive information. (CVE-2020-0543)

    Julien Grall discovered that Xen incorrectly handled memory barriers on ARM-based systems. An attacker     could possibly use this issue to cause a denial of service, obtain sensitive information or escalate     privileges. (CVE-2020-11739)

    Ilja Van Sprundel discovered that Xen incorrectly handled profiling of guests. An unprivileged attacker     could use this issue to obtain sensitive information from other guests, cause a denial of service or     possibly gain privileges. (CVE-2020-11740, CVE-2020-11741)

    It was discovered that Xen incorrectly handled grant tables. A malicious guest could possibly use this     issue to cause a denial of service. (CVE-2020-11742, CVE-2020-11743)

    Jan Beulich discovered that Xen incorrectly handled certain code paths. An attacker could possibly use     this issue to cause a denial of service. (CVE-2020-15563)

    Julien Grall discovered that Xen incorrectly verified memory addresses provided by the guest on ARM-based     systems. A malicious guest administrator could possibly use this issue to cause a denial of service.
    (CVE-2020-15564)

    Roger Pau Monn discovered that Xen incorrectly handled caching on x86 Intel systems. An attacker could     possibly use this issue to cause a denial of service. (CVE-2020-15565)

    It was discovered that Xen incorrectly handled error in event-channel port allocation. A malicious guest     could possibly use this issue to cause a denial of service. (CVE-2020-15566)

    Jan Beulich discovered that Xen incorrectly handled certain EPT (Extended Page Tables).

    An attacker could possibly use this issue to cause a denial of service, data corruption or privilege     escalation. (CVE-2020-15567)

    Andrew Cooper discovered that Xen incorrectly handled PCI passthrough. An attacker could possibly use this     issue to cause a denial of service. (CVE-2020-25595)

    Andrew Cooper discovered that Xen incorrectly sanitized path injections. An attacker could possibly use     this issue to cause a denial of service. (CVE-2020-25596)

    Jan Beulich discovered that Xen incorrectly handled validation of event channels. An attacker could     possibly use this issue to cause a denial of service. (CVE-2020-25597)

    Julien Grall and Jan Beulich discovered that Xen incorrectly handled resetting event channels. An attacker     could possibly use this issue to cause a denial of service or obtain sensitive information.
    (CVE-2020-25599)

    Julien Grall discovered that Xen incorrectly handled event channels memory allocation on 32-bits domains.
    An attacker could possibly use this issue to cause a denial of service. (CVE-2020-25600)

    Jan Beulich discovered that Xen incorrectly handled resetting or cleaning up event channels. An attacker     could possibly use this issue to cause a denial of service. (CVE-2020-25601)

    Andrew Cooper discovered that Xen incorrectly handled certain Intel specific MSR (Model Specific     Registers). An attacker could possibly use this issue to cause a denial of service. (CVE-2020-25602)

    Julien Grall discovered that Xen incorrectly handled accessing/allocating event channels. An attacker     could possibly use this issue to cause a denial of service, obtain sensitive information of privilege     escalation. (CVE-2020-25603)

    Igor Druzhinin discovered that Xen incorrectly handled locks. An attacker could possibly use this issue to     cause a denial of service. (CVE-2020-25604)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xen fixes the following issues :

bsc#1174543 - secure boot related fixes

bsc#1163019 - CVE-2020-8608: Potential OOB access due to unsafe snprintf() usages

bsc#1169392 - CVE-2020-11742: Bad continuation handling in GNTTABOP_copy

bsc#1168140 - CVE-2020-11740, CVE-2020-11741: Multiple xenoprof issues

bsc#1168142 - CVE-2020-11739: Missing memory barriers in read-write unlock paths

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks.

This update for xen fixes the following issues :

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1172205).

CVE-2020-11742: Bad continuation handling in GNTTABOP_copy (bsc#1169392).

CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues (bsc#1168140).

CVE-2020-11739: Missing memory barriers in read-write unlock paths (bsc#1168142).

CVE-2019-19583: Fixed improper checks which could have allowed HVM/PVH guest userspace code to crash the guest, leading to a guest denial of service (bsc#1158004 XSA-308).

CVE-2019-19581: Fixed a potential out of bounds on 32-bit Arm (bsc#1158003 XSA-307).

CVE-2019-19580: Fixed a privilege escalation where a malicious PV guest administrator could have been able to escalate their privilege to that of the host (bsc#1158006 XSA-310).

CVE-2019-19579: Fixed a privilege escalation where an untrusted domain with access to a physical device can DMA into host memory (bsc#1157888 XSA-306).

CVE-2019-19578: Fixed an issue where a malicious or buggy PV guest could have caused hypervisor crash resulting in denial of service affecting the entire host (bsc#1158005 XSA-309).

CVE-2019-19577: Fixed an issue where a malicious guest administrator could have caused Xen to access data structures while they are being modified leading to a crash (bsc#1158007 XSA-311).

Xenstored Crashed during VM install (bsc#1167152)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202005-08 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

update to 4.11.4

----

multiple xenoprof issues [XSA-313, CVE-2020-11740, CVE-2020-11741] (#1823912, #1823914) Missing memory barriers in read-write unlock paths [XSA-314, CVE-2020-11739] (#1823784) Bad error path in GNTTABOP_map_grant [XSA-316, CVE-2020-11743] (#1823926) Bad continuation handling in GNTTABOP_copy [XSA-318, CVE-2020-11742] (#1823943)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

Security issues fixed :

  - CVE-2020-11742: Bad continuation handling in     GNTTABOP_copy (bsc#1169392).

  - CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple     xenoprof issues (bsc#1168140).

  - CVE-2020-11739: Missing memory barriers in read-write     unlock paths (bsc#1168142).

  - CVE-2020-11743: Bad error path in GNTTABOP_map_grant     (bsc#1168143).

  - arm: a CPU may speculate past the ERET instruction     (bsc#1160932).

Non-security issues fixed :

  - Xenstored Crashed during VM install (bsc#1167152)

  - DomU hang: soft lockup CPU #0 stuck under high load     (bsc#1165206, bsc#1134506)

  - Update API compatibility versions, fixes issues for     libvirt. (bsc#1167007, bsc#1157490)

  - aacraid blocks xen commands (bsc#1155200)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

multiple xenoprof issues [XSA-313, CVE-2020-11740, CVE-2020-11741] (#1823912, #1823914) Missing memory barriers in read-write unlock paths [XSA-314, CVE-2020-11739] (#1823784) Bad error path in GNTTABOP_map_grant [XSA-316, CVE-2020-11743] (#1823926) Bad continuation handling in GNTTABOP_copy [XSA-318, CVE-2020-11742] (#1823943)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.12.2 fixes the following issues :

Security issues fixed :

CVE-2020-11742: Bad continuation handling in GNTTABOP_copy (bsc#1169392).

CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues (bsc#1168140).

CVE-2020-11739: Missing memory barriers in read-write unlock paths (bsc#1168142).

CVE-2020-11743: Bad error path in GNTTABOP_map_grant (bsc#1168143).

CVE-2020-7211: Fixed potential directory traversal using relative paths via tftp server on Windows host (bsc#1161181).

arm: a CPU may speculate past the ERET instruction (bsc#1160932).

Non-security issues fixed: Xenstored Crashed during VM install (bsc#1167152)

DomU hang: soft lockup CPU #0 stuck under high load (bsc#1165206, bsc#1134506)

Update API compatibility versions, fixes issues for libvirt.
(bsc#1167007, bsc#1157490)

aacraid blocks xen commands (bsc#1155200)

Problems Booting Fedora31 VM on sles15 sp1 Xen Dom0 (bsc#1162040).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

Security issues fixed :

CVE-2020-11742: Bad continuation handling in GNTTABOP_copy (bsc#1169392).

CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues (bsc#1168140).

CVE-2020-11739: Missing memory barriers in read-write unlock paths (bsc#1168142).

CVE-2020-11743: Bad error path in GNTTABOP_map_grant (bsc#1168143).

CVE-2020-7211: Fixed potential directory traversal using relative paths via tftp server on Windows host (bsc#1161181).

arm: a CPU may speculate past the ERET instruction (bsc#1160932).

Non-security issues fixed: Xenstored Crashed during VM install (bsc#1167152)

DomU hang: soft lockup CPU #0 stuck under high load (bsc#1165206, bsc#1134506)

Update API compatibility versions, fixes issues for libvirt.
(bsc#1167007, bsc#1157490)

aacraid blocks xen commands (bsc#1155200)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

Security issues fixed :

CVE-2020-11742: Bad continuation handling in GNTTABOP_copy (bsc#1169392).

CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues (bsc#1168140).

CVE-2020-11739: Missing memory barriers in read-write unlock paths (bsc#1168142).

CVE-2020-11743: Bad error path in GNTTABOP_map_grant (bsc#1168143).

arm: a CPU may speculate past the ERET instruction (bsc#1160932).

Non-security issues fixed :

Xenstored Crashed during VM install (bsc#1167152)

DomU hang: soft lockup CPU #0 stuck under high load (bsc#1165206, bsc#1134506)

Update API compatibility versions, fixes issues for libvirt.
(bsc#1167007, bsc#1157490)

aacraid blocks xen commands (bsc#1155200)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
165248	Ubuntu 20.04 LTS : Xen vulnerabilities (USN-5617-1)	Nessus	Ubuntu Local Security Checks	high
139595	SUSE SLES12 Security Update : xen (SUSE-SU-2020:2234-1)	Nessus	SuSE Local Security Checks	high
138394	Debian DSA-4723-1 : xen - security update	Nessus	Debian Local Security Checks	high
137624	SUSE SLES12 Security Update : xen (SUSE-SU-2020:1630-1)	Nessus	SuSE Local Security Checks	high
136638	GLSA-202005-08 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
136438	Fedora 30 : xen (2020-cbc3149753)	Nessus	Fedora Local Security Checks	high
136312	openSUSE Security Update : xen (openSUSE-2020-599)	Nessus	SuSE Local Security Checks	high
136210	Fedora 31 : xen (2020-295ed0b1e0)	Nessus	Fedora Local Security Checks	high
136164	SUSE SLES12 Security Update : xen (SUSE-SU-2020:1139-1)	Nessus	SuSE Local Security Checks	high
136163	SUSE SLES12 Security Update : xen (SUSE-SU-2020:1138-1)	Nessus	SuSE Local Security Checks	high
136076	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:1124-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-11739

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high