SB2015062902 - SUSE Linux update for Xen

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2015-3209)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-4103)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.

3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-4104)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors.

4) Resource management error (CVE-ID: CVE-2015-4105)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service (host disk consumption) via certain invalid operations.

5) Improper access control (CVE-ID: CVE-2015-4106)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors.

6) Input validation error (CVE-ID: CVE-2015-4163)

The vulnerability allows local guest domains to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (NULL pointer dereference) via a hypercall without a GNTTABOP_setup_table or GNTTABOP_set_version.

7) Resource management error (CVE-ID: CVE-2015-4164)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop and system hang) via a hypercall_iret call with EFLAGS.VM set.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html