SB2022091922 - Ubuntu update for xen
Published: September 19, 2022 Updated: October 19, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 20 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2020-0543)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to incomplete cleanup from specific special register read operations in some Intel(R) Processors. A local user can gain unauthorized access to sensitive information on the system.
2) Buffer overflow (CVE-ID: CVE-2020-11739)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the "critical" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS).3) Information disclosure (CVE-ID: CVE-2020-11740)
The vulnerability allows a remote user to gain access to potentially sensitive information.
An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers, even if profiling has not been enabled for those guests.
4) Missing Authorization (CVE-ID: CVE-2020-11741)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
An issue was discovered in xenoprof in Xen through 4.13.x, allowing
guest OS users (with active profiling) to obtain sensitive information
about other guests, cause a denial of service, or possibly gain
privileges. For guests for which "active" profiling
was enabled by the administrator, the xenoprof code uses the standard
Xen shared ring structure. Unfortunately, this code did not treat the
guest as a potential adversary: it trusts the guest not to modify buffer
size information or modify head / tail pointers in unexpected ways. A remote user can perform a denial of service (DoS) attack.
5) Unchecked Return Value (CVE-ID: CVE-2020-11742)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to introduction of unexpected behavior in the fix for CVE-2017-1213 that caused bad continuation handling in GNTTABOP_copy. A remote user can crash the hypervisor.
6) Improper Handling of Exceptional Conditions (CVE-ID: CVE-2020-11743)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant table operations are expected to return 0 for success, and a negative number for errors. Some misplaced brackets cause one error path to return 1 instead of a negative value. The grant table code in Linux treats this condition as success, and proceeds with incorrectly initialised state. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to map a grant, it hits the incorrect error path. This will crash a Linux based dom0 or backend domain.
7) Untrusted Pointer Dereference (CVE-ID: CVE-2020-15563)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to inverted code paths in x86 dirty VRAM tracking in Xen. An attacker with access to HVM guest operating system can crash the hypervisor.
Note: the vulnerability affects x86 systems only.
8) Resource management error (CVE-ID: CVE-2020-15564)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to missing alignment check in VCPUOP_register_vcpu_info hypercall in Xen. A attacker with privileged access to guest operating system can crash the hypervisor.
Note: the vulnerability affects Arm systems only.
9) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-15565)
The vulnerability allows a remote attacker to escalate privileges on the system or perform a denial of service attack.
The vulnerability exists due to application does not properly impose security restrictions. When page tables are shared between IOMMU and CPU, changes to them require flushing of both TLBs. Furthermore, IOMMUs may be non-coherent, and hence prior to flushing IOMMU TLBs, a CPU cache also needs writing back to memory after changes were made. Such writing back of cached data was missing in particular when splitting large page mappings into smaller granularity ones. A malicious guest may be able to retain read/write DMA access to frames returned to Xen's free pool, and later reused for another purpose.
Successful exploitation of the vulnerability may allows privileges escalation on the host operating system.
Note: the vulnerability affects Intel x86 systems only.
10) Resource management error (CVE-ID: CVE-2020-15566)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper error handling in event-channel port allocation in Xen. An attacker with access to guest operating system can consume more than 1023 event channels and crash the hypervisor.
11) Race condition (CVE-ID: CVE-2020-15567)
The vulnerability allows a remote attacker to escalate privileges on the system.
Note: the vulnerability can be exploited only on systems with Intel processors.
12) Use of uninitialized resource (CVE-ID: CVE-2020-25595)
The vulnerability allows a remote user to escalate privileges on the host operating system.
The vulnerability exists due to PCI passthrough code reading back untrusted values fromhardware registers in Xen. A remote user on a guest operating system can run a specially crafted program to obtain potentially sensitive information from memory and crash Xen or escalate privileges on the hypervisor.
The vulnerability affects x86 systems with PCI passthrough support.
13) Resource management error (CVE-ID: CVE-2020-25596)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within guest VM when processing state sanitization activities. A local user or application on the guest operating system can abuse SYSENTER to cause a crash of the guest VM.
14) Resource management error (CVE-ID: CVE-2020-25597)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due a login error in the handling of event channel operations in Xen, which assumes that an event channel, once valid, will not become invalid over the life time of a guest.An unprivileged guest may be able to crash Xen by resetting of all event channels.
15) Race condition (CVE-ID: CVE-2020-25599)
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to a race condition caused by uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCTL_soft_reset (by itself covered by XSA-77). A remote user on the PV guest can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the host system.
16) Resource management error (CVE-ID: CVE-2020-25600)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to the so called 2-level event channel model imposes different limits on the number of usable event channels for 32-bit x86 domains vs 64-bit or Arm (either bitness) ones. 32-bit x86 domains can use only 1023 channels, due to limited space in their shared (between guest and Xen) information structure, whereas all other domains can use up to 4095 in this model. The recording of the respective limit during domain initialization, however, has occurred at a time where domains are still deemed to be 64-bit ones, prior to actually honoring respective domain properties. At the point domains get recognized as 32-bit ones, the limit didn't get updated accordingly.
Due to this misbehavior in Xen, 32-bit domains (including Domain 0) servicing other domains may observe event channel allocations to succeed when they should really fail. Subsequent use of such event channels would then possibly lead to corruption of other parts of the shared info structure.
As a result, an unprivileged guest may cause another domain, in particular Domain 0, to misbehave, leading to denial of service of the host system.
17) Resource exhaustion (CVE-ID: CVE-2020-25601)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the application, as the FIFO event channel model allows guests to have a large number of event channels active at a time. Closing all of these when resetting all event channels or when cleaning up after the guest may take extended periods of time. So far there was no arrangement for preemption at suitable intervals, allowing a CPU to spend an almost unbounded amount of time in the processing of these operations. A remote user can consume all available CPU resources and perform a denial of service (DoS) attack of the entire host system.18) Resource management error (CVE-ID: CVE-2020-25602)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the application when processing guest requests to the "MISC_ENABLE MSR" register in Xen. A remote privileged PV guest can run a specially crafted program and crash Xen.
Only non-non-Intel x86 systems are affected.
19) Resource management error (CVE-ID: CVE-2020-25603)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to event channels control structures can be accessed lockless as long as the port is considered to be valid. Such sequence is missing appropriate memory barrier (e.g smp_*mb()) to prevent both the compiler and CPU to re-order access. A malicious guest may be able to cause a hypervisor crash.
20) Race condition (CVE-ID: CVE-2020-25604)
The vulnerability allows a remote user to perform a denial of service (Dos) attack.
The vulnerability exists due to a race condition when migrating timers between x86 HVM vCPU-s in Xen. A remote user on a guest operating system can run a specially crafted program to crash the hypervisor.
Remediation
Install update from vendor's website.