SB2025070903 - Multiple transient execution vulnerabilities in Xen

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Information exposure through microarchitectural state after transient execution (CVE-ID: CVE-2024-36350)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information leak. A local user can obtain sensitive data from previous stores.

2) Information exposure through microarchitectural state after transient execution (CVE-ID: CVE-2024-36357)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information leak. A local user can obtain sensitive data from the L1D cache.

3) Information exposure through microarchitectural state after transient execution (CVE-ID: CVE-2024-36348)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information leak. A local user process can infer the control registers speculatively even if UMIP[3] feature is enabled, potentially resulting in information leakage.

4) Information exposure through microarchitectural state after transient execution (CVE-ID: CVE-2024-36349)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information leak. A local user process can infer TSC_AUX even when such a read is disabled, potentially resulting in information leakage.

Remediation

Install update from vendor's website.

References

• https://xenbits.xen.org/xsa/advisory-471.html