SB2025080601 - Fedora 42 update for xen

Security Bulletin ID SB2025080601

Severity

Medium

Patch available

YES

Number of vulnerabilities 3

Exploitation vector Remote access

Highest impact Denial of service

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Improper error handling (CVE-ID: CVE-2025-27465)

The vulnerability allows a local guest to crash the hypervisor.

The vulnerability exists die to incorrect stubs exception handling for flags recovery. A malicious guest can force the hypervisor to crash.

2) Information exposure through microarchitectural state after transient execution (CVE-ID: CVE-2024-36350)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information leak. A local user can obtain sensitive data from previous stores.

3) Information exposure through microarchitectural state after transient execution (CVE-ID: CVE-2024-36357)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information leak. A local user can obtain sensitive data from the L1D cache.

Install update from vendor's website.