diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 165b0304a4db..56c521f794ba 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,105 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + xen-tools -- virtio: unbounded memory allocation issue + + + xen-tools + 4.7.0_4 + + + + +

The Xen Project reports:

+
+

A guest can submit virtio requests without bothering to wait for + completion and is therefore not bound by virtqueue size...

+

A malicious guest administrator can cause unbounded memory + allocation in QEMU, which can cause an Out-of-Memory condition + in the domain running qemu. Thus, a malicious guest administrator + can cause a denial of service affecting the whole host.

+
+ + + + CVE-2016-5403 + ports/211482 + http://xenbits.xen.org/xsa/advisory-184.html + + + 2016-07-27 + 2016-08-02 + + + + + xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery + + + xen-kernel + 4.54.7.0_3 + + + + +

The Xen Project reports:

+
+

Supervisor Mode Access Prevention is a hardware feature designed + to make an Operating System more robust, by raising a pagefault + rather than accidentally following a pointer into userspace. + However, legitimate accesses into userspace require whitelisting, + and the exception delivery mechanism for 32bit PV guests wasn't + whitelisted.

+

A malicious 32-bit PV guest kernel can trigger a safety check, + crashing the hypervisor and causing a denial of service to other + VMs on the host.

+
+ + + + CVE-2016-6259 + ports/211482 + http://xenbits.xen.org/xsa/advisory-183.html + + + 2016-07-26 + 2016-08-02 + + + + + xen-kernel -- x86: Privilege escalation in PV guests + + + xen-kernel + 4.7.0_3 + + + + +

The Xen Project reports:

+
+

The PV pagetable code has fast-paths for making updates to + pre-existing pagetable entries, to skip expensive re-validation + in safe cases (e.g. clearing only Access/Dirty bits). The bits + considered safe were too broad, and not actually safe.

+

A malicous PV guest administrator can escalate their privilege to + that of the host.

+
+ + + + CVE-2016-6258 + ports/211482 + http://xenbits.xen.org/xsa/advisory-182.html + + + 2016-07-26 + 2016-08-02 + + + libidn -- mulitiple vulnerabilities