Xen - Security Update (DLA-479-1)
Summary
DLA-479-1: xen - security update. Affects xen versions < 4.1.6.1-1+deb7u1. Fixed in 4.1.6.1-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Xen is a virtual machine monitor for x86-compatible computers. It allows multiple operating systems to run concurrently on a single physical computer. This vulnerability affects Xen in Debian 7 Wheezy. The impacted package is xen and the version that fixes the vulnerability is 4.1.6.1-1+deb7u1.
Vulnerability Detail
The Xen DOMCTL memory mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptable. This allows local x86 HVM domain users to cause a denial of service (host CPU consumption) by sending a crafted request to the device model (qemu-dm). Additionally, QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers. This might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling memory or I/O decoding for a PCI Express device and then accessing the device, triggering an Unsupported Request (UR) response. Other vulnerabilities include memory leaks, denial of service via #AC exceptions, memory consumption, host OS panic or hang, and more.
How To Fix
Minimum fixed version
4.1.6.1-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade xenTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This security update addresses multiple vulnerabilities in Xen. It is crucial to upgrade the libidn package to the fixed version to mitigate the risks associated with these vulnerabilities. For more information and assistance, please contact DevNack.com.
See every vulnerability recorded for xen →
FAQ
The impact of this vulnerability varies depending on the specific issue. It can range from denial of service attacks to memory leaks and privilege escalation.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it in real-time.
There are no specific workarounds mentioned for this vulnerability. It is recommended to upgrade the libidn package to the fixed version.
You can find more information about this vulnerability, including the CVE identifiers, in the Debian Security Tracker (https://security-tracker.debian.org/tracker/CVE-2015-2752).
For further support on vulnerability remediation, you can reach out to info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for xen.
