SUSE-SU-2017:2541-1

    Dashboard / Vulnerabilities / SUSE-SU-2017:2541-1

    SUSE-SU-2017:2541-1

    Published: 21 Sept 2017Last Modified: 4 Feb 2026

    Summary: Security update for xen

    Details: This update for xen fixes several issues. These security issues were fixed: - CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious guest to crash the host or potentially escalate privileges/leak information (XSA-226, bsc#1051787). - CVE-2017-12137: Incorrectly-aligned updates to pagetables allowed for privilege escalation (XSA-227, bsc#1051788). - CVE-2017-11334: The address_space_write_continue function in exec.c allowed local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area (bsc#1048920). - CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP options string (bsc#1049578). - CVE-2017-10806: Stack-based buffer overflow in hw/usb/redirect.c allowed local guest OS users to cause a denial of service via vectors related to logging debug messages (bsc#1047675). - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt (bsc#1046637). - CVE-2017-12855: Premature clearing of GTF_writing / GTF_reading lead to potentially leaking sensitive information (XSA-230, bsc#1052686). - CVE-2017-14316: Missing bound check in function `alloc_heap_pages` for an internal array allowed attackers using crafted hypercalls to execute arbitrary code within Xen (XSA-231, bsc#1056278) - CVE-2017-14317: A race in cxenstored may have cause a double-free allowind for DoS of the xenstored daemon (XSA-233, bsc#1056281). - CVE-2017-14319: An error while handling grant mappings allowed malicious or buggy x86 PV guest to escalate its privileges or crash the hypervisor (XSA-234, bsc#1056282). These non-security issues were fixed: - bsc#1002573: Optimized LVM functions in block-dmmd block-dmmd - bsc#1032598: Prevent removal of NVME devices - bsc#1037413: Support for newer intel cpu's, mwait-idle driver and skylake

    References: https://www.suse.com/support/update/announcement/2017/suse-su-20172541-1/, https://bugzilla.suse.com/1002573, https://bugzilla.suse.com/1027519, https://bugzilla.suse.com/1032598, https://bugzilla.suse.com/1037413, https://bugzilla.suse.com/1046637, https://bugzilla.suse.com/1047675, https://bugzilla.suse.com/1048920, https://bugzilla.suse.com/1049578, https://bugzilla.suse.com/1051787, https://bugzilla.suse.com/1051788, https://bugzilla.suse.com/1052686, https://bugzilla.suse.com/1056278, https://bugzilla.suse.com/1056281, https://bugzilla.suse.com/1056282, https://www.suse.com/security/cve/CVE-2017-10664, https://www.suse.com/security/cve/CVE-2017-10806, https://www.suse.com/security/cve/CVE-2017-11334, https://www.suse.com/security/cve/CVE-2017-11434, https://www.suse.com/security/cve/CVE-2017-12135, https://www.suse.com/security/cve/CVE-2017-12137, https://www.suse.com/security/cve/CVE-2017-12855, https://www.suse.com/security/cve/CVE-2017-14316, https://www.suse.com/security/cve/CVE-2017-14317, https://www.suse.com/security/cve/CVE-2017-14319

    Affected packages

    Package

    Name: xen

    Purl: pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.4.4_22-22.51.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2017:2541-1 | CVE-DB