[Xen-devel] Xen Security Advisory 172 (CVE-2016-3158, CVE-2016-3159) - broken AMD FPU FIP/FDP/FOP leak workaround

2016-03-29 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-3158,CVE-2016-3159 / XSA-172 version 3 broken AMD FPU FIP/FDP/FOP leak workaround UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 174 (CVE-2016-3961) - hugetlbfs use may crash PV Linux guests

2016-04-14 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-3961 / XSA-174 version 3 hugetlbfs use may crash PV Linux guests UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 173 (CVE-2016-3960) - x86 shadow pagetables: address width overflow

2016-04-18 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-3960 / XSA-173 version 3 x86 shadow pagetables: address width overflow UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION ===

[Xen-devel] Xen Security Advisory 179 (CVE-2016-3710, CVE-2016-3712) - QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks

2016-05-09 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-3710,CVE-2016-3712 / XSA-179 version 4 QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks UPDATES IN VERSION 4 Public release. Also includ

[Xen-devel] Xen Security Advisory 179 (CVE-2016-3710, CVE-2016-3712) - QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks

2016-05-10 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-3710,CVE-2016-3712 / XSA-179 version 5 QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks UPDATES IN VERSION 5 Fixed credits section. Zuoz

[Xen-devel] Xen Security Advisory 176 (CVE-2016-4480) - x86 software guest page walk PS bit handling flaw

2016-05-17 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-4480 / XSA-176 version 3 x86 software guest page walk PS bit handling flaw UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION ===

[Xen-devel] Xen Security Advisory 215 - possible memory corruption via failsafe callback

2017-05-02 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-215 version 2 possible memory corruption via failsafe callback UPDATES IN VERSION 2 Public release. Added email header syntax to patches,

[Xen-devel] Xen Security Advisory 213 - x86: 64bit PV guest breakout via pagetable use-after-mode-change

2017-05-02 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-213 version 2 x86: 64bit PV guest breakout via pagetable use-after-mode-change UPDATES IN VERSION 2 Public release. Added email header syntax to p

[Xen-devel] Xen Security Advisory 214 - grant transfer allows PV guest to elevate privileges

2017-05-02 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-214 version 2 grant transfer allows PV guest to elevate privileges UPDATES IN VERSION 2 Public release. Added email header syntax to patches

[Xen-devel] Xen Security Advisory 214 (CVE-2017-8904) - grant transfer allows PV guest to elevate privileges

2017-05-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-8904 / XSA-214 version 3 grant transfer allows PV guest to elevate privileges UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION

[Xen-devel] Xen Security Advisory 215 (CVE-2017-8905) - possible memory corruption via failsafe callback

2017-05-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-8905 / XSA-215 version 3 possible memory corruption via failsafe callback UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 213 (CVE-2017-8903) - x86: 64bit PV guest breakout via pagetable use-after-mode-change

2017-05-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-8903 / XSA-213 version 3 x86: 64bit PV guest breakout via pagetable use-after-mode-change UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 226 (CVE-2017-12135) - multiple problems with transitive grants

2017-08-17 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-12135 / XSA-226 version 6 multiple problems with transitive grants UPDATES IN VERSION 6 Patches actually addressing the issue have become

[Xen-devel] Xen Security Advisory 235 - add-to-physmap error paths fail to release lock on ARM

2017-08-23 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-235 add-to-physmap error paths fail to release lock on ARM ISSUE DESCRIPTION = When dealing with the grant map space of add-to-physmap operations, ARM specific code recognizes a

[Xen-devel] Xen Security Advisory 226 (CVE-2017-12135) - multiple problems with transitive grants

2017-08-29 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-12135 / XSA-226 version 7 multiple problems with transitive grants UPDATES IN VERSION 7 First patch provided in version 6 regressed 32-bi

[Xen-devel] Xen Security Advisory 239 - hypervisor stack leak in x86 I/O intercept code

2017-10-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-239 version 2 hypervisor stack leak in x86 I/O intercept code UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION = I

[Xen-devel] Xen Security Advisory 241 - Stale TLB entry due to page type release race

2017-10-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-241 version 3 Stale TLB entry due to page type release race UPDATES IN VERSION 3 Fix ARM build issue in patches. Public release. ISSUE

[Xen-devel] Xen Security Advisory 244 - x86: Incorrect handling of IST settings during CPU hotplug

2017-10-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-244 version 2 x86: Incorrect handling of IST settings during CPU hotplug UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION ===

[Xen-devel] Xen Security Advisory 242 - page type reference leak on x86

2017-10-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-242 version 2 page type reference leak on x86 UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION = The page

[Xen-devel] Xen Security Advisory 243 - x86: Incorrect handling of self-linear shadow mappings with translated guests

2017-10-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-243 version 3 x86: Incorrect handling of self-linear shadow mappings with translated guests UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 237 - multiple MSI mapping issues on x86

2017-10-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-237 version 2 multiple MSI mapping issues on x86 UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION = Multiple

[Xen-devel] Xen Security Advisory 238 - DMOP map/unmap missing argument checks

2017-10-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-238 version 2 DMOP map/unmap missing argument checks UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION = DMOPs

[Xen-devel] Xen Security Advisory 235 (CVE-2017-15596) - add-to-physmap error paths fail to release lock on ARM

2017-10-18 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-15596 / XSA-235 version 2 add-to-physmap error paths fail to release lock on ARM UPDATES IN VERSION 2 CVE assigned. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 243 (CVE-2017-15592) - x86: Incorrect handling of self-linear shadow mappings with translated guests

2017-10-18 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-15592 / XSA-243 version 4 x86: Incorrect handling of self-linear shadow mappings with translated guests UPDATES IN VERSION 4 CVE assigned. ISSUE DESCRI

[Xen-devel] Xen Security Advisory 244 (CVE-2017-15594) - x86: Incorrect handling of IST settings during CPU hotplug

2017-10-18 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-15594 / XSA-244 version 3 x86: Incorrect handling of IST settings during CPU hotplug UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION

[Xen-devel] Xen Security Advisory 237 (CVE-2017-15590) - multiple MSI mapping issues on x86

2017-10-18 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-15590 / XSA-237 version 3 multiple MSI mapping issues on x86 UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION = M

[Xen-devel] Xen Security Advisory 242 (CVE-2017-15593) - page type reference leak on x86

2017-10-18 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-15593 / XSA-242 version 3 page type reference leak on x86 UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION = Th

[Xen-devel] Xen Security Advisory 241 (CVE-2017-15588) - Stale TLB entry due to page type release race

2017-10-18 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-15588 / XSA-241 version 4 Stale TLB entry due to page type release race UPDATES IN VERSION 4 CVE assigned. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 239 (CVE-2017-15589) - hypervisor stack leak in x86 I/O intercept code

2017-10-18 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-15589 / XSA-239 version 3 hypervisor stack leak in x86 I/O intercept code UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 236 (CVE-2017-15597) - pin count / page reference race in grant table code

2017-10-24 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-15597 / XSA-236 version 3 pin count / page reference race in grant table code UPDATES IN VERSION 3 We now once again think that only Xen 4.2 a

[Xen-devel] Xen Security Advisory 243 (CVE-2017-15592) - x86: Incorrect handling of self-linear shadow mappings with translated guests

2017-11-15 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-15592 / XSA-243 version 5 x86: Incorrect handling of self-linear shadow mappings with translated guests UPDATES IN VERSION 5 New final patch, addressin

[Xen-devel] Xen Security Advisory 226 (CVE-2017-12135) - multiple problems with transitive grants

2017-08-15 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-12135 / XSA-226 version 5 multiple problems with transitive grants UPDATES IN VERSION 5 Public release. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 229 (CVE-2017-12134) - linux: Fix Xen block IO merge-ability calculation

2017-08-15 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-12134 / XSA-229 version 3 linux: Fix Xen block IO merge-ability calculation UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION

[Xen-devel] Xen Security Advisory 228 (CVE-2017-12136) - grant_table: Race conditions with maptrack free list handling

2017-08-15 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-12136 / XSA-228 version 3 grant_table: Race conditions with maptrack free list handling UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION ===

[Xen-devel] Xen Security Advisory 227 (CVE-2017-12137) - x86: PV privilege escalation via map_grant_ref

2017-08-15 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-12137 / XSA-227 version 3 x86: PV privilege escalation via map_grant_ref UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION ===

[Xen-devel] Xen Security Advisory 230 - grant_table: possibly premature clearing of GTF_writing / GTF_reading

2017-08-15 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-230 version 2 grant_table: possibly premature clearing of GTF_writing / GTF_reading UPDATES IN VERSION 2 Public release. (A CVE request for this iss

[Xen-devel] Xen Security Advisory 230 (CVE-2017-12855) - grant_table: possibly premature clearing of GTF_writing / GTF_reading

2017-08-15 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-12855 / XSA-230 version 3 grant_table: possibly premature clearing of GTF_writing / GTF_reading UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 219 - x86: insufficient reference counts during shadow emulation

2017-06-20 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-219 version 2 x86: insufficient reference counts during shadow emulation UPDATES IN VERSION 2 Public release. Add caveat about exploitability

[Xen-devel] Xen Security Advisory 222 - stale P2M mappings due to insufficient error checking

2017-06-20 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-222 version 2 stale P2M mappings due to insufficient error checking UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 220 - x86: PKRU and BND* leakage between vCPU-s

2017-06-20 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-220 version 2 x86: PKRU and BND* leakage between vCPU-s UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION = Memo

[Xen-devel] Xen Security Advisory 221 - NULL pointer deref in event channel poll

2017-06-20 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-221 version 2 NULL pointer deref in event channel poll UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION = When

[Xen-devel] Xen Security Advisory 225 - arm: vgic: Out-of-bound access when sending SGIs

2017-06-20 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-225 version 2 arm: vgic: Out-of-bound access when sending SGIs UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION = A

[Xen-devel] Xen Security Advisory 217 - page transfer may allow PV guest to elevate privilege

2017-06-20 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-217 version 2 page transfer may allow PV guest to elevate privilege UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 216 - blkif responses leak backend stack data

2017-06-20 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-216 version 3 blkif responses leak backend stack data UPDATES IN VERSION 3 Public release. Fix a typo ("our" for "or" in Vulnerable S

[Xen-devel] Xen Security Advisory 223 - ARM guest disabling interrupt may crash Xen

2017-06-20 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-223 version 2 ARM guest disabling interrupt may crash Xen UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION = Vir

[Xen-devel] Xen Security Advisory 218 - Races in the grant table unmap code

2017-06-20 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-218 version 4 Races in the grant table unmap code UPDATES IN VERSION 4 Adjust last patch description and add review tag. Public rele

[Xen-devel] Xen Security Advisory 216 - blkif responses leak backend stack data

2017-06-20 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-216 version 4 blkif responses leak backend stack data UPDATES IN VERSION 4 Move "For patch:" Reported-by to patches as intended. ISSU

[Xen-devel] Xen Security Advisory 217 (CVE-2017-10912) - page transfer may allow PV guest to elevate privilege

2017-07-07 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-10912 / XSA-217 version 3 page transfer may allow PV guest to elevate privilege UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 216 (CVE-2017-10911) - blkif responses leak backend stack data

2017-07-07 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-10911 / XSA-216 version 5 blkif responses leak backend stack data UPDATES IN VERSION 5 CVE assigned. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 220 (CVE-2017-10916) - x86: PKRU and BND* leakage between vCPU-s

2017-07-07 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-10916 / XSA-220 version 3 x86: PKRU and BND* leakage between vCPU-s UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION

[Xen-devel] Xen Security Advisory 225 (CVE-2017-10923) - arm: vgic: Out-of-bound access when sending SGIs

2017-07-07 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-10923 / XSA-225 version 3 arm: vgic: Out-of-bound access when sending SGIs UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 223 (CVE-2017-10919) - ARM guest disabling interrupt may crash Xen

2017-07-07 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-10919 / XSA-223 version 3 ARM guest disabling interrupt may crash Xen UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION ===

[Xen-devel] Xen Security Advisory 219 (CVE-2017-10915) - x86: insufficient reference counts during shadow emulation

2017-07-07 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-10915 / XSA-219 version 3 x86: insufficient reference counts during shadow emulation UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 221 (CVE-2017-10917) - NULL pointer deref in event channel poll

2017-07-07 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-10917 / XSA-221 version 3 NULL pointer deref in event channel poll UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 222 (CVE-2017-10918) - stale P2M mappings due to insufficient error checking

2017-07-07 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-10918 / XSA-222 version 3 stale P2M mappings due to insufficient error checking UPDATES IN VERSION 3 CVE assigned. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 218 (CVE-2017-10913, CVE-2017-10914) - Races in the grant table unmap code

2017-07-07 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-10913,CVE-2017-10914 / XSA-218 version 5 Races in the grant table unmap code UPDATES IN VERSION 5 CVEs assigned. ISSUE DESCRIPTION

[Xen-devel] Xen Security Advisory 233 (CVE-2017-14317) - cxenstored: Race in domain cleanup

2017-09-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-14317 / XSA-233 version 3 cxenstored: Race in domain cleanup UPDATES IN VERSION 3 Added metadata file Public release. ISSUE DESCRIPT

[Xen-devel] Xen Security Advisory 231 (CVE-2017-14316) - Missing NUMA node parameter verification

2017-09-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-14316 / XSA-231 version 3 Missing NUMA node parameter verification UPDATES IN VERSION 3 Updated metadata file Public release. ISSUE DES

[Xen-devel] Xen Security Advisory 232 (CVE-2017-14318) - Missing check for grant table

2017-09-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-14318 / XSA-232 version 4 Missing check for grant table UPDATES IN VERSION 4 Added metadata file Public release. ISSUE DESCRIPTIO

[Xen-devel] Xen Security Advisory 234 (CVE-2017-14319) - insufficient grant unmapping checks for x86 PV guests

2017-09-12 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory CVE-2017-14319 / XSA-234 version 3 insufficient grant unmapping checks for x86 PV guests UPDATES IN VERSION 3 Added metadata file Public release. ISS

[Xen-devel] Xen Security Advisory 245 - ARM: Some memory not scrubbed at boot

2017-09-28 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Xen Security Advisory XSA-245 ARM: Some memory not scrubbed at boot NOTE REGARDING LACK OF EMBARGO == This bug was discussed publicly before it was realised that it was a security vu

[Xen-devel] Xen Security Advisory 212 (CVE-2017-7228) - x86: broken check in memory_exchange() permits PV guest breakout

2017-04-04 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2017-7228 / XSA-212 version 3 x86: broken check in memory_exchange() permits PV guest breakout UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 186 (CVE-2016-7093) - x86: Mishandling of instruction pointer truncation during emulation

2016-09-08 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-7093 / XSA-186 version 4 x86: Mishandling of instruction pointer truncation during emulation UPDATES IN VERSION 4 Public release. ISSUE DESCRIPTION

[Xen-devel] Xen Security Advisory 185 (CVE-2016-7092) - x86: Disallow L3 recursive pagetable for 32-bit PV guests

2016-09-08 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-7092 / XSA-185 version 3 x86: Disallow L3 recursive pagetable for 32-bit PV guests UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION

[Xen-devel] Xen Security Advisory 188 (CVE-2016-7154) - use after free in FIFO event channel code

2016-09-08 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-7154 / XSA-188 version 3 use after free in FIFO event channel code UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 187 (CVE-2016-7094) - x86 HVM: Overflow of sh_ctxt->seg_reg[]

2016-09-08 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-7094 / XSA-187 version 3 x86 HVM: Overflow of sh_ctxt->seg_reg[] UPDATES IN VERSION 3 Fix the backports xsa187-4.6-0002-*.patch and xsa187-

[Xen-devel] Xen Security Advisory 208 (CVE-2017-2615) - oob access in cirrus bitblt copy

2017-02-10 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2017-2615 / XSA-208 oob access in cirrus bitblt copy ISSUE DESCRIPTION = When doing bitblt copy backwards, qemu should negate the blit width. This avoids an oob access before t

[Xen-devel] Xen Security Advisory 208 (CVE-2017-2615) - oob access in cirrus bitblt copy

2017-02-13 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2017-2615 / XSA-208 version 2 oob access in cirrus bitblt copy UPDATES IN VERSION 2 Included backport for qemu-xen versions 4.7 (and earlier)

[Xen-devel] Xen Security Advisory 207 - memory leak when destroying guest without PT devices

2017-02-15 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory XSA-207 version 2 memory leak when destroying guest without PT devices UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION = C

[Xen-devel] Xen Security Advisory 209 (CVE-2017-2620) - cirrus_bitblt_cputovideo does not check if memory region is safe

2017-02-21 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2017-2620 / XSA-209 version 3 cirrus_bitblt_cputovideo does not check if memory region is safe UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 209 (CVE-2017-2620) - cirrus_bitblt_cputovideo does not check if memory region is safe

2017-02-23 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2017-2620 / XSA-209 version 4 cirrus_bitblt_cputovideo does not check if memory region is safe UPDATES IN VERSION 4 Include a prerequisite patch for qemu-ups

[Xen-devel] Xen Security Advisory 210 - arm: memory corruption when freeing p2m pages

2017-02-23 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory XSA-210 arm: memory corruption when freeing p2m pages ISSUE DESCRIPTION = When freeing pages used for stage-2 page tables, the freeing routine failed to remove these pages from a

[Xen-devel] Xen Security Advisory 193 (CVE-2016-9385) - x86 segment base write emulation lacking canonical address checks

2016-11-22 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-9385 / XSA-193 version 3 x86 segment base write emulation lacking canonical address checks UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 192 (CVE-2016-9382) - x86 task switch to VM86 mode mis-handled

2016-11-22 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-9382 / XSA-192 version 3 x86 task switch to VM86 mode mis-handled UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 194 (CVE-2016-9384) - guest 32-bit ELF symbol table load leaking host data

2016-11-22 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-9384 / XSA-194 version 3 guest 32-bit ELF symbol table load leaking host data UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 191 (CVE-2016-9386) - x86 null segments not always treated as unusable

2016-11-22 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-9386 / XSA-191 version 3 x86 null segments not always treated as unusable UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 198 (CVE-2016-9379, CVE-2016-9380) - delimiter injection vulnerabilities in pygrub

2016-11-22 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-9379,CVE-2016-9380 / XSA-198 version 3 delimiter injection vulnerabilities in pygrub UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION

[Xen-devel] Xen Security Advisory 197 (CVE-2016-9381) - qemu incautious about shared ring processing

2016-11-22 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-9381 / XSA-197 version 3 qemu incautious about shared ring processing UPDATES IN VERSION 3 Added email header syntax to patches, for e.g. git-

[Xen-devel] Xen Security Advisory 196 (CVE-2016-9377, CVE-2016-9378) - x86 software interrupt injection mis-handled

2016-11-22 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-9377,CVE-2016-9378 / XSA-196 version 3 x86 software interrupt injection mis-handled UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 195 (CVE-2016-9383) - x86 64-bit bit test instruction emulation broken

2016-11-22 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-9383 / XSA-195 version 3 x86 64-bit bit test instruction emulation broken UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 201 - ARM guests may induce host asynchronous abort

2016-11-29 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory XSA-201 ARM guests may induce host asynchronous abort ISSUE DESCRIPTION = Depending on how the hardware and firmware have been integrated, guest-triggered asynchronous aborts (SE

[Xen-devel] Xen Security Advisory 199 (CVE-2016-9637) - qemu ioport array overflow

2016-12-06 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-9637 / XSA-199 version 3 qemu ioport array overflow UPDATES IN VERSION 3 Clarify the IMPACT description, by escalating privilege to t

[Xen-devel] Xen Security Advisory 201 (CVE-2016-9815, CVE-2016-9816, CVE-2016-9817, CVE-2016-9818) - ARM guests may induce host asynchronous abort

2016-12-07 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-9815,CVE-2016-9816,CVE-2016-9817,CVE-2016-9818 / XSA-201 version 2 ARM guests may induce host asynchronous abort UPDATES IN VERSION 2 CVEs assigned. IS

[Xen-devel] Xen Security Advisory 182 (CVE-2016-6258) - x86: Privilege escalation in PV guests

2016-07-26 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-6258 / XSA-182 version 3 x86: Privilege escalation in PV guests UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 183 (CVE-2016-6259) - x86: Missing SMAP whitelisting in 32-bit exception / event delivery

2016-07-26 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-6259 / XSA-183 version 5 x86: Missing SMAP whitelisting in 32-bit exception / event delivery UPDATES IN VERSION 5 Public release. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 184 (CVE-2016-5403) - virtio: unbounded memory allocation issue

2016-07-27 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-5403 / XSA-184 version 2 virtio: unbounded memory allocation issue UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 200 (CVE-2016-9932) - x86 CMPXCHG8B emulation fails to ignore operand size override

2016-12-13 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-9932 / XSA-200 version 3 x86 CMPXCHG8B emulation fails to ignore operand size override UPDATES IN VERSION 3 CVE assigned. Public release. ISSUE DESC

[Xen-devel] Xen Security Advisory 204 - x86: Mishandling of SYSCALL singlestep during emulation

2016-12-19 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory XSA-204 x86: Mishandling of SYSCALL singlestep during emulation ISSUE DESCRIPTION = The typical behaviour of singlestepping exceptions is determined at the start of the instruction, w

[Xen-devel] Xen Security Advisory 204 (CVE-2016-10013) - x86: Mishandling of SYSCALL singlestep during emulation

2016-12-19 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-10013 / XSA-204 version 2 x86: Mishandling of SYSCALL singlestep during emulation UPDATES IN VERSION 2 CVE assigned. ISSUE DESCRIPTION ===

[Xen-devel] Xen Security Advisory 203 (CVE-2016-10025) - x86: missing NULL pointer check in VMFUNC emulation

2016-12-21 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-10025 / XSA-203 version 3 x86: missing NULL pointer check in VMFUNC emulation UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 202 (CVE-2016-10024) - x86 PV guests may be able to mask interrupts

2016-12-21 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-10024 / XSA-202 version 3 x86 PV guests may be able to mask interrupts UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 190 (CVE-2016-7777) - CR0.TS and CR0.EM not always honored for x86 HVM guests

2016-10-04 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016- / XSA-190 version 5 CR0.TS and CR0.EM not always honored for x86 HVM guests UPDATES IN VERSION 5 Public release. ISSUE DESCRIPTION ==

[Xen-devel] Xen Security Advisory 211 (CVE-2016-9603) - Cirrus VGA Heap overflow via display refresh

2017-03-14 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-9603 / XSA-211 version 2 Cirrus VGA Heap overflow via display refresh UPDATES IN VERSION 2 Patches for qemu-xen-traditional. Public release.

[Xen-devel] Xen Security Advisory 156 (CVE-2015-5307, CVE-2015-8104) - x86: CPU lockup during exception delivery

2015-11-09 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2015-5307,CVE-2015-8104 / XSA-156 version 2 x86: CPU lockup during exception delivery UPDATES IN VERSION 2 Minor title and text adjustment. CVE-2015-81

[Xen-devel] Xen Security Advisory 163 - virtual PMU is unsupported

2015-11-24 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory XSA-163 virtual PMU is unsupported ISSUE DESCRIPTION = The Virtual Performance Measurement Unit feature has been documented as unsupported, so far only on Intel CPUs. F

[Xen-devel] Xen Security Advisory 161 - WITHDRAWN: missing XSETBV intercept privilege check on AMD SVM

2015-11-25 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory XSA-161 version 2 WITHDRAWN: missing XSETBV intercept privilege check on AMD SVM UPDATES IN VERSION 2 Upon further inspection the necessary privilege le

[Xen-devel] Xen Security Advisory 135 (CVE-2015-3209) - Heap overflow in QEMU PCNET controller, allowing guest->host escape

2015-06-10 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2015-3209 / XSA-135 version 3 Heap overflow in QEMU PCNET controller, allowing guest->host escape UPDATES IN VERSION 3 Public release. ISSUE DESCRIPTION =

[Xen-devel] Xen Security Advisory 136 (CVE-2015-4164) - vulnerability in the iret hypercall handler

2015-06-11 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2015-4164 / XSA-136 version 3 vulnerability in the iret hypercall handler UPDATES IN VERSION 3 Public release. Added email header syntax to patch

[Xen-devel] Xen Security Advisory 134 (CVE-2015-4163) - GNTTABOP_swap_grant_ref operation misbehavior

2015-06-11 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2015-4163 / XSA-134 version 3 GNTTABOP_swap_grant_ref operation misbehavior UPDATES IN VERSION 3 Public release. Added email header syntax to patc

[Xen-devel] Xen Security Advisory 171 (CVE-2016-3157) - I/O port access privilege escalation in x86-64 Linux

2016-03-19 Thread Xen . org security team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Xen Security Advisory CVE-2016-3157 / XSA-171 version 4 I/O port access privilege escalation in x86-64 Linux UPDATES IN VERSION 4 Clarify Vulnerable Systems section. Public rel

  1   2   >