ALT-PU-2018-2108-1
Package kernel-image-un-def updated to version 4.17.13-alt1 for branch sisyphus in task 211122.
Closed vulnerabilities
Published: 2018-07-24
BDU:2019-01344
Уязвимость функции xen_failsafe_callback гипервизора Xen, позволяющая нарушителю вызвать отказ в обслуживании или повысить свои привилегии
Severity: HIGH (7.8)
Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: MEDIUM (6.8)
Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C
References:
Published: 2018-07-28
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2018-14678
An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges.
Severity: HIGH (7.2)
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Severity: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
- http://www.securityfocus.com/bid/104924
- http://www.securitytracker.com/id/1041397
- https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html
- https://usn.ubuntu.com/3931-1/
- https://usn.ubuntu.com/3931-2/
- https://www.debian.org/security/2018/dsa-4308
- https://xenbits.xen.org/xsa/advisory-274.html
- http://www.securityfocus.com/bid/104924
- http://www.securitytracker.com/id/1041397
- https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html
- https://usn.ubuntu.com/3931-1/
- https://usn.ubuntu.com/3931-2/
- https://www.debian.org/security/2018/dsa-4308
- https://xenbits.xen.org/xsa/advisory-274.html