Linux Security
    Linux Security
    Linux Security

    Fedora 32: xen 2020-df772b417b

    Date 24 Dec 2020
    429
    Posted By LinuxSecurity Advisories
    xenstore watch notifications lacking permission checks [XSA-115, CVE-2020-29480] (#1908091) Xenstore: new domains inheriting existing node permissions [XSA-322, CVE-2020-29481] (#1908095) Xenstore: wrong path length check [XSA-323, CVE-2020-29482] (#1908096) Xenstore: guests can crash xenstored via watchs [XSA-324, CVE-2020-29484] (#1908088) Xenstore: guests can disturb domain cleanup
    --------------------------------------------------------------------------------
    Fedora Update Notification
    FEDORA-2020-df772b417b
    2020-12-25 01:25:28.437759
    --------------------------------------------------------------------------------
    
    Name        : xen
    Product     : Fedora 32
    Version     : 4.13.2
    Release     : 5.fc32
    URL         : https://xen.org/
    Summary     : Xen is a virtual machine monitor
    Description :
    This package contains the XenD daemon and xm command line
    tools, needed to manage virtual machines running under the
    Xen hypervisor
    
    --------------------------------------------------------------------------------
    Update Information:
    
    xenstore watch notifications lacking permission checks [XSA-115, CVE-2020-29480]
    (#1908091) Xenstore: new domains inheriting existing node permissions [XSA-322,
    CVE-2020-29481] (#1908095) Xenstore: wrong path length check [XSA-323,
    CVE-2020-29482] (#1908096) Xenstore: guests can crash xenstored via watchs
    [XSA-324, CVE-2020-29484] (#1908088) Xenstore: guests can disturb domain cleanup
    [XSA-325, CVE-2020-29483] (#1908087) oxenstored memory leak in reset_watches
    [XSA-330, CVE-2020-29485] (#1908000) undue recursion in x86 HVM context switch
    code [XSA-348, CVE-2020-29566] (#1908085) oxenstored: node ownership can be
    changed by unprivileged clients [XSA-352, CVE-2020-29486] (#1908003) oxenstored:
    permissions not checked on root node [XSA-353, CVE-2020-29479] (#1908002) FIFO
    event channels control block related ordering [XSA-358, CVE-2020-29570]
    (#1907931) FIFO event channels control structure ordering [XSA-359,
    CVE-2020-29571] (#1908089)
    --------------------------------------------------------------------------------
    ChangeLog:
    
    * Wed Dec 16 2020 Michael Young  - 4.13.2-5
    - xenstore watch notifications lacking permission checks [XSA-115,
    	CVE-2020-29480] (#1908091)
    - Xenstore: new domains inheriting existing node permissions [XSA-322,
    	CVE-2020-29481] (#1908095)
    - Xenstore: wrong path length check [XSA-323, CVE-2020-29482] (#1908096)
    - Xenstore: guests can crash xenstored via watchs [XSA-324, CVE-2020-29484]
    	(#1908088)
    - Xenstore: guests can disturb domain cleanup [XSA-325, CVE-2020-29483]
    	(#1908087)
    - oxenstored memory leak in reset_watches [XSA-330, CVE-2020-29485]
    	(#1908000)
    - undue recursion in x86 HVM context switch code [XSA-348, CVE-2020-29566]
    	(#1908085)
    - oxenstored: node ownership can be changed by unprivileged clients
    	[XSA-352, CVE-2020-29486] (#1908003)
    - oxenstored: permissions not checked on root node [XSA-353, CVE-2020-29479]
    	(#1908002)
    - FIFO event channels control block related ordering [XSA-358,
    	CVE-2020-29570] (#1907931)
    - FIFO event channels control structure ordering [XSA-359, CVE-2020-29571]
    	(#1908089)
    --------------------------------------------------------------------------------
    References:
    
      [ 1 ] Bug #1905623 - CVE-2020-29485 xen: oxenstored memory leak in reset_watches (XSA-330)
            https://bugzilla.redhat.com/show_bug.cgi?id=1905623
      [ 2 ] Bug #1905626 - CVE-2020-29482 xen: Xenstore: wrong path length check (XSA-323)
            https://bugzilla.redhat.com/show_bug.cgi?id=1905626
      [ 3 ] Bug #1905632 - CVE-2020-29481 xen: Xenstore: new domains inheriting existing node permissions (XSA-322)
            https://bugzilla.redhat.com/show_bug.cgi?id=1905632
      [ 4 ] Bug #1905635 - CVE-2020-29484 xen: Xenstore: guests can crash xenstored via watchs (XSA-324)
            https://bugzilla.redhat.com/show_bug.cgi?id=1905635
      [ 5 ] Bug #1905648 - CVE-2020-29483 xen: Xenstore: guests can disturb domain cleanup (XSA-325)
            https://bugzilla.redhat.com/show_bug.cgi?id=1905648
      [ 6 ] Bug #1905652 - CVE-2020-29486 xen: oxenstored: node ownership can be changed by unprivileged clients (XSA-352)
            https://bugzilla.redhat.com/show_bug.cgi?id=1905652
      [ 7 ] Bug #1905668 - CVE-2020-29479 xen: oxenstored: permissions not checked on root node (XSA-353)
            https://bugzilla.redhat.com/show_bug.cgi?id=1905668
      [ 8 ] Bug #1905669 - CVE-2020-29566 xen: undue recursion in x86 HVM context switch code (XSA-348)
            https://bugzilla.redhat.com/show_bug.cgi?id=1905669
      [ 9 ] Bug #1905672 - CVE-2020-29480 xen: xenstore watch notifications lacking permission checks (XSA-115)
            https://bugzilla.redhat.com/show_bug.cgi?id=1905672
      [ 10 ] Bug #1905675 - CVE-2020-29570 xen: FIFO event channels control block related ordering (XSA-358)
            https://bugzilla.redhat.com/show_bug.cgi?id=1905675
      [ 11 ] Bug #1905676 - CVE-2020-29571 xen: FIFO event channels control structure ordering
            https://bugzilla.redhat.com/show_bug.cgi?id=1905676
    --------------------------------------------------------------------------------
    
    This update can be installed with the "dnf" update program. Use
    su -c 'dnf upgrade --advisory FEDORA-2020-df772b417b' at the command
    line. For more information, refer to the dnf documentation available at
    https://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
    
    All packages are signed with the Fedora Project GPG key. More details on the
    GPG keys used by the Fedora Project can be found at
    https://fedoraproject.org/keys
    --------------------------------------------------------------------------------
    _______________________________________________
    package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it.
    To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it.
    Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
    List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
    List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it.
    

    LinuxSecurity Poll

    'Tis the season of giving! How have you given back to the open-source community?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/49-tis-the-season-of-giving-how-have-you-given-back-to-the-open-source-community?task=poll.vote&format=json
    49
    radio
    [{"id":"171","title":"I've contributed to the development of an open-source project.","votes":"22","type":"x","order":"1","pct":34.92,"resources":[]},{"id":"172","title":"I've reviewed open-source code for security bugs.","votes":"13","type":"x","order":"2","pct":20.63,"resources":[]},{"id":"173","title":"I've made a donation to an open-source project.","votes":"28","type":"x","order":"3","pct":44.44,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

    Please vote first in order to view vote results.


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.