Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 492
Alerts This Week
Warning Icon 1 492

SUSE: 2016:3044-1 Important: Xen Privilege Escalation Threats

suse
Calendar Grey December 7, 2016
Scroller Suse
SUSE Security Update 2023:4056-2 addresses 12 critical issues in libvirt. Read patch guidelines here.
An update that fixes 14 vulnerabilities is now available

Summary

xen was updated to fix several security issues. These security issues were fixed: - CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652). - CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100) - CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103)

Topics%20covered

Topics Covered

security advisory critical issue software patch privilege escalation SUSE Linux xen update

References

#1000106 #1000893 #1003030 #1003032 #1005004

#1005005 #1007157 #1009100 #1009103 #1009107

#1009109 #1009111 #1011652 #990843

Cross- CVE-2016-6351 CVE-2016-7777 CVE-2016-7908

CVE-2016-7909 CVE-2016-8667 CVE-2016-8669

CVE-2016-8910 CVE-2016-9379 CVE-2016-9380

CVE-2016-9381 CVE-2016-9382 CVE-2016-9383

CVE-2016-9386 CVE-2016-9637

Affected Products:

SUSE Linux Enterprise Server 11-SP2-LTSS

SUSE Linux Enterprise Debuginfo 11-SP2

https://www.suse.com/security/cve/CVE-2016-6351.html

https://www.suse.com/security/cve/CVE-2016-7777.html

https://www.suse.com/security/cve/CVE-2016-7908.html

https://www.suse.com/security/cve/CVE-2016-7909.html

https://www.suse.com/security/cve/CVE-2016-8667.html

https://www.suse.com/security/cve/CVE-2016-8669.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2016:3044-1
Rating: important

Topics%20covered

Topics Covered

security advisory critical issue software patch privilege escalation SUSE Linux xen update

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.