Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 513
Alerts This Week
Warning Icon 1 513

SUSE: 2021:2943-1 Critical: Xen Security Issues and Fixes

suse
Calendar Grey September 3, 2021
Scroller Suse
SUSE rolls out a significant patch for xen, targeting several vulnerabilities and strengthening overall security measures.
An update that fixes 9 vulnerabilities is now available

Summary

This update for xen fixes the following issues: - CVE-2021-28698: long running loops in grant table handling (XSA-380)(bsc#1189378). - CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling (bsc#1186429). - CVE-2021-0089: xen: Speculative Code Store Bypass (bsc#1186433). - CVE-2021-28699: inadequate grant-v2 status frames array bounds check (XSA-382)(bsc#1189380). - CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373). - CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation (XSA-379)(bsc#1189376). - CVE-2021-28690: xen: x86: TSX Async Abort protections not restored after S3 (bsc#1186434). - Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882). Patch Instructions:

Topics%20covered

Topics Covered

security advisory security issue critical software update important xen SUSE Linux Enterprise

References

#1186429 #1186433 #1186434 #1189373 #1189376

#1189378 #1189380 #1189882

Cross- CVE-2021-0089 CVE-2021-28690 CVE-2021-28692

CVE-2021-28694 CVE-2021-28695 CVE-2021-28696

CVE-2021-28697 CVE-2021-28698 CVE-2021-28699

CVSS scores:

CVE-2021-0089 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE-2021-28694 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2021-28695 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2021-28696 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2021-28697 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2021-28698 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2021-28699 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:2943-1
Rating: important

Topics%20covered

Topics Covered

security advisory security issue critical software update important xen SUSE Linux Enterprise

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.