Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

SUSE: 2021:2957-1 Important: Multiple Xen Security Fixes - DoS

suse
Calendar Grey September 6, 2021
Scroller Suse
SUSE rolled out an essential patch for xen, tackling 13 problems, which encompasses vulnerabilities that could lead to information leaks as well as specific fix notes.
An update that fixes 13 vulnerabilities is now available

Summary

This update for xen fixes the following issues: - CVE-2021-3594: slirp: invalid pointer initialization may lead to information disclosure (udp)(bsc#1187378). - CVE-2021-3595: slirp: invalid pointer initialization may lead to information disclosure (tftp)(bsc#1187376). - CVE-2021-28698: long running loops in grant table handling (XSA-380)(bsc#1189378). - CVE-2021-28699: inadequate grant-v2 status frames array bounds check (XSA-382)(bsc#1189380). - CVE-2021-20255: Fixed stack overflow via infinite recursion in eepro100 (bsc#1182654) - CVE-2021-28690: xen: x86: TSX Async Abort protections not restored after S3 (bsc#1186434) - CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling (bsc#1186429) - CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: IOMMU page mapping issues

Topics%20covered

Topics Covered

security advisory important information disclosure xen SUSE Linux Enterprise

References

#1182654 #1186429 #1186433 #1186434 #1187369

#1187376 #1187378 #1189373 #1189376 #1189378

#1189380 #1189882

Cross- CVE-2021-0089 CVE-2021-20255 CVE-2021-28690

CVE-2021-28692 CVE-2021-28694 CVE-2021-28695

CVE-2021-28696 CVE-2021-28697 CVE-2021-28698

CVE-2021-28699 CVE-2021-3592 CVE-2021-3594

CVE-2021-3595

CVSS scores:

CVE-2021-0089 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE-2021-20255 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2021-20255 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L

CVE-2021-28694 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2021-28695 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2021-28696 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:2957-1
Rating: important

Topics%20covered

Topics Covered

security advisory important information disclosure xen SUSE Linux Enterprise

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.