Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

SUSE 15 SP6: 2024-4163-1 important: xen deadlock and data leak

suse
Calendar Grey December 4, 2024
Dist Suse Esm H88
SUSE has issued a crucial security patch for Xen, tackling serious vulnerabilities that necessitate a system reboot following the update's implementation.
* bsc#1027519 * bsc#1230366 * bsc#1232542 * bsc#1232622 * bsc#1232624

Summary

## This update for xen fixes the following issues: Security issues fixed: * CVE-2024-45818: xen: Deadlock in x86 HVM standard VGA handling (bsc#1232622) * CVE-2024-45819: xen: libxl leaks data to PVH guests via ACPI tables (bsc#1232624) * CVE-2024-45817: xen: x86: Deadlock in vlapic_error() (bsc#1230366) Non-security issues fixed: * Removed usage of net-tools-deprecated from supportconfig plugin (bsc#1232542) * Upstream bug fixes (bsc#1027519)

Topics%20covered

Topics Covered

security advisory DoS important SUSE deadlock data leakage xen

References

* bsc#1027519

* bsc#1230366

* bsc#1232542

* bsc#1232622

* bsc#1232624

Cross-

* CVE-2024-45817

* CVE-2024-45818

* CVE-2024-45819

CVSS scores:

* CVE-2024-45817 ( SUSE ): 6.9

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2024-45817 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2024-45818 ( SUSE ): 8.2

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

* CVE-2024-45818 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

* CVE-2024-45819 ( SUSE ): 6.8

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

* CVE-2024-45819 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Products:

* Basesystem Module 15-SP6

* openSUSE Leap 15.6

* Server Applications Module 15-SP6

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2024:4163-1
Release Date: 2024-12-04T07:57:17Z
Rating: important

Topics%20covered

Topics Covered

security advisory DoS important SUSE deadlock data leakage xen

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here