Debian Security Advisory

DSA-4131-1 xen -- security update

Date Reported:
04 Mar 2018
Affected Packages:
xen
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2018-7540, CVE-2018-7541, CVE-2018-7542.
More information:

Multiple vulnerabilities have been discovered in the Xen hypervisor:

  • CVE-2018-7540

    Jann Horn discovered that missing checks in page table freeing may result in denial of service.

  • CVE-2018-7541

    Jan Beulich discovered that incorrect error handling in grant table checks may result in guest-to-host denial of service and potentially privilege escalation.

  • CVE-2018-7542

    Ian Jackson discovered that insufficient handling of x86 PVH guests without local APICs may result in guest-to-host denial of service.

For the stable distribution (stretch), these problems have been fixed in version 4.8.3+comet2+shim4.10.0+comet3-1+deb9u5.

We recommend that you upgrade your xen packages.

For the detailed security status of xen please refer to its security tracker page at: https://security-tracker.debian.org/tracker/xen