Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

Vulnerability IntelligenceSUSE-SU-2021:1268-1

SUSE-SU-2021:1268-1

HIGH7.9

Security update for xen

Published Apr 20, 2021

Modified 5 years ago

Fix available

Details

Description of the patch:

This update for xen fixes the following issues:

CVE-2021-27379: Fixed an issue where entries in the IOMMU were not being updated under certain circumstances due to improper backport of XSA-321 (XSA-366, bsc#1182431)
Fixed an issue where xenstored was crashing with segfault (bsc#1182155).

Affected Packages

xen

SUSE Linux Enterprise Server 12 SP2-BCLSUSE OpenStack Cloud 7

Fixed in:

4.7.6_14-43.76.1

xen-doc-html

SUSE Linux Enterprise Server 12 SP2-BCLSUSE OpenStack Cloud 7

Fixed in:

4.7.6_14-43.76.1

xen-libs

SUSE Linux Enterprise Server 12 SP2-BCLSUSE OpenStack Cloud 7

Fixed in:

4.7.6_14-43.76.1

xen-libs-32bit

SUSE Linux Enterprise Server 12 SP2-BCLSUSE OpenStack Cloud 7

Fixed in:

4.7.6_14-43.76.1

xen-tools

SUSE Linux Enterprise Server 12 SP2-BCLSUSE OpenStack Cloud 7

Fixed in:

4.7.6_14-43.76.1

xen-tools-domU

SUSE Linux Enterprise Server 12 SP2-BCLSUSE OpenStack Cloud 7

Fixed in:

4.7.6_14-43.76.1

References

ADVISORY

https://bugzilla.suse.com/1182155

ADVISORY

https://bugzilla.suse.com/1182431

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2021-April/008658.html

ADVISORY

https://www.suse.com/security/cve/CVE-2021-27379/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2021/suse-su-20211268-1/

CVSS Analysis

CVSS v3.1

7.9

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

ChangedS:C

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

HighA:H

7.9/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

Upstream

CVE-2021-27379

Ecosystems

SUSE Linux Enterprise Server 12 SP2-BCL SUSE OpenStack Cloud 7

Timeline

PublishedApr 20, 2021

ModifiedApr 20, 2021

SUSE-SU-2021:1268-1 | Mondoo Vulnerability Intelligence