Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14557-1 advisory.

  - A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while     processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user     within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host,     resulting in a denial of service. (CVE-2020-25723)

  - An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service     (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry     can be half-updated. (CVE-2020-27670)

  - An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of     service (data corruption), cause a data leak, or possibly gain privileges because coalescing of per-page     IOMMU TLB flushes is mishandled. (CVE-2020-27671)

  - An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of     service, achieve data corruption, or possibly gain privileges by exploiting a race condition that leads to     a use-after-free involving 2MiB and 1GiB superpages. (CVE-2020-27672)

  - An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges     by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an     INVLPG-like attack technique. (CVE-2020-27674)

  - Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from     outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a Platypus     attack. NOTE: there is only one logically independent fix: to change the access control for each such     interface in Xen. (CVE-2020-28368)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for xen fixes the following issues :

CVE-2020-28368: Intel RAPL sidechannel attack aka PLATYPUS attack (bsc#1178591, XSA-351)

CVE-2021-3308: IRQ vector leak on x86 (bsc#1181254, XSA-360)

CVE-2021-28687: HVM soft-reset crashes toolstack (bsc#1183072, XSA-368)

L3: conring size for XEN HV's with huge memory to small (bsc#1177204).

kdump of HVM fails, soft-reset not handled by libxl (bsc#1179148)

openQA job causes libvirtd to dump core when running kdump inside domain (bsc#1181989).

Upstream bug fixes (bsc#1027519)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

CVE-2021-3308: VUL-0: xen: IRQ vector leak on x86 (bsc#1181254, XSA-360)

CVE-2021-28687: VUL-0: xen: HVM soft-reset crashes toolstack (bsc#1183072, XSA-368)

CVE-2021-20257: VUL-0: xen: infinite loop issue in the e1000 NIC emulator (bsc#1182846)

CVE-2020-28368: VUL-0: xen: Intel RAPL sidechannel attack aka PLATYPUS attack aka (bsc#1178591, XSA-351)

L3: conring size for XEN HV's with huge memory to small. Inital Xen logs cut (bsc#1177204)

Kdump of HVM fails, soft-reset not handled by libxl (bsc#1179148)

OpenQA job causes libvirtd to dump core when running kdump inside domain (bsc#1181989)

Allow restart of xenwatchdogd, enable tuning of keep-alive interval and timeout options via XENWATCHDOGD_ARGS= (bsc#1178736)

The receiving side did detect holes in a to-be-allocated superpage, but allocated a superpage anyway. This resulted to over-allocation (bsc#1177112)

The receiving side may punch holes incorrectly into optimistically allocated superpages. Also reduce overhead in bitmap handling (bsc#1177112)

Upstream bug fixes (bsc#1027519)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

bsc#1178963 - stack corruption from XSA-346 change (XSA-355)

bsc#1177409 - CVE-2020-27674: x86 PV guest INVLPG-like flushes may leave stale TLB entries (XSA-286)

bsc#1177412 - CVE-2020-27672: Race condition in Xen mapping code (XSA-345)

bsc#1177413 - CVE-2020-27671: undue deferral of IOMMU TLB flushes (XSA-346)

bsc#1177414 - CVE-2020-27670: unsafe AMD IOMMU page table updates (XSA-347)

bsc#1178591 - CVE-2020-28368: Intel RAPL sidechannel attack aka PLATYPUS attack aka XSA-351

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

Security issue fixed :

CVE-2020-28368: Fixed the Intel RAPL sidechannel attack, aka PLATYPUS attack, aka XSA-351 (bsc#1178591).

Non-security issues fixed :

Updated to Xen 4.12.4 bug fix release (bsc#1027519).

Fixed a panic during MSI cleanup on AMD hardware (bsc#1027519).

Adjusted help for --max_iters, default is 5 (bsc#1177950).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

bsc#1178963 - VUL-0: xen: stack corruption from XSA-346 change (XSA-355)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

Security issue fixed :

CVE-2020-28368: Fixed the Intel RAPL sidechannel attack, aka PLATYPUS attack, aka XSA-351 (bsc#1178591).

Non-security issue fixed :

Adjusted help for --max_iters, default is 5 (bsc#1177950).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

Security issue fixed :

CVE-2020-28368: Fixed the Intel RAPL sidechannel attack, aka PLATYPUS attack, aka XSA-351 (bsc#1178591).

Non-security issues fixed :

Updated to Xen 4.12.4 bug fix release (bsc#1027519).

Fixed a panic during MSI cleanup on AMD hardware (bsc#1027519).

Adjusted help for --max_iters, default is 5 (bsc#1177950).

Improved performance of live migration to get more throughput on 10Gbs+ connections (jsc#SLE-16899).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

Security issue fixed :

CVE-2020-28368: Fixed the Intel RAPL sidechannel attack, aka PLATYPUS attack, aka XSA-351 (bsc#1178591).

Non-security issues fixed :

Updated to Xen 4.13.2 bug fix release (bsc#1027519).

Fixed a panic during MSI cleanup on AMD hardware (bsc#1027519).

Adjusted help for --max_iters, default is 5 (bsc#1177950).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

  - bsc#1178963 - VUL-0: xen: stack corruption from XSA-346     change (XSA-355) 

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for xen fixes the following issues :

  - bsc#1178963 - VUL-0: xen: stack corruption from XSA-346     change (XSA-355) 

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, privilege escalation or information leaks.

stack corruption from XSA-346 change [XSA-355]

----

Information leak via power sidechannel [XSA-351]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

Security issue fixed :

  - CVE-2020-28368: Fixed the Intel RAPL sidechannel attack,     aka PLATYPUS attack, aka XSA-351 (bsc#1178591).

Non-security issues fixed :

  - Updated to Xen 4.12.4 bug fix release (bsc#1027519).

  - Fixed a panic during MSI cleanup on AMD hardware     (bsc#1027519).

  - Adjusted help for --max_iters, default is 5     (bsc#1177950).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for xen fixes the following issues :

Security issue fixed :

  - CVE-2020-28368: Fixed the Intel RAPL sidechannel attack,     aka PLATYPUS attack, aka XSA-351 (bsc#1178591).

Non-security issues fixed :

  - Updated to Xen 4.13.2 bug fix release (bsc#1027519).

  - Fixed a panic during MSI cleanup on AMD hardware     (bsc#1027519).

  - Adjusted help for --max_iters, default is 5     (bsc#1177950).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Information leak via power sidechannel [XSA-351]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An information disclosure vulnerability exists in power/energy monitoring interfaces, which can be used to create covert channels and infer the operations and data used by other contexts within the  system.

ID	Name	Product	Family	Severity
150513	SUSE SLES11 Security Update : xen (SUSE-SU-2020:14557-1)	Nessus	SuSE Local Security Checks	high
149227	SUSE SLES15 Security Update : xen (SUSE-SU-2021:1460-1)	Nessus	SuSE Local Security Checks	medium
148365	SUSE SLES12 Security Update : xen (SUSE-SU-2021:1023-1)	Nessus	SuSE Local Security Checks	medium
144102	SUSE SLES12 Security Update : xen (SUSE-SU-2020:3742-1)	Nessus	SuSE Local Security Checks	high
143881	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:3413-1)	Nessus	SuSE Local Security Checks	medium
143878	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:3615-1)	Nessus	SuSE Local Security Checks	high
143861	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:3611-1)	Nessus	SuSE Local Security Checks	high
143824	SUSE SLES12 Security Update : xen (SUSE-SU-2020:3653-1)	Nessus	SuSE Local Security Checks	high
143703	SUSE SLES12 Security Update : xen (SUSE-SU-2020:3415-1)	Nessus	SuSE Local Security Checks	medium
143698	SUSE SLES12 Security Update : xen (SUSE-SU-2020:3414-1)	Nessus	SuSE Local Security Checks	medium
143675	SUSE SLES12 Security Update : xen (SUSE-SU-2020:3612-1)	Nessus	SuSE Local Security Checks	medium
143674	SUSE SLES12 Security Update : xen (SUSE-SU-2020:3631-1)	Nessus	SuSE Local Security Checks	high
143625	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:3412-1)	Nessus	SuSE Local Security Checks	medium
143538	openSUSE Security Update : xen (openSUSE-2020-2192)	Nessus	SuSE Local Security Checks	high
143506	openSUSE Security Update : xen (openSUSE-2020-2162)	Nessus	SuSE Local Security Checks	high
143500	Debian DSA-4804-1 : xen - security update	Nessus	Debian Local Security Checks	high
143397	Fedora 33 : xen (2020-d71fa5f0b9)	Nessus	Fedora Local Security Checks	medium
143301	openSUSE Security Update : xen (openSUSE-2020-2030)	Nessus	SuSE Local Security Checks	medium
143298	openSUSE Security Update : xen (openSUSE-2020-2017)	Nessus	SuSE Local Security Checks	medium
143139	Fedora 32 : xen (2020-2684e0fadd)	Nessus	Fedora Local Security Checks	medium
142889	Xen Platypus information leak via power sidechannel (XSA-351)	Nessus	Misc.	medium

Detections

Analytics

CVE-2020-28368

medium

Tenable Plugins

high

medium

medium

high

medium

high

high

high

medium

medium

medium

high

medium

high

high

high

medium

medium

medium

medium

medium