Alpine: xen: security update to 4.10.4-r2

high Tenable Cloud Security Plugin ID 407742

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a
situation where an untrusted domain has access to a physical device (and assignable-add is not used),
because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's "assignable-add"
feature to prepare devices to be assigned to untrusted guests. Unfortunately, this is not considered a
strictly required step for device assignment. The PCI passthrough documentation on the wiki describes
alternate ways of preparing devices for assignment, and libvirt uses its own ways as well. Hosts where
these "alternate" methods are used will still leave the system in a vulnerable state after the device
comes back from a guest. An untrusted domain with access to a physical device can DMA into host memory,
leading to privilege escalation. Only systems where guests are given direct access to physical devices
capable of DMA (PCI pass-through) are vulnerable. Systems which do not use PCI pass-through are not
vulnerable. (CVE-2019-19579)

- An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of
service or possibly gain privileges by triggering data-structure access during pagetable-height updates.
When running on AMD systems with an IOMMU, Xen attempted to dynamically adapt the number of levels of
pagetables (the pagetable height) in the IOMMU according to the guest's address space size. The code to
select and update the height had several bugs. Notably, the update was done without taking a lock which is
necessary for safe operation. A malicious guest administrator can cause Xen to access data structures
while they are being modified, causing Xen to crash. Privilege escalation is thought to be very difficult
but cannot be ruled out. Additionally, there is a potential memory leak of 4kb per guest boot, under
memory pressure. Only Xen on AMD CPUs is vulnerable. Xen running on Intel CPUs is not vulnerable. ARM
systems are not vulnerable. Only systems where guests are given direct access to physical devices are
vulnerable. Systems which do not use PCI pass-through are not vulnerable. Only HVM guests can exploit the
vulnerability. PV and PVH guests cannot. All versions of Xen with IOMMU support are vulnerable.
(CVE-2019-19577)

- An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service
via degenerate chains of linear pagetables, because of an incorrect fix for CVE-2017-15595. "Linear
pagetables" is a technique which involves either pointing a pagetable at itself, or to another pagetable
of the same or higher level. Xen has limited support for linear pagetables: A page may either point to
itself, or point to another pagetable of the same level (i.e., L2 to L2, L3 to L3, and so on). XSA-240
introduced an additional restriction that limited the "depth" of such chains by allowing pages to either
*point to* other pages of the same level, or *be pointed to* by other pages of the same level, but not
both. To implement this, we keep track of the number of outstanding times a page points to or is pointed
to another page table, to prevent both from happening at the same time. Unfortunately, the original commit
introducing this reset this count when resuming validation of a partially-validated pagetable, incorrectly
dropping some "linear_pt_entry" counts. If an attacker could engineer such a situation to occur, they
might be able to make loops or other arbitrary chains of linear pagetables, as described in XSA-240. A
malicious or buggy PV guest may cause the hypervisor to crash, resulting in Denial of Service (DoS)
affecting the entire host. Privilege escalation and information leaks cannot be excluded. All versions of
Xen are vulnerable. Only x86 systems are affected. Arm systems are not affected. Only x86 PV guests can
leverage the vulnerability. x86 HVM and PVH guests cannot leverage the vulnerability. Only systems which
have enabled linear pagetables are vulnerable. Systems which have disabled linear pagetables, either by
selecting CONFIG_PV_LINEAR_PT=n when building the hypervisor, or adding pv-linear-pt=false on the command-
line, are not vulnerable. (CVE-2019-19578)

- An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by
leveraging race conditions in pagetable promotion and demotion operations, because of an incomplete fix
for CVE-2019-18421. XSA-299 addressed several critical issues in restartable PV type change operations.
Despite extensive testing and auditing, some corner cases were missed. A malicious PV guest administrator
may be able to escalate their privilege to that of the host. All security-supported versions of Xen are
vulnerable. Only x86 systems are affected. Arm systems are not affected. Only x86 PV guests can leverage
the vulnerability. x86 HVM and PVH guests cannot leverage the vulnerability. Note that these attacks
require very precise timing, which may be difficult to exploit in practice. (CVE-2019-19580)

Plugin Details

Severity: High

ID: 407742

Version: Revision 1.25

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 95.11

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2019-19579

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2019-19578

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 11/7/2019

Reference Information

CVE: CVE-2019-19577, CVE-2019-19578, CVE-2019-19579, CVE-2019-19580, CVE-2019-19582, CVE-2019-19583

IAVB: 2019-B-0084-S, 2019-B-0091-S

Detections

Analytics