Alpine: xen: security update to 4.11.3-r1

high Tenable Cloud Security Plugin ID 407751

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of
service or possibly gain privileges by triggering data-structure access during pagetable-height updates.
When running on AMD systems with an IOMMU, Xen attempted to dynamically adapt the number of levels of
pagetables (the pagetable height) in the IOMMU according to the guest's address space size. The code to
select and update the height had several bugs. Notably, the update was done without taking a lock which is
necessary for safe operation. A malicious guest administrator can cause Xen to access data structures
while they are being modified, causing Xen to crash. Privilege escalation is thought to be very difficult
but cannot be ruled out. Additionally, there is a potential memory leak of 4kb per guest boot, under
memory pressure. Only Xen on AMD CPUs is vulnerable. Xen running on Intel CPUs is not vulnerable. ARM
systems are not vulnerable. Only systems where guests are given direct access to physical devices are
vulnerable. Systems which do not use PCI pass-through are not vulnerable. Only HVM guests can exploit the
vulnerability. PV and PVH guests cannot. All versions of Xen with IOMMU support are vulnerable.
(CVE-2019-19577)

- An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service
via degenerate chains of linear pagetables, because of an incorrect fix for CVE-2017-15595. "Linear
pagetables" is a technique which involves either pointing a pagetable at itself, or to another pagetable
of the same or higher level. Xen has limited support for linear pagetables: A page may either point to
itself, or point to another pagetable of the same level (i.e., L2 to L2, L3 to L3, and so on). XSA-240
introduced an additional restriction that limited the "depth" of such chains by allowing pages to either
*point to* other pages of the same level, or *be pointed to* by other pages of the same level, but not
both. To implement this, we keep track of the number of outstanding times a page points to or is pointed
to another page table, to prevent both from happening at the same time. Unfortunately, the original commit
introducing this reset this count when resuming validation of a partially-validated pagetable, incorrectly
dropping some "linear_pt_entry" counts. If an attacker could engineer such a situation to occur, they
might be able to make loops or other arbitrary chains of linear pagetables, as described in XSA-240. A
malicious or buggy PV guest may cause the hypervisor to crash, resulting in Denial of Service (DoS)
affecting the entire host. Privilege escalation and information leaks cannot be excluded. All versions of
Xen are vulnerable. Only x86 systems are affected. Arm systems are not affected. Only x86 PV guests can
leverage the vulnerability. x86 HVM and PVH guests cannot leverage the vulnerability. Only systems which
have enabled linear pagetables are vulnerable. Systems which have disabled linear pagetables, either by
selecting CONFIG_PV_LINEAR_PT=n when building the hypervisor, or adding pv-linear-pt=false on the command-
line, are not vulnerable. (CVE-2019-19578)

- An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by
leveraging race conditions in pagetable promotion and demotion operations, because of an incomplete fix
for CVE-2019-18421. XSA-299 addressed several critical issues in restartable PV type change operations.
Despite extensive testing and auditing, some corner cases were missed. A malicious PV guest administrator
may be able to escalate their privilege to that of the host. All security-supported versions of Xen are
vulnerable. Only x86 systems are affected. Arm systems are not affected. Only x86 PV guests can leverage
the vulnerability. x86 HVM and PVH guests cannot leverage the vulnerability. Note that these attacks
require very precise timing, which may be difficult to exploit in practice. (CVE-2019-19580)

- An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service
(infinite loop) because certain bit iteration is mishandled. In a number of places bitmaps are being used
by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave
in certain corner cases: On x86 accesses to bitmaps with a compile time known size of 64 may incur
undefined behavior, which may in particular result in infinite loops. A malicious guest may cause a
hypervisor crash or hang, resulting in a Denial of Service (DoS). All versions of Xen are vulnerable. x86
systems with 64 or more nodes are vulnerable (there might not be any such systems that Xen would run on).
x86 systems with less than 64 nodes are not vulnerable. (CVE-2019-19582)

- An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of
service (guest OS crash) because VMX VMEntry checks mishandle a certain case. Please see XSA-260 for
background on the MovSS shadow. Please see XSA-156 for background on the need for #DB interception. The
VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single
Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in.
The resulting VMEntry failure is fatal to the guest. HVM/PVH guest userspace code may be able to crash the
guest, resulting in a guest Denial of Service. All versions of Xen are affected. Only systems supporting
VMX hardware virtual extensions (Intel, Cyrix, or Zhaoxin CPUs) are affected. Arm and AMD systems are
unaffected. Only HVM/PVH guests are affected. PV guests cannot leverage the vulnerability.
(CVE-2019-19583)

Plugin Details

Severity: High

ID: 407751

Version: Revision 1.25

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 95.11

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2019-19578

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 12/11/2019

Reference Information

CVE: CVE-2019-19577, CVE-2019-19578, CVE-2019-19580, CVE-2019-19582, CVE-2019-19583

IAVB: 2019-B-0091-S

Detections

Analytics