Pawel Wieczorkiewicz

When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch, potentially resulting in information disclosure. This issue is related to errors occurring after a core exits the C0 sleep state. Exploitation of this issue may allow an attacker to disclose protected information, including access to the return address predictor cache.

The issue is related to the implementation of the Indirect Branch Prediction Barrier (IBPB) mechanism in AMD processor microcode, which may lead to a potential information disclosure due to incorrect clearing of the Return Address Stack (RAS). This could allow an attacker to obtain sensitive information using a side channel. The vulnerability is being actively exploited.

The issue is related to speculative execution in AMD CPUs, which may allow data leakage by transiently executing beyond unconditional direct branches. This could potentially lead to the disclosure of arbitrary memory areas. For example, a proof-of-concept exploit has been developed to determine address layouts and bypass the KASLR (kernel address space layout randomization) protection mechanism by executing non-privileged code in the ePBF kernel subsystem. Other attack scenarios may also lead to kernel memory content leakage.

The issue is related to a buffer overflow in the memory when reading a lease, which can cause a denial of service. The outcome of encountering the defect varies according to the component being affected, whether the package was built as a 32-bit or 64-bit binary, and whether the compiler flag -fstack-protection-strong was used when compiling. In dhclient, it is possible to cause a crash on a 32-bit system when reading an improper lease, leading to network connectivity problems. In dhcpd, when run in DHCPv4 or DHCPv6 mode, the server may exit or improperly delete leases.

An issue was discovered in Xen where xenstored and guests communicate via a shared memory page using a specific protocol. When a guest violates this protocol, xenstored will drop the connection to that guest, resulting in the same actions as if the guest had been destroyed, including sending an `@releaseDomain` event. This can lead to a zombie domain, where memory mappings of that guest's memory will not be removed due to the missing event. A malicious guest can block resources of the host for a period after its own death. Guests with a stub domain device model can eventually crash xenstored, resulting in a more serious denial of service. Only the C variant of Xenstore is affected, and only HVM guests with a stubdom device model can cause a serious DoS.

An issue was discovered in some OSes, such as Linux, FreeBSD, and NetBSD, which are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable.

An issue in the Linux kernel PV block backend may cause a pointer to be re-used after it was freed. This occurs when the kernel thread handler does not have time to reset `ring->xenblkd` to NULL if the frontend quickly toggles between connect and disconnect states. A misbehaving guest can trigger a dom0 crash by continuously connecting/disconnecting a block frontend, potentially leading to privilege escalation and information leaks. This issue affects systems with a Linux blkback.

An issue in Xen allows guest OS users to cause a denial of service due to bad continuation handling in GNTTABOP copy. Grant table operations are expected to return 0 for success and a negative number for errors. However, a path through grant copy handling may return success to the caller without any action taken, leaving status fields of individual operations uninitialised. This can result in errant behaviour in the caller of GNTTABOP copy. A buggy or malicious guest can construct its grant table to hit the incorrect exit path when a backend domain tries to copy a grant, returning success without doing anything, which may cause crashes or other incorrect behaviour.

Name of the Vulnerable Software and Affected Versions: Intel(R) Processors (affected versions not specified) Description: The issue is related to improper data forwarding in some data cache for Intel(R) Processors, which may allow an authenticated user to potentially enable information disclosure via local access. This is due to errors in data synchronization in the cache memory. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.