Xen: Multiple vulnerabilities — GLSA 201710-17

Multiple vulnerabilities have been found in Xen, the worst of which may allow local attackers to escalate privileges.

Affected packages

app-emulation/xen on all architectures
Affected versions < 4.7.3
Unaffected versions >= 4.7.3
app-emulation/xen-pvgrub on all architectures
Affected versions < 4.7.3
Unaffected versions >= 4.7.3
app-emulation/xen-tools on all architectures
Affected versions < 4.7.3
Unaffected versions >= 4.7.3

Background

Xen is a bare-metal hypervisor.

Description

Multiple vulnerabilities have been discovered in Xen. Please review the referenced CVE identifiers for details.

Impact

A local attacker could escalate privileges, cause a Denial of Service condition, obtain sensitive information, or have other unspecified impacts.

Workaround

There is no known workaround at this time.

Resolution

All Xen users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.7.3"
 

All Xen pvgrub users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-emulation/xen-pvgrub-4.7.3"
 

All Xen Tools users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-emulation/xen-tools-4.7.3"
 

References

Release date
October 18, 2017

Latest revision
October 18, 2017: 1

Severity
high

Exploitable
local

Bugzilla entries