Wei Liu

**Nome do software vulnerável e versões afetadas** Versões do kernel Linux anteriores à 6.6.37 **Descrição** Nas máquinas virtuais CoCo, é possível que um host não confiável provoque a falha das funções `set memory encrypted()` ou `set memory decrypted()`, resultando em memória compartilhada. Os chamadores precisam lidar com esses erros para evitar devolver memória descriptografada (compartilhada) ao alocador de páginas, o que poderia levar a problemas funcionais ou de segurança. O driver `netvsc` poderia liberar páginas descriptografadas/compartilhadas se `set memory decrypted()` falhar. Verificar o campo `decrypted` no `gpadl` pode determinar se a memória deve ser liberada. **Recomendações** Para resolver o problema, atualize para a versão 6.6.37 ou posterior do kernel do Linux. Como solução alternativa temporária, considere verificar o campo `decrypted` no `gpadl` para decidir se a memória deve ser liberada e lide com os erros de `set memory encrypted()` e `set memory decrypted()` para evitar o retorno de memória descriptografada (compartilhada) ao alocador de páginas.

**Name of the Vulnerable Software and Affected Versions** Xen versions 4.4.x through 4.9.x **Description** An issue allows ARM guest OS users to cause a denial of service, preventing physical CPU usage, due to lock mishandling when an add-to-physmap error is detected. **Recommendations** For Xen versions 4.4.x through 4.9.x, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Xen versions 4.6.x and earlier **Description** The issue allows local OS guest administrators to cause a denial of service or gain host OS privileges by manipulating information in guest-controlled areas of xenstore. This can lead to resource consumption or management facility confusion. **Recommendations** For Xen versions 4.6.x and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen versions prior to 4.7 **Description** The issue allows local guest OS users with access to the driver domain to cause a denial of service by manipulating information in the backend directories in xenstore. This can lead to management tool confusion. **Recommendations** For versions prior to 4.7, update to version 4.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Xen (affected versions not specified) **Description** The issue allows local guest administrators to cause a denial of service, resulting in a "scheduling while atomic" error and host crash, by sending a malformed packet. This occurs when using certain Linux versions that do not allow sleeping in softirq context, causing a mutex to be taken when trying to disable the interface. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.