Pawel Wieczorkiewicz

**Name of the Vulnerable Software and Affected Versions** AMD processors (affected versions not specified) **Description** When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch, potentially resulting in information disclosure. This issue is related to errors occurring after a core exits the C0 sleep state. Exploitation of this issue may allow an attacker to disclose protected information, including access to the return address predictor cache. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AMD processor microcode (affected versions not specified) **Description** The issue is related to the implementation of the Indirect Branch Prediction Barrier (IBPB) mechanism in AMD processor microcode, which may lead to a potential information disclosure due to incorrect clearing of the Return Address Stack (RAS). This could allow an attacker to obtain sensitive information using a side channel. The vulnerability is being actively exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AMD CPUs (affected versions not specified) **Description** The issue is related to speculative execution in AMD CPUs, which may allow data leakage by transiently executing beyond unconditional direct branches. This could potentially lead to the disclosure of arbitrary memory areas. For example, a proof-of-concept exploit has been developed to determine address layouts and bypass the KASLR (kernel address space layout randomization) protection mechanism by executing non-privileged code in the ePBF kernel subsystem. Other attack scenarios may also lead to kernel memory content leakage. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ISC DHCP versions 4.1-ESV-R1 through 4.1-ESV-R16 ISC DHCP versions 4.4.0 through 4.4.2 **Description** The issue is related to a buffer overflow in the memory when reading a lease, which can cause a denial of service. The outcome of encountering the defect varies according to the component being affected, whether the package was built as a 32-bit or 64-bit binary, and whether the compiler flag -fstack-protection-strong was used when compiling. In dhclient, it is possible to cause a crash on a 32-bit system when reading an improper lease, leading to network connectivity problems. In dhcpd, when run in DHCPv4 or DHCPv6 mode, the server may exit or improperly delete leases. **Recommendations** For ISC DHCP versions 4.1-ESV-R1 through 4.1-ESV-R16, consider updating to a newer version to mitigate the risk. For ISC DHCP versions 4.4.0 through 4.4.2, consider updating to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the lease database to minimize the risk of exploitation. Avoid using the `dhcpd` server binary built for a 32-bit architecture with the -fstack-protection-strong compiler flag until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Xen versions through 4.14.x **Description** An issue was discovered in Xen where xenstored and guests communicate via a shared memory page using a specific protocol. When a guest violates this protocol, xenstored will drop the connection to that guest, resulting in the same actions as if the guest had been destroyed, including sending an `@releaseDomain` event. This can lead to a zombie domain, where memory mappings of that guest's memory will not be removed due to the missing event. A malicious guest can block resources of the host for a period after its own death. Guests with a stub domain device model can eventually crash xenstored, resulting in a more serious denial of service. Only the C variant of Xenstore is affected, and only HVM guests with a stubdom device model can cause a serious DoS. **Recommendations** To resolve the issue, update to a version of Xen that is not affected by this issue. As a temporary workaround, consider restricting the use of the `@releaseDomain` event to minimize the risk of exploitation. Restrict access to the xenstored internal management to prevent a malicious guest from blocking resources of the host. Avoid using the stub domain device model for HVM guests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen versions through 4.14.x **Description** An issue was discovered in some OSes, such as Linux, FreeBSD, and NetBSD, which are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable. **Recommendations** For Xen versions through 4.14.x, consider implementing a queue limit or a mechanism to handle watch events more efficiently to prevent an OOM in the backend. As a temporary workaround, consider restricting the rate at which watch events are received or disabling the single-threaded watch event processing until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 5.10.1 Xen versions through 4.14.x **Description** An issue in the Linux kernel PV block backend may cause a pointer to be re-used after it was freed. This occurs when the kernel thread handler does not have time to reset `ring->xenblkd` to NULL if the frontend quickly toggles between connect and disconnect states. A misbehaving guest can trigger a dom0 crash by continuously connecting/disconnecting a block frontend, potentially leading to privilege escalation and information leaks. This issue affects systems with a Linux blkback. **Recommendations** For Linux kernel versions through 5.10.1, update to a version that includes the fix for this issue. For Xen versions through 4.14.x, ensure that the Linux kernel used is updated to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the block backend to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Xen versions prior to 4.14 **Description** An issue in Xen allows guest OS users to cause a denial of service due to bad continuation handling in GNTTABOP copy. Grant table operations are expected to return 0 for success and a negative number for errors. However, a path through grant copy handling may return success to the caller without any action taken, leaving status fields of individual operations uninitialised. This can result in errant behaviour in the caller of GNTTABOP copy. A buggy or malicious guest can construct its grant table to hit the incorrect exit path when a backend domain tries to copy a grant, returning success without doing anything, which may cause crashes or other incorrect behaviour. **Recommendations** For Xen versions prior to 4.14, update to version 4.14 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Intel(R) Processors (affected versions not specified) Description: The issue is related to improper data forwarding in some data cache for Intel(R) Processors, which may allow an authenticated user to potentially enable information disclosure via local access. This is due to errors in data synchronization in the cache memory. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.