certfr_avis - CERTFR-2024-AVI-0589

CERTFR-2024-AVI-0589

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans Xen. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L'éditeur indique que les systèmes avec Xapi versions 24.x sont potentiellement affectés mais qu'il n'a pas connaissance de tels systèmes utilisant la fonctionnalité vulnérable de sauvegarde/restauration de metadonnées.

Impacted products

	Vendor	Product	Description
	XEN	N/A	Systèmes avec Xapi versions 1.249.x sans le correctif de sécurité xsa459
	XEN	N/A	Xen versions ultérieures à 4.3 sans le correctif de sécurité xsa458

References

Title

Publication Time

Tags

Bulletin de sécurité Xen xsa/advisory-458	2024-07-16	vendor-advisory
Bulletin de sécurité Xen xsa/advisory-459	2024-07-16	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Syst\u00e8mes avec Xapi versions 1.249.x sans le correctif de s\u00e9curit\u00e9 xsa459",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "XEN",
          "scada": false
        }
      }
    },
    {
      "description": "Xen versions ult\u00e9rieures \u00e0 4.3 sans le correctif de s\u00e9curit\u00e9 xsa458",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "XEN",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u0027\u00e9diteur indique que les syst\u00e8mes avec Xapi versions 24.x sont potentiellement affect\u00e9s mais qu\u0027il n\u0027a pas connaissance de tels syst\u00e8mes utilisant la fonctionnalit\u00e9 vuln\u00e9rable de sauvegarde/restauration de metadonn\u00e9es.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-31144",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-31144"
    },
    {
      "name": "CVE-2024-31143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-31143"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0589",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Xen. Elles permettent \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9 et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Xen",
  "vendor_advisories": [
    {
      "published_at": "2024-07-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-458",
      "url": "https://xenbits.xen.org/xsa/advisory-458.html"
    },
    {
      "published_at": "2024-07-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-459",
      "url": "https://xenbits.xen.org/xsa/advisory-459.html"
    }
  ]
}

CVE-2024-31144 (GCVE-0-2024-31144)

Vulnerability from cvelistv5 – Published: 2025-02-14 20:16 – Updated: 2025-04-26 20:03

Summary

For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.html#object-model-overview Xapi contains functionality to backup and restore metadata about Virtual Machines and Storage Repositories (SRs). The metadata itself is stored in a Virtual Disk Image (VDI) inside an SR. This is used for two purposes; a general backup of metadata (e.g. to recover from a host failure if the filer is still good), and Portable SRs (e.g. using an external hard drive to move VMs to another host). Metadata is only restored as an explicit administrator action, but occurs in cases where the host has no information about the SR, and must locate the metadata VDI in order to retrieve the metadata. The metadata VDI is located by searching (in UUID alphanumeric order) each VDI, mounting it, and seeing if there is a suitable metadata file present. The first matching VDI is deemed to be the metadata VDI, and is restored from. In the general case, the content of VDIs are controlled by the VM owner, and should not be trusted by the host administrator. A malicious guest can manipulate its disk to appear to be a metadata backup. A guest cannot choose the UUIDs of its VDIs, but a guest with one disk has a 50% chance of sorting ahead of the legitimate metadata backup. A guest with two disks has a 75% chance, etc.

Severity ?

3.8 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-noinfo Not enough information

Assigner

XEN

References

URL

Tags

https://xenbits.xen.org/xsa/advisory-459.html

Impacted products

	Vendor	Product	Version
	Xen Project	Xen	Unknown: consult Xen advisory XSA-459

Credits

This issue was discovered by XenServer.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-26T20:03:17.226Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/07/16/4"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-459.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 3.8,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-31144",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-18T14:36:10.430446Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-18T14:43:41.254Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen Project",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-459"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eSystems running Xapi v1.249.x are affected.\n\nSystems running Xapi v24.x are potentially affected.  However it is\nbelieved that the only supported products using this version of Xapi\nhave not shipped the metadata backup/restore functionality.\n\nTo leverage the vulnerability, an attacker would likely need insider\ninformation to construct a plausible-looking metadata backup, and would\nhave to persuade a real administrator to perform a data-recovery action.\n\u003c/pre\u003e\u003cbr\u003e"
            }
          ],
          "value": "Systems running Xapi v1.249.x are affected.\n\nSystems running Xapi v24.x are potentially affected.  However it is\nbelieved that the only supported products using this version of Xapi\nhave not shipped the metadata backup/restore functionality.\n\nTo leverage the vulnerability, an attacker would likely need insider\ninformation to construct a plausible-looking metadata backup, and would\nhave to persuade a real administrator to perform a data-recovery action."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by XenServer."
        }
      ],
      "datePublic": "2024-07-16T11:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eFor a brief summary of Xapi terminology, see:\n\n  \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://xapi-project.github.io/xen-api/overview.html#object-model-overview\"\u003ehttps://xapi-project.github.io/xen-api/overview.html#object-model-overview\u003c/a\u003e\n\nXapi contains functionality to backup and restore metadata about Virtual\nMachines and Storage Repositories (SRs).\n\nThe metadata itself is stored in a Virtual Disk Image (VDI) inside an\nSR.  This is used for two purposes; a general backup of metadata\n(e.g. to recover from a host failure if the filer is still good), and\nPortable SRs (e.g. using an external hard drive to move VMs to another\nhost).\n\nMetadata is only restored as an explicit administrator action, but\noccurs in cases where the host has no information about the SR, and must\nlocate the metadata VDI in order to retrieve the metadata.\n\nThe metadata VDI is located by searching (in UUID alphanumeric order)\neach VDI, mounting it, and seeing if there is a suitable metadata file\npresent.  The first matching VDI is deemed to be the metadata VDI, and\nis restored from.\n\nIn the general case, the content of VDIs are controlled by the VM owner,\nand should not be trusted by the host administrator.\n\nA malicious guest can manipulate its disk to appear to be a metadata\nbackup.\n\nA guest cannot choose the UUIDs of its VDIs, but a guest with one disk\nhas a 50% chance of sorting ahead of the legitimate metadata backup.  A\nguest with two disks has a 75% chance, etc.\u003c/pre\u003e\u003cbr\u003e"
            }
          ],
          "value": "For a brief summary of Xapi terminology, see:\n\n   https://xapi-project.github.io/xen-api/overview.html#object-model-overview \n\nXapi contains functionality to backup and restore metadata about Virtual\nMachines and Storage Repositories (SRs).\n\nThe metadata itself is stored in a Virtual Disk Image (VDI) inside an\nSR.  This is used for two purposes; a general backup of metadata\n(e.g. to recover from a host failure if the filer is still good), and\nPortable SRs (e.g. using an external hard drive to move VMs to another\nhost).\n\nMetadata is only restored as an explicit administrator action, but\noccurs in cases where the host has no information about the SR, and must\nlocate the metadata VDI in order to retrieve the metadata.\n\nThe metadata VDI is located by searching (in UUID alphanumeric order)\neach VDI, mounting it, and seeing if there is a suitable metadata file\npresent.  The first matching VDI is deemed to be the metadata VDI, and\nis restored from.\n\nIn the general case, the content of VDIs are controlled by the VM owner,\nand should not be trusted by the host administrator.\n\nA malicious guest can manipulate its disk to appear to be a metadata\nbackup.\n\nA guest cannot choose the UUIDs of its VDIs, but a guest with one disk\nhas a 50% chance of sorting ahead of the legitimate metadata backup.  A\nguest with two disks has a 75% chance, etc."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "If a fraudulent metadata backup has been written into an SR which also contains a legitimate metadata backup, and an administrator explicitly chooses to restore from backup, the fraudulent metadata might be consumed instead of the legitimate metadata.  Control over meta data includes: which VMs are created, disk assignment, vCPU/RAM requirements, GPU allocation, etc."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-14T20:16:39.941Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xen.org/xsa/advisory-459.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Xapi: Metadata injection attack against backup/restore functionality",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eNot using the metadata restore functionality avoids the vulnerability.\u003c/pre\u003e\u003cbr\u003e"
            }
          ],
          "value": "Not using the metadata restore functionality avoids the vulnerability."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2024-31144",
    "datePublished": "2025-02-14T20:16:39.941Z",
    "dateReserved": "2024-03-28T18:14:12.892Z",
    "dateUpdated": "2025-04-26T20:03:17.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-31143 (GCVE-0-2024-31143)

Vulnerability from cvelistv5 – Published: 2024-07-18 13:31 – Updated: 2025-04-26 20:03

Summary

An optional feature of PCI MSI called "Multiple Message" allows a device to use multiple consecutive interrupt vectors. Unlike for MSI-X, the setting up of these consecutive vectors needs to happen all in one go. In this handling an error path could be taken in different situations, with or without a particular lock held. This error path wrongly releases the lock even when it is not currently held.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-832 - Unlock of a Resource that is not Locked

Assigner

XEN

References

URL

Tags

https://xenbits.xenproject.org/xsa/advisory-458.html

Impacted products

	Vendor	Product	Version
	Xen	Xen	Unknown: consult Xen advisory XSA-458

Credits

This issue was discovered by Jan Beulich of SUSE.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-26T20:03:16.232Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://xenbits.xenproject.org/xsa/advisory-458.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/07/16/3"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-458.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xen",
            "vendor": "xen",
            "versions": [
              {
                "lessThan": "4.16",
                "status": "affected",
                "version": "4.4",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-31143",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-21T13:31:44.467773Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-832",
                "description": "CWE-832 Unlock of a Resource that is not Locked",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-21T13:39:34.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-458"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Xen versions 4.4 and newer are vulnerable.  Xen versions 4.3 and older\nare not vulnerable.\n\nOnly x86 guest which have a multi-vector MSI capable device passed\nthrough to them can leverage the vulnerability.\n"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Jan Beulich of SUSE.\n"
        }
      ],
      "datePublic": "2024-07-16T11:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An optional feature of PCI MSI called \"Multiple Message\" allows a\ndevice to use multiple consecutive interrupt vectors.  Unlike for MSI-X,\nthe setting up of these consecutive vectors needs to happen all in one\ngo.  In this handling an error path could be taken in different\nsituations, with or without a particular lock held.  This error path\nwrongly releases the lock even when it is not currently held.\n"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Denial of Service (DoS) affecting the entire host, crashes, information\nleaks, or elevation of privilege all cannot be ruled out.\n"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-18T13:31:31.244Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-458.html"
        }
      ],
      "title": "double unlock in x86 guest IRQ handling",
      "workarounds": [
        {
          "lang": "en",
          "value": "Not passing through multi-vector MSI capable devices to x86 guests will\navoid the vulnerability.\n"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2024-31143",
    "datePublished": "2024-07-18T13:31:31.244Z",
    "dateReserved": "2024-03-28T18:14:12.892Z",
    "dateUpdated": "2025-04-26T20:03:16.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2024-AVI-0589

Solutions

CVE-2024-31144 (GCVE-0-2024-31144)

CVE-2024-31143 (GCVE-0-2024-31143)

Tags

Sightings

Nomenclature