DSA-5184: -1 xen -- security update

Published Jul 15, 2022

Updated

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation. In addition this updates provides mitigations for the Retbleed speculative execution attack and the MMIO stale data vulnerabilities.

Affected Software

2 affected components

debian/xen

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade xen to a version that resolves this vulnerability.
Patch DSA-5184-1

Event History

Jul 15, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Who is exposed to the privilege-escalation issues?

Systems using the Debian Xen hypervisor are in scope. The advisory states that the discovered vulnerabilities could result in privilege escalation.

What additional protections are included in this update?

The update includes mitigations for the Retbleed speculative execution attack and MMIO stale data vulnerabilities.

Which CVEs are associated with this advisory?

The referenced CVEs are CVE-2022-21123, CVE-2022-21125, and CVE-2022-21166.