Description
Xen 4.2.x and 4.3.x, when using Intel VT-d and a PCI device has been assigned, does not clear the flag that suppresses IOMMU TLB flushes when unspecified errors occur, which causes the TLB entries to not be flushed and allows local guest administrators to cause a denial of service (host crash) or gain privileges via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.4.0-1 | — |
| Debian 13 | xen | 4.4.0-1 | — |
| Debian 12 | xen | 4.4.0-1 | — |
References
- 55932 third-party-advisory
- 1029468 vdb-entry
- SUSE-SU-2014:0373 vendor-advisory
- FEDORA-2013-23466 vendor-advisory
- GLSA-201407-03 vendor-advisory
- FEDORA-2013-23457 vendor-advisory
- [Xen-announce] 20131210 Xen Security Advisory 80 (CVE-2013-6400) - IOMMU TLB flushing may be inadvertently suppressed mailing-list
- [oss-security] 20131210 Xen Security Advisory 80 (CVE-2013-6400) - IOMMU TLB flushing may be inadvertently suppressed mailing-list