SUSE: CVE-2021-28712: SUSE Linux Security Advisory
Description
Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as "driver domains". Running PV backends in driver domains has one primary security advantage: if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. There are three affected backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch 3, CVE-2021-28713
Solution(s)
- suse-upgrade-cluster-md-kmp-64kb
- suse-upgrade-cluster-md-kmp-azure
- suse-upgrade-cluster-md-kmp-default
- suse-upgrade-cluster-md-kmp-preempt
- suse-upgrade-dlm-kmp-64kb
- suse-upgrade-dlm-kmp-azure
- suse-upgrade-dlm-kmp-default
- suse-upgrade-dlm-kmp-preempt
- suse-upgrade-dtb-al
- suse-upgrade-dtb-allwinner
- suse-upgrade-dtb-altera
- suse-upgrade-dtb-amd
- suse-upgrade-dtb-amlogic
- suse-upgrade-dtb-apm
- suse-upgrade-dtb-arm
- suse-upgrade-dtb-broadcom
- suse-upgrade-dtb-cavium
- suse-upgrade-dtb-exynos
- suse-upgrade-dtb-freescale
- suse-upgrade-dtb-hisilicon
- suse-upgrade-dtb-lg
- suse-upgrade-dtb-marvell
- suse-upgrade-dtb-mediatek
- suse-upgrade-dtb-nvidia
- suse-upgrade-dtb-qcom
- suse-upgrade-dtb-renesas
- suse-upgrade-dtb-rockchip
- suse-upgrade-dtb-socionext
- suse-upgrade-dtb-sprd
- suse-upgrade-dtb-xilinx
- suse-upgrade-dtb-zte
- suse-upgrade-gfs2-kmp-64kb
- suse-upgrade-gfs2-kmp-azure
- suse-upgrade-gfs2-kmp-default
- suse-upgrade-gfs2-kmp-preempt
- suse-upgrade-kernel-64kb
- suse-upgrade-kernel-64kb-devel
- suse-upgrade-kernel-64kb-extra
- suse-upgrade-kernel-64kb-livepatch-devel
- suse-upgrade-kernel-64kb-optional
- suse-upgrade-kernel-azure
- suse-upgrade-kernel-azure-base
- suse-upgrade-kernel-azure-devel
- suse-upgrade-kernel-azure-extra
- suse-upgrade-kernel-azure-livepatch-devel
- suse-upgrade-kernel-azure-optional
- suse-upgrade-kernel-debug
- suse-upgrade-kernel-debug-base
- suse-upgrade-kernel-debug-devel
- suse-upgrade-kernel-debug-livepatch-devel
- suse-upgrade-kernel-default
- suse-upgrade-kernel-default-base
- suse-upgrade-kernel-default-base-rebuild
- suse-upgrade-kernel-default-devel
- suse-upgrade-kernel-default-extra
- suse-upgrade-kernel-default-kgraft
- suse-upgrade-kernel-default-livepatch
- suse-upgrade-kernel-default-livepatch-devel
- suse-upgrade-kernel-default-man
- suse-upgrade-kernel-default-optional
- suse-upgrade-kernel-devel
- suse-upgrade-kernel-devel-azure
- suse-upgrade-kernel-docs
- suse-upgrade-kernel-docs-html
- suse-upgrade-kernel-kvmsmall
- suse-upgrade-kernel-kvmsmall-base
- suse-upgrade-kernel-kvmsmall-devel
- suse-upgrade-kernel-kvmsmall-livepatch-devel
- suse-upgrade-kernel-macros
- suse-upgrade-kernel-obs-build
- suse-upgrade-kernel-obs-qa
- suse-upgrade-kernel-preempt
- suse-upgrade-kernel-preempt-devel
- suse-upgrade-kernel-preempt-extra
- suse-upgrade-kernel-preempt-livepatch-devel
- suse-upgrade-kernel-preempt-optional
- suse-upgrade-kernel-source
- suse-upgrade-kernel-source-azure
- suse-upgrade-kernel-source-vanilla
- suse-upgrade-kernel-syms
- suse-upgrade-kernel-syms-azure
- suse-upgrade-kernel-vanilla
- suse-upgrade-kernel-vanilla-base
- suse-upgrade-kernel-vanilla-devel
- suse-upgrade-kernel-vanilla-livepatch-devel
- suse-upgrade-kernel-zfcpdump
- suse-upgrade-kernel-zfcpdump-man
- suse-upgrade-kgraft-patch-4_4_180-94_153-default
- suse-upgrade-kselftests-kmp-64kb
- suse-upgrade-kselftests-kmp-azure
- suse-upgrade-kselftests-kmp-default
- suse-upgrade-kselftests-kmp-preempt
- suse-upgrade-ocfs2-kmp-64kb
- suse-upgrade-ocfs2-kmp-azure
- suse-upgrade-ocfs2-kmp-default
- suse-upgrade-ocfs2-kmp-preempt
- suse-upgrade-reiserfs-kmp-64kb
- suse-upgrade-reiserfs-kmp-azure
- suse-upgrade-reiserfs-kmp-default
- suse-upgrade-reiserfs-kmp-preempt
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center