Xen (64-bit PV): Top-level shadow reference dropped too early for 64-bit PV guests - privilege escalation to host

Impact

Top-level shadow reference dropped too early for 64-bit PV guests - privilege escalation to host

Who can reach it

Tenant VM guest (PV)

What to do

Hypervisor patch + reboot/evacuation

References

Related entries

• Xen (libfsimage/pygrub): Multiple vulnerabilities in libfsimage disk handlingCVE-2023-34325 · Xen (libfsimage/pygrub)High
• Linux kernel (nf_tables): Stack out-of-bounds read/write in nft_byteorder_eval() - local root (Pwn2Own)CVE-2023-35001 · Linux kernel (nf_tables)High
• Linux kernel (netfilter pipapo): UAF from improper element removal in nft_pipapo_remove() - local rootCVE-2023-4004 · Linux kernel (netfilter pipapo)High
• Linux kernel (nf_tables): UAF adding a rule with NFTA_RULE_CHAIN_ID - local rootCVE-2023-4147 · Linux kernel (nf_tables)High
• Linux kernel (net/sched hfsc): Use-after-free in sch_hfsc qdisc - local rootCVE-2023-4623 · Linux kernel (net/sched hfsc)High
• glibc (ld.so): Looney Tunables: buffer overflow in the ld.so GLIBC_TUNABLES parser - local root on default installsCVE-2023-4911 · glibc (ld.so)High