[ GLSA 202009-14 ] Xen

[GLSA]

Gentoo Linux Security Advisory

Title: Xen: Buffer overflow (GLSA 202009-14)
Severity: normal
Exploitable: local, remote
Date: 2020-09-29
Bug(s): #738040
ID: 202009-14

Synopsis

A buffer overflow in Xen might allow remote attacker(s) to execute
arbitrary code.


Background

Xen is a bare-metal hypervisor.

Affected Packages

Package: app-emulation/xen
Vulnerable: < 4.13.1-r3
Unaffected: >= 4.13.1-r3
Architectures: All supported architectures

Package: app-emulation/xen-tools
Vulnerable: < 4.13.1-r3
Unaffected: >= 4.13.1-r3
Architectures: All supported architectures


Description

An out-of-bounds read/write access issue was found in the USB emulator
when using QEMU.


Impact

A remote attacker could possibly execute arbitrary code with the
privileges of the process or cause a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All Xen users should upgrade to the latest version: