Major Xen update fixes over 20 vulns, including guest/host escape flaw

The newest version (v4.5.1) of popular hypervisor Xen has been released last week, and includes a bucketload of improvements and bug-fixes, including nearly 20 security fixes.

Patches for the vulnerabilities in question have been issued one by one or in small batches since January (when Xen 4.5.0 was made available) as the flaws became known, but this update contains all of them.

Details about the vulnerabilities are provided here. The newest Xen version includes the fixes for vulnerabilities described in advisories from XSA-117 to XSA-136, “with the exception of XSA-124 which documents security risks of non-standard PCI device functionality that cannot be addressed in software.”

They are mostly flaws that can be exploited to trigger mostly denial of service situations, but also to provide attackers access to data of other guests and, occasionally, greater privileges on the system and the ability to execute malicious code.

CVE-2015-3209, detailed in XSA-135 is of a more serious nature, and can be exploited by an attacker to take complete control of the host system.

Administrators are advised to implement the update as soon a possible.