[Pkg-xen-devel] Bug#1057300: bookworm-pu: package xen/4.17.2+76-ge1f9cb16e2-1~deb12u1

[Maximilian Engelhardt]

Package: release.debian.org
Severity: normal
Tags: bookworm
User: release.debian.org at packages.debian.org
Usertags: pu
X-Debbugs-Cc: xen at packages.debian.org, maxi at daemonizer.de, hans at knorrie.org, team at security.debian.org
Control: affects -1 + src:xen

This is a Xen stable update. This update could also have been a security
update on its own, but since the changes do not ultimately require a
DSA, we'd like to publish via the point release channel, so that users
get the new Xen and Linux kernel package at exactly the same moment,
reducing reboot stress.

[ Reason ]
Xen in bookworm is currently affected by several CVEs:
- CVE-2023-20593
- CVE-2023-20569
- CVE-2022-40982
- CVE-2023-34320
- CVE-2023-34321
- CVE-2023-34322
- CVE-2023-20588
- CVE-2023-34323
- CVE-2023-34326
- CVE-2023-34325
- CVE-2023-34327
- CVE-2023-34328
- CVE-2023-46835
- CVE-2023-46836
(see also #1056928)

[ Impact ]
The above mentioned CVEs are not fixed in bookworm.

[ Tests ]
The Debian package is based only on upstream commits that have passed
the upstream automated tests.
The Debian package has been successfully tested by the xen packaging
team on their test machines.
The same version is also in unstable without any reports.

[ Risks ]
There could be upstream changes unrelated to the above mentioned
security fixes that cause regressions. However upstream has an automated
testing machinery (osstest) that only allows a commit in the upstream
stable branch if all test pass.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
* Advance the upstream source code to the latest available commit in the
upstream stable Xen 4.17 branch line
* No packaging changes were made
* Where necessary, patches were as-is rebased against upstream changes
* Document changes and mention security issues in the changelog in the
usual format

[ Other info ]
This update, like previous Xen 4.17 updates for Bookworm, is based on
the upstream stable-4.17 branch.

The branch in general only accepts bug fixes and does not allow new
features, so the changes there are mainly security fixes, important bug
fixes and fixes related to hardware errata or hardware support.

The package we have prepared is exactly what we would have done as a
security update in a stable release, what we have historically done
together with the security team and are planning to continue to do.

As upstream does extensive automated testing on their stable branches
chances for unnoticed regressions are low. We believe that by following
the upstream stable release branch line the risk for regressions is
lower than trying to manually pick and adjust (security) patches without
all the deep knowledge that upstream has. This approach is similar to
what the Linux kernel team is doing.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: xen_4.17.1+2-gb773c48e36-1..xen_4.17.2+76-ge1f9cb16e2-1~deb12u1.debdiff
Type: text/x-patch
Size: 505450 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-xen-devel/attachments/20231202/eb0360ec/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://alioth-lists.debian.net/pipermail/pkg-xen-devel/attachments/20231202/eb0360ec/attachment-0001.sig>