# changelog

author: Gael Duperrey <gduperrey@vates.fr> - 4.13.5-9.36.1
changelog:
  - Security update, synced from hotfix XS82ECU1045
  - *** Upstream changelog ***
  - * Thu Aug 3 2023 Andrew Cooper <andrew.cooper3@citrix.com> - 4.13.5-9.36
  - - Fixes for
  -   - XSA-434 CVE-2023-20569
  -   - XSA-435 CVE-2022-40982
  - - Expose MSR_ARCH_CAPS to guests on all Intel hardware by default.  On Cascade
  -   Lake and later hardware, guests now see the bits stating hardware immunity
  -   to various speculative vulnerabilities.


author: Andrei Semenov <andrei.semenov@vates.tech> - 4.13.5-9.36.2
changelog:
  - More fixes to Zenbleed (XenServer backport from Xen Project)
  - Fix for AMD errata #1474 (XenServer backport from Xen Project)
  - Fix for XSA-429 (XenServer backport from Xen Project)


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 4.13.5-9.37.1
changelog:
  - Security update
  - Sync with hotfix XS82ECU1047, which fixes XSAs we already fixed, but also goes further on XSA-443 and adds other fixes
  - *** Upstream changelog ***
  - * Wed Oct 4 2023 Andrew Cooper <andrew.cooper3@citrix.com> - 4.13.5-9.37
  - - Fixes for
  -   - XSA-438 CVE-2023-34322
  -   - XSA-439 CVE-2023-20588
  -   - XSA-440 CVE-2023-34323
  -   - XSA-442 CVE-2023-34326
  -   - XSA-443 CVE-2023-34325
  -   - XSA-444 CVE-2023-34327 CVE-2023-34328
  - - Pygrub extended to deprivilege itself before operating on guest disks.
  - - Ignore MADT entries with invalid APIC_IDs.
  - - Fix the emulation of VPBLENDMW with a mask and memory operand.
  - - Fix a incorrect diagnostic about spurious interrupts.
  - - Update IO-APIC IRTEs atomically.  Fixes a race condition which causes
  -   interrupts to be routed badly, often with "No irq handler for vector"
  -   errors.
  - - Further fix for XSA-433.  Extend the chicken-bit workaround to all CPUs
  -   which appear to be a Zen2 microarchtiecture, even those not on the published
  -   model list.
  - - Fix for AMD errata #1474.  Disable C6 after 1000 days of uptime on AMD Zen2
  -   systems to avoid a crash at ~1044 days.
  - - Fix for MSR_ARCH_CAPS boot-time calculations for PV guests.


author: Gael Duperrey <gduperrey@vates.tech> - 4.13.5-9.38.1
changelog:
  - Security update, synced from hotfix XS82ECU1057
  - *** Upstream changelog ***
  - * Mon Nov 6 2023 Andrew Cooper <andrew.cooper3@citrix.com> - 4.13.5-9.38
  - - Fixes for
  -   - XSA-445 CVE-2023-46835
  -   - XSA-446 CVE-2023-46836
  - - Fix for AMD erratum #1485, which has been observed to cause #UD exception on AMD Zen4 systems.


author: David Morel <david.morel@vates.tech> - 4.13.5-9.39.1
changelog:
  - Security update, synced from hotfix XS82ECU1061
  - Replace our fix for XSA-449
  - *** Upstream changelog ***
  - * Fri Mar  8 2024 Andrew Cooper <andrew.cooper3@citrix.com> - 4.13.5-9.39
  - - Fixes for:
  -   - XSA-449 CVE-2023-46839
  -   - XSA-453 CVE-2024-2193, off by default
  -   - XSA-452 CVE-2023-28746


author: David Morel <david.morel@vates.tech> - 4.13.5-9.40.1
changelog:
  - Security update, synced from hotfix XS82ECU1062
  - *** Upstream changelog ***
  - * Mon Apr  8 2024 Andrew Cooper <andrew.cooper3@citrix.com> - 4.13.5-9.40
  - - Fixes for:
  -   - XSA-454 CVE-2023-46842
  -   - XSA-455 CVE-2024-31142
  -   - XSA-456 CVE-2024-2201


author: David Morel <david.morel@vates.tech> - 4.13.5-9.40.2
changelog:
  - Security update
  - Fix for:
    - XSA-458 CVE-2024-31143: fixing double unlock in x86 guest IRQ handling


author: David Morel <david.morel@vates.tech> - 4.13.5-9.40.3
changelog:
  - Security update
  - Fix for:
    - XSA-460 CVE-2024-31145 - error handling in x86 IOMMU identity mapping
    - XSA-461 CVE-2024-31146 - PCI device pass-through with shared resources


