As per Debian Security Advisory of 06 Nov 2022:
https://www.debian.org/security/2022/dsa-5272
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation, denial of service or information leaks.
The advisory also mentions they have been fixed in Debian bullseye, but what does this all mean for Qubes OS users?
nvm
Every vulnerability in Xen is reviewed by the Qubes security team.
The result of that review is noted on the web site, and a note made here, and on the mailing list.
Some Xen vulnerabilities impact Qubes - these are highlighted in the
review and a separate Qubes Security Bulletin is issued.
again, these are on the web site, here,
and posts made in the Forum, and on the mailing list.
The QSB contains information on what user action is required. Usually
the Qubes security team provide patches or updated packages earlier than
other distros.
In this case the vulnerabilities were released on 11-01, the Qubes
analysis identified only one (CVE-2022-42309) impacting Qubes, and a QSB
issued on 11-01, with details of the available updated package.
The Debian advisory and updated packages was issued on 11-06.
I strongly recommend that users keep an eye out for QSB notices, and
check out the site. Updated
packages are in the security-testing repository first before migrating to
current - if you want to be ahead of the game enable that repository in
dom0. (There is some risk in doing so - that’s why it is a testing
repository)
So, could it be that those crashes, freezes and reboots were caused by this (and ddos by other vulnerabilities, while ddos is not counted by Qubes devs as affecting the security of Qubes OS)?
Since I still experience freeze and reboot, i suspect not.
Well, what (rhetorically)? Maybe you should revise your threat model, hahaha.