OracleVM 3.4:xen (OVMSA-2018-0221)

high Nessus 插件 ID 109989

简介

远程 OracleVM 主机缺少一个或多个安全更新。

描述

远程 OracleVM 系统缺少解决关键安全更新的必要补丁:

- BUILDINFO:OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8

- BUILDINFO:xen commit=5ee0a217664a1fde547afa506e92e4998ed26699

- BUILDINFO:QEMU 上游 commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

- BUILDINFO:传统 QEMU commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

- BUILDINFO:IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e

- BUILDINFO:SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee

- Red-tape:使用 CVE XSA-262 更新 repo (Boris Ostrovsky) [Orabug:27948889] (CVE-2018-10981)

- Red-tape:使用 CVE XSA-261 更新 repo (Boris Ostrovsky) [Orabug:27948864] (CVE-2018-10982)

- BUILDINFO:OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8

- BUILDINFO:xen commit=a20dadee84429112c3b5f245180f72d990063d20

- BUILDINFO:QEMU 上游 commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

- BUILDINFO:传统 QEMU commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

- BUILDINFO:IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e

- BUILDINFO:SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee

- x86/HVM:防止仿真器以奇怪的方式驱动 ioreq 状态 (Jan Beulich) [Orabug:27948889]

- x86/vpt:添加对 IO-APIC 路由中断的支持 (Xen Project Security Team) [Orabug:27948864]

- BUILDINFO:OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8

- BUILDINFO:xen commit=c6b30b4f49430b1314928a4d98a5e9e754895e4d

- BUILDINFO:QEMU 上游 commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

- BUILDINFO:传统 QEMU commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

- BUILDINFO:IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e

- BUILDINFO:SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee

- vnuma:即使 vnuma 关闭,仍可以取消设置 smt (Elena Ufimtseva) [Orabug:27950640]

- x86/paging:请勿无条件地寻找 SHARED_M2P_ENTRY 中的错误 (Jan Beulich) [Orabug:27965254] (CVE-2017-17565)

- x86/mm:请勿错误地设置页面所有权 (Jan Beulich) [Orabug:27965236] (CVE-2017-17566)

- misc/xenmicrocode:将 /lib/firmware/<some blob> 上传到管理程序 (Konrad Rzeszutek Wilk) [Orabug:
27957822]

- BUILDINFO:OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8

- BUILDINFO:xen commit=75ac5267506600d4587b80daae6bb694099e2c03

- BUILDINFO:QEMU 上游 commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

- BUILDINFO:传统 QEMU commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

- BUILDINFO:IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e

- BUILDINFO:SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee

- x86/traps:修复管理程序上下文中的#DB 异常处理 (Andrew Cooper) [Orabug:27963989] (CVE-2018-8897)

- x86/traps:将中断堆栈表用于 #DB (Andrew Cooper) [Orabug:27963989] (CVE-2018-8897)

- x86/pv:将异常注入移至 [,compat_]test_all_events (Andrew Cooper) [Orabug:
27963989] (CVE-2018-8897)

- x86/traps:修复 #DB 处理程序中的 %dr6 处理 (Andrew Cooper) [Orabug:27963989] (CVE-2018-8897)

- x86/traps:对 set_debugreg 进行的多项无效改进 (Andrew Cooper) [Orabug:27963989] (CVE-2018-8897)

- x86/pv:set_debugreg 中存在数个错误 (Ross Philipson) [Orabug:27963989] (CVE-2018-8897)

- x86/pv:do_get_debugreg CR4.DE 条件已反转。(Ross Philipson) [Orabug:27963989] (CVE-2018-8897)

- BUILDINFO:OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8

- BUILDINFO:xen commit=d787e7a9d35cc2880b525f1d7a35f27969590f4c

- BUILDINFO:QEMU 上游 commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

- BUILDINFO:传统 QEMU commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

- BUILDINFO:IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e

- BUILDINFO:SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee

- vnuma:请勿打开 vcpus 奇数的 smt (Elena Ufimtseva)

解决方案

更新受影响的 xen/xen-tools 程序包。

另见

https://oss.oracle.com/pipermail/oraclevm-errata/2018-May/000857.html

插件详情

严重性: High

ID: 109989

文件名: oraclevm_OVMSA-2018-0221.nasl

版本: 1.11

类型: local

发布时间: 2018/5/23

最近更新时间: 2024/10/3

支持的传感器: Nessus

风险信息

VPR

风险因素: Critical

分数: 9.5

CVSS v2

风险因素: High

基本分数: 7.2

时间分数: 6.3

矢量: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS 分数来源: CVE-2018-8897

CVSS v3

风险因素: High

基本分数: 8.8

时间分数: 8.4

矢量: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

时间矢量: CVSS:3.0/E:H/RL:O/RC:C

CVSS 分数来源: CVE-2018-10982

漏洞信息

CPE: p-cpe:/a:oracle:vm:xen, p-cpe:/a:oracle:vm:xen-tools, cpe:/o:oracle:vm_server:3.4

必需的 KB 项: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list

可利用: true

易利用性: Exploits are available

补丁发布日期: 2018/5/22

漏洞发布日期: 2017/12/12

可利用的方式

Metasploit (Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability)

参考资料信息

CVE: CVE-2017-17565, CVE-2017-17566, CVE-2018-10981, CVE-2018-10982, CVE-2018-8897