XEN received various security and bugfixes :

  - CVE-2012-4535: xen: Timer overflow DoS vulnerability     (XSA-20)

  - CVE-2012-4537: xen: Memory mapping failure DoS     vulnerability (XSA-22)

The following additional bugs have been fixed :

  - bnc#784087 - L3: Xen BUG at io_apic.c:129     26102-x86-IOAPIC-legacy-not-first.patch

  - Upstream patches from Jan     25927-x86-domctl-ioport-mapping-range.patch     25931-x86-domctl-iomem-mapping-checks.patch     26061-x86-oprof-counter-range.patch     25431-x86-EDD-MBR-sig-check.patch     25480-x86_64-sysret-canonical.patch     25481-x86_64-AMD-erratum-121.patch     25485-x86_64-canonical-checks.patch     25587-param-parse-limit.patch     25589-pygrub-size-limits.patch     25744-hypercall-return-long.patch     25765-x86_64-allow-unsafe-adjust.patch     25773-x86-honor-no-real-mode.patch     25786-x86-prefer-multiboot-meminfo-over-e801.patch     25808-domain_create-return-value.patch     25814-x86_64-set-debugreg-guest.patch     24742-gnttab-misc.patch 25098-x86-emul-lock-UD.patch     25200-x86_64-trap-bounce-flags.patch     25271-x86_64-IST-index.patch bnc#651093 - win2k8 guests     are unable to restore after saving the vms state     ept-novell-x64.patch 23800-x86_64-guest-addr-range.patch     24168-x86-vioapic-clear-remote_irr.patch     24453-x86-vIRQ-IRR-TMR-race.patch     24456-x86-emul-lea.patch

    bnc#713555 - Unable to install RHEL 6.1 x86 as a     paravirtualized guest OS on SLES 10 SP4 x86     vm-install-0.2.19.tar.bz2

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201604-03 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly cause a Denial of Service condition or       obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

a malicious 64-bit PV guest can crash the dom0 [XSA-12, CVE-2012-3494] (#854585) a malicious crash might be able to crash the dom0 or escalate privileges [XSA-13, CVE-2012-3495] (#854589) a malicious PV guest can crash the dom0 [XSA-14, CVE-2012-3496] (#854590) a malicious HVM guest can crash the dom0 and might be able to read hypervisor or guest memory [XSA-16, CVE-2012-3498] (#854593) an HVM guest could use VT100 escape sequences to escalate privileges to that of the qemu process [XSA-17, CVE-2012-3515] (#854599) disable qemu monitor by default [XSA-19, CVE-2012-4411] (#855141)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libvirt received security and bugfixes :

  - Fixed a libvirt remote denial of service (crash)     problem. The following bugs have been fixed :.
    (CVE-2012-4423)

  - qemu: Fix probing for guest capabilities

  - xen-xm: Generate UUID if not specified

  - xenParseXM: don't dereference NULL pointer when script     is empty

This security update of XEN fixes various bugs and security issues.

  - Upstream patch 26088-xend-xml-filesize-check.patch

  - bnc#787163 - CVE-2012-4544: xen: Domain builder Out-of-     memory due to malicious kernel/ramdisk (XSA 25)     CVE-2012-4544-xsa25.patch

  - bnc#779212 - CVE-2012-4411: XEN / qemu: guest     administrator can access qemu monitor console (XSA-19)     CVE-2012-4411-xsa19.patch

  - bnc#786516 - CVE-2012-4535: xen: Timer overflow DoS     vulnerability CVE-2012-4535-xsa20.patch

  - bnc#786518 - CVE-2012-4536: xen: pirq range check DoS     vulnerability CVE-2012-4536-xsa21.patch

  - bnc#786517 - CVE-2012-4537: xen: Memory mapping failure     DoS vulnerability CVE-2012-4537-xsa22.patch

  - bnc#786519 - CVE-2012-4538: xen: Unhooking empty PAE     entries DoS vulnerability CVE-2012-4538-xsa23.patch

  - bnc#786520 - CVE-2012-4539: xen: Grant table hypercall     infinite loop DoS vulnerability     CVE-2012-4539-xsa24.patch

  - bnc#784087 - L3: Xen BUG at io_apic.c:129     26102-x86-IOAPIC-legacy-not-first.patch

  - Upstream patches from Jan     26054-x86-AMD-perf-ctr-init.patch     26055-x86-oprof-hvm-mode.patch     26056-page-alloc-flush-filter.patch     26061-x86-oprof-counter-range.patch     26062-ACPI-ERST-move-data.patch     26063-x86-HPET-affinity-lock.patch     26093-HVM-PoD-grant-mem-type.patch

  - Upstream patches from Jan     25931-x86-domctl-iomem-mapping-checks.patch     25952-x86-MMIO-remap-permissions.patch

  - Upstream patches from Jan     25808-domain_create-return-value.patch     25814-x86_64-set-debugreg-guest.patch     25815-x86-PoD-no-bug-in-non-translated.patch     25816-x86-hvm-map-pirq-range-check.patch     25833-32on64-bogus-pt_base-adjust.patch     25834-x86-S3-MSI-resume.patch     25835-adjust-rcu-lock-domain.patch     25836-VT-d-S3-MSI-resume.patch 25850-tmem-xsa-15-1.patch     25851-tmem-xsa-15-2.patch 25852-tmem-xsa-15-3.patch     25853-tmem-xsa-15-4.patch 25854-tmem-xsa-15-5.patch     25855-tmem-xsa-15-6.patch 25856-tmem-xsa-15-7.patch     25857-tmem-xsa-15-8.patch 25858-tmem-xsa-15-9.patch     25859-tmem-missing-break.patch 25860-tmem-cleanup.patch     25883-pt-MSI-cleanup.patch     25927-x86-domctl-ioport-mapping-range.patch     25929-tmem-restore-pool-version.patch

  - bnc#778105 - first XEN-PV VM fails to spawn xend:
    Increase wait time for disk to appear in host bootloader     Modified existing xen-domUloader.diff

  - Upstream patches from Jan     25752-ACPI-pm-op-valid-cpu.patch     25754-x86-PoD-early-access.patch     25755-x86-PoD-types.patch     25756-x86-MMIO-max-mapped-pfn.patch     25757-x86-EPT-PoD-1Gb-assert.patch     25764-x86-unknown-cpu-no-sysenter.patch     25765-x86_64-allow-unsafe-adjust.patch     25771-grant-copy-status-paged-out.patch     25773-x86-honor-no-real-mode.patch     25786-x86-prefer-multiboot-meminfo-over-e801.patch

  - bnc#777890 - CVE-2012-3497: xen: multiple TMEM hypercall     vulnerabilities (XSA-15)     CVE-2012-3497-tmem-xsa-15-1.patch     CVE-2012-3497-tmem-xsa-15-2.patch     CVE-2012-3497-tmem-xsa-15-3.patch     CVE-2012-3497-tmem-xsa-15-4.patch     CVE-2012-3497-tmem-xsa-15-5.patch     CVE-2012-3497-tmem-xsa-15-6.patch     CVE-2012-3497-tmem-xsa-15-7.patch     CVE-2012-3497-tmem-xsa-15-8.patch     CVE-2012-3497-tmem-xsa-15-9.patch     tmem-missing-break.patch

Multiple vulnerabilities have been discovered in xen-qemu-dm-4.0, the Xen QEMU Device Model virtual machine hardware emulator. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2012-3515 :
    The device model for HVM domains does not properly     handle VT100 escape sequences when emulating certain     devices with a virtual console backend. An attacker     within a guest with access to the vulnerable virtual     console could overwrite memory of the device model and     escalate privileges to that of the device model process.

  - CVE-2012-4411 :
    The QEMU monitor was enabled by default, allowing     administrators of a guest to access resources of the     host, possibly escalate privileges or access resources     belonging to another guest.

disable qemu monitor by default [XSA-19, CVE-2012-4411] (#855141)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

XEN was updated to fix various bugs and security issues :

The following security issues have been fixed :

  - xen: Domain builder Out-of-memory due to malicious     kernel/ramdisk (XSA 25). (CVE-2012-4544)

  - XEN / qemu: guest administrator can access qemu monitor     console (XSA-19). (CVE-2012-4411)

  - xen: Timer overflow DoS vulnerability (XSA 20).
    (CVE-2012-4535)

  - xen: pirq range check DoS vulnerability (XSA 21).
    (CVE-2012-4536)

  - xen: Memory mapping failure DoS vulnerability (XSA 22).
    (CVE-2012-4537)

  - xen: Unhooking empty PAE entries DoS vulnerability (XSA     23). (CVE-2012-4538)

  - xen: Grant table hypercall infinite loop DoS     vulnerability (XSA 24). (CVE-2012-4539)

  - xen: multiple TMEM hypercall vulnerabilities (XSA-15)     Also the following bugs have been fixed and upstream     patches have been applied:. (CVE-2012-3497)

  - L3: Xen BUG at io_apic.c:129     26102-x86-IOAPIC-legacy-not-first.patch. (bnc#784087)

  - Upstream patches merged:
    26054-x86-AMD-perf-ctr-init.patch     26055-x86-oprof-hvm-mode.patch     26056-page-alloc-flush-filter.patch     26061-x86-oprof-counter-range.patch     26062-ACPI-ERST-move-data.patch     26063-x86-HPET-affinity-lock.patch     26093-HVM-PoD-grant-mem-type.patch     25931-x86-domctl-iomem-mapping-checks.patch     25952-x86-MMIO-remap-permissions.patch     25808-domain_create-return-value.patch     25814-x86_64-set-debugreg-guest.patch     25815-x86-PoD-no-bug-in-non-translated.patch     25816-x86-hvm-map-pirq-range-check.patch     25833-32on64-bogus-pt_base-adjust.patch     25834-x86-S3-MSI-resume.patch     25835-adjust-rcu-lock-domain.patch     25836-VT-d-S3-MSI-resume.patch 25850-tmem-xsa-15-1.patch     25851-tmem-xsa-15-2.patch 25852-tmem-xsa-15-3.patch     25853-tmem-xsa-15-4.patch 25854-tmem-xsa-15-5.patch     25855-tmem-xsa-15-6.patch 25856-tmem-xsa-15-7.patch     25857-tmem-xsa-15-8.patch 25858-tmem-xsa-15-9.patch     25859-tmem-missing-break.patch 25860-tmem-cleanup.patch     25883-pt-MSI-cleanup.patch     25927-x86-domctl-ioport-mapping-range.patch     25929-tmem-restore-pool-version.patch

  - first XEN-PV VM fails to spawn xend: Increase wait time     for disk to appear in host bootloader Modified existing     xen-domUloader.diff. (bnc#778105)

    25752-ACPI-pm-op-valid-cpu.patch     25754-x86-PoD-early-access.patch     25755-x86-PoD-types.patch     25756-x86-MMIO-max-mapped-pfn.patch

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Xen Security Advisory CVE-2012-4411 / XSA-19 version 2     guest administrator can access qemu monitor console     Disable qemu monitor by default. The qemu monitor is an     overly powerful feature which must be protected from     untrusted (guest) administrators. (CVE-2012-4411)

  - fix xm create vcpu_avail exceeds XMLRPC int limits If     maxvcpus = vcpus = 40, (1<<40 -1) will exceed XMLRPC int     limit. Change it to str will work. Then in the xend     side, it will converted back to int. (CVE-2012-3515)

This security update of XEN fixes various bugs and security issues.

  - Upstream patch 26088-xend-xml-filesize-check.patch

  - bnc#787163 - CVE-2012-4544: xen: Domain builder Out-of-     memory due to malicious kernel/ramdisk (XSA 25)     CVE-2012-4544-xsa25.patch

  - bnc#779212 - CVE-2012-4411: XEN / qemu: guest     administrator can access qemu monitor console (XSA-19)     CVE-2012-4411-xsa19.patch

  - bnc#786516 - CVE-2012-4535: xen: Timer overflow DoS     vulnerability CVE-2012-4535-xsa20.patch

  - bnc#786518 - CVE-2012-4536: xen: pirq range check DoS     vulnerability CVE-2012-4536-xsa21.patch

  - bnc#786517 - CVE-2012-4537: xen: Memory mapping failure     DoS vulnerability CVE-2012-4537-xsa22.patch

  - bnc#786519 - CVE-2012-4538: xen: Unhooking empty PAE     entries DoS vulnerability CVE-2012-4538-xsa23.patch

  - bnc#786520 - CVE-2012-4539: xen: Grant table hypercall     infinite loop DoS vulnerability     CVE-2012-4539-xsa24.patch

  - bnc#784087 - L3: Xen BUG at io_apic.c:129     26102-x86-IOAPIC-legacy-not-first.patch

  - Upstream patches from Jan     26054-x86-AMD-perf-ctr-init.patch     26055-x86-oprof-hvm-mode.patch     26056-page-alloc-flush-filter.patch     26061-x86-oprof-counter-range.patch     26062-ACPI-ERST-move-data.patch     26063-x86-HPET-affinity-lock.patch     26093-HVM-PoD-grant-mem-type.patch

  - Upstream patches from Jan     25931-x86-domctl-iomem-mapping-checks.patch     25952-x86-MMIO-remap-permissions.patch

------------------------------------------------------------------- Mon Sep 24 16:41:58 CEST 2012 - ohering@suse.de

  - use BuildRequires: gcc46 only in sles11sp2 or 12.1 to     fix build in 11.4

------------------------------------------------------------------- Thu Sep 20 10:03:40 MDT 2012 - carnold@novell.com

  - Upstream patches from Jan     25808-domain_create-return-value.patch     25814-x86_64-set-debugreg-guest.patch     25815-x86-PoD-no-bug-in-non-translated.patch     25816-x86-hvm-map-pirq-range-check.patch     25833-32on64-bogus-pt_base-adjust.patch     25834-x86-S3-MSI-resume.patch     25835-adjust-rcu-lock-domain.patch     25836-VT-d-S3-MSI-resume.patch 25850-tmem-xsa-15-1.patch     25851-tmem-xsa-15-2.patch 25852-tmem-xsa-15-3.patch     25853-tmem-xsa-15-4.patch 25854-tmem-xsa-15-5.patch     25855-tmem-xsa-15-6.patch 25856-tmem-xsa-15-7.patch     25857-tmem-xsa-15-8.patch 25858-tmem-xsa-15-9.patch     25859-tmem-missing-break.patch 25860-tmem-cleanup.patch     25883-pt-MSI-cleanup.patch     25927-x86-domctl-ioport-mapping-range.patch     25929-tmem-restore-pool-version.patch

  - bnc#778105 - first XEN-PV VM fails to spawn xend:
    Increase wait time for disk to appear in host bootloader     Modified existing xen-domUloader.diff

  - Upstream patches from Jan     25752-ACPI-pm-op-valid-cpu.patch     25754-x86-PoD-early-access.patch     25755-x86-PoD-types.patch     25756-x86-MMIO-max-mapped-pfn.patch     25757-x86-EPT-PoD-1Gb-assert.patch     25764-x86-unknown-cpu-no-sysenter.patch     25765-x86_64-allow-unsafe-adjust.patch     25771-grant-copy-status-paged-out.patch     25773-x86-honor-no-real-mode.patch     25786-x86-prefer-multiboot-meminfo-over-e801.patch

  - bnc#777890 - CVE-2012-3497: xen: multiple TMEM hypercall     vulnerabilities (XSA-15)     CVE-2012-3497-tmem-xsa-15-1.patch     CVE-2012-3497-tmem-xsa-15-2.patch     CVE-2012-3497-tmem-xsa-15-3.patch     CVE-2012-3497-tmem-xsa-15-4.patch     CVE-2012-3497-tmem-xsa-15-5.patch     CVE-2012-3497-tmem-xsa-15-6.patch     CVE-2012-3497-tmem-xsa-15-7.patch     CVE-2012-3497-tmem-xsa-15-8.patch     CVE-2012-3497-tmem-xsa-15-9.patch     tmem-missing-break.patch

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
83564	SUSE SLED10 / SLES10 Security Update : Xen (SUSE-SU-2012:1487-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	medium
90380	GLSA-201604-03 : Xen: Multiple vulnerabilities (Venom)	Nessus	Gentoo Local Security Checks	2016/4/7	2021/1/11	critical
62155	Fedora 16 : xen-4.1.3-2.fc16 (2012-13443)	Nessus	Fedora Local Security Checks	2012/9/18	2021/1/11	high
64201	SuSE 11.2 Security Update : libvirt (SAT Patch Number 7015)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	medium
74820	openSUSE Security Update : XEN (openSUSE-SU-2012:1572-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
62014	Debian DSA-2543-1 : xen-qemu-dm-4.0 - multiple vulnerabilities	Nessus	Debian Local Security Checks	2012/9/10	2021/1/11	high
62160	Fedora 18 : xen-4.1.3-4.fc18 (2012-13536)	Nessus	Fedora Local Security Checks	2012/9/18	2021/1/11	medium
64238	SuSE 11.2 Security Update : Xen (SAT Patch Number 7018)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	medium
79485	OracleVM 3.1 : xen (OVMSA-2012-0046)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/4	high
74821	openSUSE Security Update : XEN (openSUSE-SU-2012:1573-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high

检测

插件搜索

medium

critical

high

medium

high

high

medium

medium

high

high