Multiple vulnerabilities have been discovered in the Xen hypervisor.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2016-7777 (XSA-190)     Jan Beulich from SUSE discovered that Xen does not     properly honor CR0.TS and CR0.EM for x86 HVM guests,     potentially allowing guest users to read or modify FPU,     MMX, or XMM register state information belonging to     arbitrary tasks on the guest by modifying an instruction     while the hypervisor is preparing to emulate it.

  - CVE-2016-9379, CVE-2016-9380 (XSA-198)     Daniel Richman and Gabor Szarka of the Cambridge     University Student-Run Computing Facility discovered     that pygrub, the boot loader emulator, fails to quote     (or sanity check) its results when reporting them to its     caller. A malicious guest administrator can take     advantage of this flaw to cause an information leak or     denial of service.

  - CVE-2016-9382 (XSA-192)     Jan Beulich of SUSE discovered that Xen does not     properly handle x86 task switches to VM86 mode. A     unprivileged guest process can take advantage of this     flaw to crash the guest or, escalate its privileges to     that of the guest operating system.

  - CVE-2016-9383 (XSA-195)     George Dunlap of Citrix discovered that the Xen x86     64-bit bit test instruction emulation is broken. A     malicious guest can take advantage of this flaw to     modify arbitrary memory, allowing for arbitrary code     execution, denial of service (host crash), or     information leaks.

  - CVE-2016-9385 (XSA-193)     Andrew Cooper of Citrix discovered that Xen's x86     segment base write emulation lacks canonical address     checks. A malicious guest administrator can take     advantage of this flaw to crash the host, leading to a     denial of service.

  - CVE-2016-9386 (XSA-191)     Andrew Cooper of Citrix discovered that x86 null     segments are not always treated as unusable. An     unprivileged guest user program may be able to elevate     its privilege to that of the guest operating system.

According to its self-reported version number, the Xen hypervisor installed on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the inject_swint() function in     x86_emulate.c due to improper handling of the format of     IDT lookups when emulating instructions which generate     software interrupts. A guest attacker can exploit this     to crash the host, resulting in a denial of service     condition. (CVE-2016-9377)

  - A flaw exists in the svm_inject_trap() function in svm.c     due to a failure to properly perform IDT privilege     checks when emulating instructions which generate     software interrupts. A guest attacker can exploit this     to crash the host, resulting in a denial of service     condition. (CVE-2016-9378)

  - A flaw exists in the sniff_netware() function in file     tools/pygrub/src/pygrub due to improper handling of     string quotes and S-expressions in the bootloader when     the S-expressions output format is requested. A guest     attacker can exploit this to cause the bootloader     configuration file to produce incorrect output,     resulting in the disclosure or deletion of files from     the host. (CVE-2016-9379)

  - A flaw exists in the sniff_netware() function in file     tools/pygrub/src/pygrub due to improper handling of NULL     bytes in the bootloader when the null-delimited output     format is requested. A guest attacker can exploit this     to cause configuration files to output ambiguous or     confusing results, resulting in the disclosure or     deletion of files from the host. (CVE-2016-9380)

  - A double-fetch flaw exists that is triggered when the     compiler omits QEMU optimizations. A guest attacker can     exploit this to gain elevated privileges on the host.
    (CVE-2016-9381)

  - A flaw exists in the hvm_task_switch() function in hvm.c     due to improper handling of x86 task switching to VM86     mode. A guest attacker can exploit this to cause a     denial of service condition or gain elevated privileges     within the guest environment. (CVE-2016-9382)

  - A flaw exists in the x86_emulate() function in     x86_emulate.c that allows a guest attacker to cause     changes to memory and thereby gain elevated privileges     on the host. (CVE-2016-9383)

  - A flaw exists that is triggered as unused bytes in     image metadata are not properly cleared during symbol     table loading. This may allow a guest attacker to     disclose potentially sensitive information from the     host. (CVE-2016-9384)

  - A flaw exists due to improper clearing of unused bytes     in image metadata during symbol table loading. A guest     attacker can exploit this to disclose sensitive     information from the host. (CVE-2016-9384)

  - A flaw exists in the x86 segment base write emulation     due to a lack of canonical address checks. A guest     attacker can exploit this issue to crash the host,     resulting in a denial of service condition.
    (CVE-2016-9385)

  - A flaw exists in the x86 emulator due to improper     validation of the usability of segments when performing     memory accesses. A guest attacker can exploit this to     gain elevated privileges within the guest environment.
    (CVE-2016-9386)

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
95610	Debian DSA-3729-1 : xen - security update	Nessus	Debian Local Security Checks	2016/12/8	2026/1/15	high
95630	Xen Multiple Vulnerabilities (XSA-191 - XSA-198)	Nessus	Misc.	2016/12/8	2020/7/10	high

检测

插件搜索

high

high