pin count / page reference race in grant table code [XSA-236, CVE-2017-15597] (#1506693)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, informations leaks or privilege escalation.

For Debian 8 'Jessie', these problems have been fixed in version 4.4.4lts2-0+deb8u1.

We recommend that you upgrade your xen packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.9.1 (bsc#1027519) fixes several issues. This new feature was added :

  - Support migration of HVM domains larger than 1 TB These     security issues were fixed :

  - bsc#1068187: Failure to recognize errors in the Populate     on Demand (PoD) code allowed for DoS (XSA-246)

  - bsc#1068191: Missing p2m error checking in PoD code     allowed unprivileged guests to retain a writable mapping     of freed memory leading to information leaks, privilege     escalation or DoS (XSA-247).

  - CVE-2017-15289: The mode4and5 write functions allowed     local OS guest privileged users to cause a denial of     service (out-of-bounds write access and Qemu process     crash) via vectors related to dst calculation     (bsc#1063123)

  - CVE-2017-15597: A grant copy operation being done on a     grant of a dying domain allowed a malicious guest     administrator to corrupt hypervisor memory, allowing for     DoS or potentially privilege escalation and information     leaks (bsc#1061075).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues. These security issues were fixed :

  - bsc#1068187: Failure to recognize errors in the Populate     on Demand (PoD) code allowed for DoS (XSA-246)

  - bsc#1068191: Missing p2m error checking in PoD code     allowed unprivileged guests to retain a writable mapping     of freed memory leading to information leaks, privilege     escalation or DoS (XSA-247).

  - CVE-2017-15289: The mode4and5 write functions allowed     local OS guest privileged users to cause a denial of     service (out-of-bounds write access and Qemu process     crash) via vectors related to dst calculation     (bsc#1063123)

  - CVE-2017-15597: A grant copy operation being done on a     grant of a dying domain allowed a malicious guest     administrator to corrupt hypervisor memory, allowing for     DoS or potentially privilege escalation and information     leaks (bsc#1061075).

  - CVE-2017-15595: x86 PV guest OS users were able to cause     a DoS (unbounded recursion, stack consumption, and     hypervisor crash) or possibly gain privileges via     crafted page-table stacking (bsc#1061081).

  - CVE-2017-15592: x86 HVM guest OS users were able to     cause a DoS (hypervisor crash) or possibly gain     privileges because self-linear shadow mappings were     mishandled for translated guests (bsc#1061086).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.9.1 (bsc#1027519) fixes several issues.

This new feature was added :

  - Support migration of HVM domains larger than 1 TB

These security issues were fixed :

  - bsc#1068187: Failure to recognize errors in the Populate     on Demand (PoD) code allowed for DoS (XSA-246)

  - bsc#1068191: Missing p2m error checking in PoD code     allowed unprivileged guests to retain a writable mapping     of freed memory leading to information leaks, privilege     escalation or DoS (XSA-247).

  - CVE-2017-15289: The mode4and5 write functions allowed     local OS guest privileged users to cause a denial of     service (out-of-bounds write access and Qemu process     crash) via vectors related to dst calculation     (bsc#1063123)

  - CVE-2017-15597: A grant copy operation being done on a     grant of a dying domain allowed a malicious guest     administrator to corrupt hypervisor memory, allowing for     DoS or potentially privilege escalation and information     leaks (bsc#1061075).

This non-security issue was fixed :

  - bsc#1055047: Fixed --initrd-inject option in     virt-install 

This update was imported from the SUSE:SLE-12-SP3:Update update project.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin     would be accompanied by a suitable page reference. Other portions of code, however, did not match up with     that assumption. When such a grant copy operation is being done on a grant of a dying domain, the     assumption turns out wrong. A malicious guest administrator can cause hypervisor memory corruption, most     likely resulting in host crash and a Denial of Service. Privilege escalation and information leaks cannot     be ruled out. (CVE-2017-15597)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
105998	Fedora 27 : xen (2017-f05808ee5b)	Nessus	Fedora Local Security Checks	2018/1/15	2025/11/4	critical
118215	Debian DLA-1549-1 : xen security update	Nessus	Debian Local Security Checks	2018/10/19	2024/7/30	critical
104870	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:3115-1)	Nessus	SuSE Local Security Checks	2017/11/30	2025/11/13	critical
105033	SUSE SLES11 Security Update : xen (SUSE-SU-2017:3212-1)	Nessus	SuSE Local Security Checks	2017/12/6	2025/11/12	critical
105221	openSUSE Security Update : xen (openSUSE-2017-1321)	Nessus	SuSE Local Security Checks	2017/12/14	2025/11/12	critical
220773	Linux Distros Unpatched Vulnerability : CVE-2017-15597	Nessus	Misc.	2025/3/4	2025/8/26	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical