The Xen Project reports :

The XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

A malicious or buggy 64-bit PV guest may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks.

The version of Citrix XenServer installed on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists when invoking the instruction emulator     that is triggered during the handling of SYSCALL by     single-stepping applications. A local attacker can     exploit this to execute code with elevated privileges     on the guest. (CVE-2016-10013)

  - An out-of-array memory access error exists in the     memory_exchange() function within file common/memory.c     due to improper checking of XENMEM_exchange input. An     attacker on a 64-bit PV guest VM who has administrative     privileges can exploit this issue to access arbitrary     system memory locations, which can then be potentially     used for further compromising the host. (CVE-2017-7228)

  - A memory leak issue exits due to improper cleanup being     performed during guest destruction. An attacker on the     guest can exploit this, by repeatedly rebooting, to     exhaust memory on the host system, resulting in a denial     of service condition.

Qemu: 9pfs: host memory leakage via v9fs_create [CVE-2017-7377] (#1437873)

----

add additional patch for [XSA-206] (#1436690)

----

xenstore denial of service via repeated update [XSA-206] (#1436690)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0095 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0096 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0039 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details.

This update for xen to version 4.7.2 fixes the following issues: These security issues were fixed :

  - CVE-2017-7228: Broken check in memory_exchange()     permited PV guest breakout (bsc#1030442).

  - XSA-206: Unprivileged guests issuing writes to xenstore     were able to stall progress of the control domain or     driver domain, possibly leading to a Denial of Service     (DoS) of the entire host (bsc#1030144).

  - CVE-2017-6505: The ohci_service_ed_list function in     hw/usb/hcd-ohci.c allowed local guest OS users to cause     a denial of service (infinite loop) via vectors     involving the number of link endpoint list descriptors     (bsc#1028235).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an out-of-array memory access error in the memory_exchange() function in file common/memory.c due to improper checking of XENMEM_exchange input. An attacker on a 64-bit PV guest VM who has administrative privileges can exploit this issue to access arbitrary system memory locations, which can then be potentially used for further compromising the host.

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0142 for details.

Qemu: 9pfs: host memory leakage via v9fs_create [CVE-2017-7377] (#1437873) x86: broken check in memory_exchange() permits PV guest breakout [XSA-212, CVE-2017-7228] (#1438804)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following security issues :

  - CVE-2017-7228: Broken check in memory_exchange()     permited PV guest breakout (bsc#1030442).

  - CVE-2017-6414: Memory leak in the vcard_apdu_new     function in card_7816.c in libcacard allowed local guest     OS users to cause a denial of service (host memory     consumption) via vectors related to allocating a new     APDU object (bsc#1027570).

  - CVE-2017-6505: The ohci_service_ed_list function in     hw/usb/hcd-ohci.c allowed local guest OS users to cause     a denial of service (infinite loop) via vectors     involving the number of link endpoint list descriptors     (bsc#1028235).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues: These security issues were fixed :

  - CVE-2017-7228: Broken check in memory_exchange()     permited PV guest breakout (bsc#1030442).

  - XSA-206: Unprivileged guests issuing writes to xenstore     were able to stall progress of the control domain or     driver domain, possibly leading to a Denial of Service     (DoS) of the entire host (bsc#1030144).

  - CVE-2017-6505: The ohci_service_ed_list function in     hw/usb/hcd-ohci.c allowed local guest OS users to cause     a denial of service (infinite loop) via vectors     involving the number of link endpoint list descriptors     (bsc#1028235).

  - CVE-2017-6414: Memory leak in the vcard_apdu_new     function in card_7816.c in libcacard allowed local guest     OS users to cause a denial of service (host memory     consumption) via vectors related to allocating a new     APDU object (bsc#1027570).

  - CVE-2017-2633: The VNC display driver support was     vulnerable to an out-of-bounds memory access issue. A     user/process inside guest could use this flaw to cause     DoS (bsc#1026636).

  - CVE-2016-9603: A privileged user within the guest VM can     cause a heap overflow in the device model process,     potentially escalating their privileges to that of the     device model process (bsc#1028655).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-7228 (XSA-212)

An insufficient check on XENMEM_exchange may allow PV guests to access all of system memory.

For Debian 7 'Wheezy', these problems have been fixed in version 4.1.6.lts1-6.

We recommend that you upgrade your xen packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
99240	FreeBSD : xen-kernel -- broken check in memory_exchange() permits PV guest breakout (90becf7c-1acf-11e7-970f-002590263bf5)	Nessus	FreeBSD Local Security Checks	2017/4/7	2025/12/26	high
99377	Citrix XenServer multiple vulnerabilities (CTX222565)	Nessus	Misc.	2017/4/14	2025/12/25	high
99405	Fedora 24 : xen (2017-03dc811be6)	Nessus	Fedora Local Security Checks	2017/4/17	2025/12/25	high
99976	OracleVM 3.3 : xen (OVMSA-2017-0095)	Nessus	OracleVM Local Security Checks	2017/5/4	2025/12/22	critical
99977	OracleVM 3.2 : xen (OVMSA-2017-0096)	Nessus	OracleVM Local Security Checks	2017/5/4	2025/12/22	critical
140019	OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	2020/8/28	2026/1/9	critical
111992	OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	2018/8/20	2026/1/9	critical
99302	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:0983-1)	Nessus	SuSE Local Security Checks	2017/4/12	2025/12/26	high
99399	Xen Hypervisor XENMEM_exchange Memory Disclosure (XSA-212)	Nessus	Misc.	2017/4/14	2025/12/25	high
102835	OracleVM 3.4 : xen (OVMSA-2017-0142)	Nessus	OracleVM Local Security Checks	2017/8/30	2025/11/25	critical
99256	Fedora 25 : xen (2017-054729ab08)	Nessus	Fedora Local Security Checks	2017/4/10	2025/12/26	high
99507	SUSE SLES11 Security Update : xen (SUSE-SU-2017:1058-1)	Nessus	SuSE Local Security Checks	2017/4/20	2025/12/25	high
99579	SUSE SLES12 Security Update : xen (SUSE-SU-2017:1080-1)	Nessus	SuSE Local Security Checks	2017/4/21	2025/12/23	critical
99601	Debian DLA-907-1 : xen security update	Nessus	Debian Local Security Checks	2017/4/24	2025/12/23	high

检测

插件搜索

high

high

high

critical

critical

critical

critical

high

high

critical

high

high

critical

high