XEN was updated to fix various denial of service issues.

  - bnc#789945 - CVE-2012-5510: xen: Grant table version     switch list corruption vulnerability (XSA-26)

  - bnc#789944 - CVE-2012-5511: xen: Several HVM operations     do not validate the range of their inputs (XSA-27)

  - bnc#789940 - CVE-2012-5512: xen: HVMOP_get_mem_access     crash / HVMOP_set_mem_access information leak (XSA-28)

  - bnc#789951 - CVE-2012-5513: xen: XENMEM_exchange may     overwrite hypervisor memory (XSA-29)

  - bnc#789948 - CVE-2012-5514: xen: Missing unlock in     guest_physmap_mark_populate_on_demand() (XSA-30)

  - bnc#789950 - CVE-2012-5515: xen: Several memory     hypercall operations allow invalid extent order values     (XSA-31)

  - bnc#789988 - FATAL PAGE FAULT in hypervisor     (arch_do_domctl)

  - Upstream patches from Jan     26132-tmem-save-NULL-check.patch     26134-x86-shadow-invlpg-check.patch     26148-vcpu-timer-overflow.patch (Replaces     CVE-2012-4535-xsa20.patch)     26149-x86-p2m-physmap-error-path.patch (Replaces     CVE-2012-4537-xsa22.patch)     26150-x86-shadow-unhook-toplevel-check.patch (Replaces     CVE-2012-4538-xsa23.patch)

  - bnc#777628 - guest 'disappears' after live migration     Updated block-dmmd script

  - Fix exception in balloon.py and osdep.py     xen-max-free-mem.diff

  - bnc#792476 - efi files missing in latest XEN update     Revert c/s 25751 EFI Makefile changes in     23614-x86_64-EFI-boot.patch

The remote host is affected by the vulnerability described in GLSA-201309-24 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Guest domains could possibly gain privileges, execute arbitrary code, or       cause a Denial of Service on the host domain (Dom0). Additionally, guest       domains could gain information about other virtual machines running on       the same host or read arbitrary files on the host.
  Workaround :

    The CVEs listed below do not currently have fixes, but only apply to Xen       setups which have &ldquo;tmem&rdquo; specified on the hypervisor command line.
      TMEM is not currently supported for use in production systems, and       administrators using tmem should disable it.
      Relevant CVEs:
      * CVE-2012-2497
      * CVE-2012-6030
      * CVE-2012-6031
      * CVE-2012-6032
      * CVE-2012-6033
      * CVE-2012-6034
      * CVE-2012-6035
      * CVE-2012-6036

The remote OracleVM system is missing necessary patches to address critical security updates :

  - XSA-20: VCPU/timers: Prevent overflow in calculations     [orabug 15852489] (CVE-2012-4535)

  - XSA-22: Prevent incorrect updates of m2p mappings     [orabug 15852490] (CVE-2012-4537)

  - Increase network hotplug script timeout to 200 (Chuang     Cao) [Orabug 14378502]

XEN received various security and bugfixes :

  - CVE-2012-4535: xen: Timer overflow DoS vulnerability     (XSA-20)

  - CVE-2012-4537: xen: Memory mapping failure DoS     vulnerability (XSA-22)

The following additional bugs have been fixed :

  - bnc#784087 - L3: Xen BUG at io_apic.c:129     26102-x86-IOAPIC-legacy-not-first.patch

  - Upstream patches from Jan     25927-x86-domctl-ioport-mapping-range.patch     25931-x86-domctl-iomem-mapping-checks.patch     26061-x86-oprof-counter-range.patch     25431-x86-EDD-MBR-sig-check.patch     25480-x86_64-sysret-canonical.patch     25481-x86_64-AMD-erratum-121.patch     25485-x86_64-canonical-checks.patch     25587-param-parse-limit.patch     25589-pygrub-size-limits.patch     25744-hypercall-return-long.patch     25765-x86_64-allow-unsafe-adjust.patch     25773-x86-honor-no-real-mode.patch     25786-x86-prefer-multiboot-meminfo-over-e801.patch     25808-domain_create-return-value.patch     25814-x86_64-set-debugreg-guest.patch     24742-gnttab-misc.patch 25098-x86-emul-lock-UD.patch     25200-x86_64-trap-bounce-flags.patch     25271-x86_64-IST-index.patch bnc#651093 - win2k8 guests     are unable to restore after saving the vms state     ept-novell-x64.patch 23800-x86_64-guest-addr-range.patch     24168-x86-vioapic-clear-remote_irr.patch     24453-x86-vIRQ-IRR-TMR-race.patch     24456-x86-emul-lea.patch

    bnc#713555 - Unable to install RHEL 6.1 x86 as a     paravirtualized guest OS on SLES 10 SP4 x86     vm-install-0.2.19.tar.bz2

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201604-03 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly cause a Denial of Service condition or       obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

XEN received various security and bugfixes :

  - xen: Timer overflow DoS vulnerability (XSA-20).
    (CVE-2012-4535)

  - xen: Memory mapping failure DoS vulnerability (XSA-22)     The following additional bugs have beenfixed:.
    (CVE-2012-4537)

  - L3: Xen BUG at io_apic.c:129     26102-x86-IOAPIC-legacy-not-first.patch. (bnc#784087)

  - Upstream patches from Jan     25927-x86-domctl-ioport-mapping-range.patch     25931-x86-domctl-iomem-mapping-checks.patch     26061-x86-oprof-counter-range.patch     25431-x86-EDD-MBR-sig-check.patch     25480-x86_64-sysret-canonical.patch     25481-x86_64-AMD-erratum-121.patch     25485-x86_64-canonical-checks.patch     25587-param-parse-limit.patch     25589-pygrub-size-limits.patch     25744-hypercall-return-long.patch     25765-x86_64-allow-unsafe-adjust.patch     25773-x86-honor-no-real-mode.patch     25786-x86-prefer-multiboot-meminfo-over-e801.patch     25808-domain_create-return-value.patch     25814-x86_64-set-debugreg-guest.patch     24742-gnttab-misc.patch 25098-x86-emul-lock-UD.patch     25200-x86_64-trap-bounce-flags.patch     25271-x86_64-IST-index.patch

  - win2k8 guests are unable to restore after saving the vms     state ept-novell-x64.patch     23800-x86_64-guest-addr-range.patch     24168-x86-vioapic-clear-remote_irr.patch     24453-x86-vIRQ-IRR-TMR-race.patch     24456-x86-emul-lea.patch. (bnc#651093)

  - Unable to install RHEL 6.1 x86 as a paravirtualized     guest OS on SLES 10 SP4 x86 vm-install-0.2.19.tar.bz2.
    (bnc#713555)

Multiple denial of service vulnerabilities have been discovered in the Xen Hypervisor. One of the issue (CVE-2012-5513 ) could even lead to privilege escalation from guest to host.

Some of the recently published Xen Security Advisories ( XSA 25and 28) are not fixed by this update and should be fixed in a future release.

  - CVE-2011-3131 ( XSA 5): DoS using I/OMMU faults from     PCI-passthrough guest     A VM that controls a PCI[E] device directly can cause it     to issue DMA requests to invalid addresses. Although     these requests are denied by the I/OMMU, the hypervisor     needs to handle the interrupt and clear the error from     the I/OMMU, and this can be used to live-lock a CPU and     potentially hang the host.

  - CVE-2012-4535 ( XSA 20): Timer overflow DoS     vulnerability

    A guest which sets a VCPU with an inappropriate deadline     can cause an infinite loop in Xen, blocking the affected     physical CPU indefinitely.

  - CVE-2012-4537 ( XSA 22): Memory mapping failure DoS     vulnerability

    When set_p2m_entry fails, Xen's internal data structures     (the p2m and m2p tables) can get out of sync. This     failure can be triggered by unusual guest behaviour     exhausting the memory reserved for the p2m table. If it     happens, subsequent guest-invoked memory operations can     cause Xen to fail an assertion and crash.

  - CVE-2012-4538 ( XSA 23): Unhooking empty PAE entries DoS     vulnerability

    The HVMOP_pagetable_dying hypercall does not correctly     check the caller's pagetable state, leading to a     hypervisor crash.

  - CVE-2012-4539 ( XSA 24): Grant table hypercall infinite     loop DoS vulnerability

    Due to inappropriate duplicate use of the same loop     control variable, passing bad arguments to     GNTTABOP_get_status_frames can cause an infinite loop in     the compat hypercall handler.

  - CVE-2012-5510 ( XSA 26): Grant table version switch list     corruption vulnerability

    Downgrading the grant table version of a guest involves     freeing its status pages. This freeing was incomplete -     the page(s) are freed back to the allocator, but not     removed from the domain's tracking list. This would     cause list corruption, eventually leading to a     hypervisor crash.

  - CVE-2012-5513 ( XSA 29): XENMEM_exchange may overwrite     hypervisor memory

    The handler for XENMEM_exchange accesses guest memory     without range checking the guest provided addresses,     thus allowing these accesses to include the hypervisor     reserved range.

  A malicious guest administrator can cause Xen to crash. If the out   of address space bounds access does not lead to a crash, a carefully   crafted privilege escalation cannot be excluded, even though the   guest doesn't itself control the values written.

  - CVE-2012-5514 ( XSA 30): Broken error handling in     guest_physmap_mark_populate_on_demand()

    guest_physmap_mark_populate_on_demand(), before carrying     out its actual operation, checks that the subject GFNs     are not in use. If that check fails, the code prints a     message and bypasses the gfn_unlock() matching the     gfn_lock() carried out before entering the loop. A     malicious guest administrator can then use it to cause     Xen to hang.

  - CVE-2012-5515 ( XSA 31): Several memory hypercall     operations allow invalid extent order values

    Allowing arbitrary extent_order input values for     XENMEM_decrease_reservation, XENMEM_populate_physmap,     and XENMEM_exchange can cause arbitrarily long time     being spent in loops without allowing vital other code     to get a chance to execute. This may also cause     inconsistent state resulting at the completion of these     hypercalls.

This update fixes the following security issues in xen :

  - Grant table version switch list corruption vulnerability     (XSA-26). (CVE-2012-5510)

  - Several HVM operations do not validate the range of     their inputs (XSA-27). (CVE-2012-5511)

  - HVMOP_get_mem_access crash / HVMOP_set_mem_access     information leak (XSA-28). (CVE-2012-5512)

  - XENMEM_exchange may overwrite hypervisor memory     (XSA-29). (CVE-2012-5513)

  - Missing unlock in     guest_physmap_mark_populate_on_demand() (XSA-30).
    (CVE-2012-5514)

  - Several memory hypercall operations allow invalid extent     order values (XSA-31) Also the following bugs have been     fixed and upstream patches have been applied:.
    (CVE-2012-5515)

  - FATAL PAGE FAULT in hypervisor (arch_do_domctl)

  - 25931-x86-domctl-iomem-mapping-checks.patch

  - 26132-tmem-save-NULL-check.patch

  - 26134-x86-shadow-invlpg-check.patch

  - 26148-vcpu-timer-overflow.patch (Replaces     CVE-2012-4535-xsa20.patch)

  - 26149-x86-p2m-physmap-error-path.patch (Replaces     CVE-2012-4537-xsa22.patch)

  - 26150-x86-shadow-unhook-toplevel-check.patch (Replaces     CVE-2012-4538-xsa23.patch)

  - 26151-gnttab-compat-get-status-frames.patch (Replaces     CVE-2012-4539-xsa24.patch)

  - efi files missing in latest XEN update. (bnc#792476)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1540 advisory.

    - [net] rds-ping cause kernel panic (Alexander Gordeev) [822755 822756] {CVE-2012-2372}
    - [xen] add guest address range checks to XENMEM_exchange handlers (Igor Mammedov) [878033 878034]     {CVE-2012-5513}
    - [xen] x86/physmap: Prevent incorrect updates of m2p mappings (Igor Mammedov) [870148 870149]     {CVE-2012-4537}
    - [xen] VCPU/timer: Dos vulnerability prev overflow in calculations (Igor Mammedov) [870150 870151]     {CVE-2012-4535}
    - [fs] ext4: race-cond protect for convert_unwritten_extents_endio (Lukas Czerner) [869910 869911]     {CVE-2012-4508}
    - [fs] ext4: serialize fallocate w/ ext4_convert_unwritten_extents (Lukas Czerner) [869910 869911]     {CVE-2012-4508}
    - [fs] ext4: flush the i_completed_io_list during ext4_truncate (Lukas Czerner) [869910 869911]     {CVE-2012-4508}
    - [net] ipv4: add RCU protection to inet->opt (Jiri Pirko) [872113 855302] {CVE-2012-3552}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 10 Service Pack 3 LTSS Xen hypervisor and toolset have been updated to fix various security issues :

The following security issues have been addressed :

XSA-20: CVE-2012-4535: Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cause a denial of service (Xen infinite loop and physical CPU consumption) by setting a VCPU with an 'inappropriate deadline'. (bnc#786516)

XSA-22: CVE-2012-4537: Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka 'Memory mapping failure DoS vulnerability'. (bnc#786517)

XSA-25: CVE-2012-4544: The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.
(bnc#787163)

XSA-29: CVE-2012-5513: The XENMEM_exchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service (crash) or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range. (bnc#789951)

XSA-31: CVE-2012-5515: The (1) XENMEM_decrease_reservation, (2) XENMEM_populate_physmap, and (3) XENMEM_exchange hypercalls in Xen 4.2 and earlier allow local guest administrators to cause a denial of service (long loop and hang) via a crafted extent_order value. (bnc#789950)

XSA-44: CVE-2013-1917: Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service (hypervisor crash) by triggering a #GP fault, which is not properly handled by another IRET instruction. (bnc#813673)

XSA-47: CVE-2013-1920: Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running 'under memory pressure' and the Xen Security Module (XSM) is enabled, uses the wrong ordering of operations when extending the per-domain event channel tracking table, which causes a use-after-free and allows local guest kernels to inject arbitrary events and gain privileges via unspecified vectors. (bnc#813677)

XSA-55: CVE-2013-2196: Multiple unspecified vulnerabilities in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to 'other problems' that are not CVE-2013-2194 or CVE-2013-2195. (bnc#823011)

XSA-55: CVE-2013-2195: The Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to 'pointer dereferences' involving unexpected calculations. (bnc#823011)

XSA-55: CVE-2013-2194: Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel. (bnc#823011)

XSA-63: CVE-2013-4355: Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain hypervisor stack memory via a (1) port or (2) memory mapped I/O write or (3) other unspecified operations related to addresses without associated memory.
(bnc#840592)

XSA-67: CVE-2013-4368: The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS:
segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register. (bnc#842511)

XSA-73: CVE-2013-4494: Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified vectors. (bnc#848657)

XSA-76: CVE-2013-4554: Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2. (bnc#849668)

XSA-82: CVE-2013-6885: The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (bnc#853049)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
74850	openSUSE Security Update : xen (openSUSE-SU-2012:1687-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
70184	GLSA-201309-24 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2013/9/28	2021/1/6	high
79487	OracleVM 2.2 : xen (OVMSA-2012-0049)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/4	low
83564	SUSE SLED10 / SLES10 Security Update : Xen (SUSE-SU-2012:1487-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	medium
90380	GLSA-201604-03 : Xen: Multiple vulnerabilities (Venom)	Nessus	Gentoo Local Security Checks	2016/4/7	2021/1/11	critical
62963	SuSE 10 Security Update : Xen (ZYPP Patch Number 8359)	Nessus	SuSE Local Security Checks	2012/11/19	2021/1/19	medium
63188	Debian DSA-2582-1 : xen - several vulnerabilities	Nessus	Debian Local Security Checks	2012/12/9	2021/1/11	medium
64232	SuSE 11.2 Security Update : Xen (SAT Patch Number 7133)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	medium
68663	Oracle Linux 5 : kernel (ELSA-2012-1540)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	medium
83617	SUSE SLES10 Security Update : Xen (SUSE-SU-2014:0470-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	medium

检测

插件搜索

medium

high

low

medium

critical

medium

medium

medium

medium

medium