There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a
    GNTMAP_device_map and GNTMAP_host_map mapping, which allows guest OS users to cause a denial of service
    (count mismanagement and memory corruption) or obtain privileged host OS access, aka XSA-224 bug 2.
    (CVE-2017-10921)

  - The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows
    guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by
    leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka
    XSA-216. (CVE-2017-10911)

  - Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS
    access, aka XSA-217. (CVE-2017-10912)

  - The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of
    concurrent unmap calls, which allows backend attackers to obtain sensitive information or gain privileges,
    aka XSA-218 bug 1. (CVE-2017-10913)

  - The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows
    guest OS users to cause a denial of service (memory consumption), or possibly obtain sensitive information
    or gain privileges, aka XSA-218 bug 2. (CVE-2017-10914)

xen：さまざまな欠陥（#1463247）のblkif応答でバックエンドスタックデータが漏洩します[XSA-216]ページ転送により、PVゲストが権限を昇格できる可能性があります[XSA-217]許可表アンマップコードでの競合[XSA-218] x86：
シャドウエミュレーション中の不十分な参照カウント[XSA-219] x86：
vCPU-s間のPKRUとBND *の漏洩[XSA-220]イベントチャネルポーリングのNULLポインターデリファレンス[XSA-221]（#1463231）不十分なエラーチェックによる古いP2Mマッピング[XSA-222] ARMゲストによる割り込みの無効化によりXenがクラッシュする可能性があります[XSA-223]許可表操作が参照カウントを誤って処理します[XSA-224] arm：vgic：SGIを送信する際の領域外アクセス[XSA-225]

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

xen：さまざまな欠陥（#1463247）のblkif応答でバックエンドスタックデータが漏洩します[XSA-216]ページ転送により、PVゲストが権限を昇格できる可能性があります[XSA-217]許可表アンマップコードでの競合[XSA-218] x86：
シャドウエミュレーション中の不十分な参照カウント[XSA-219] x86：
vCPU-s間のPKRUとBND *の漏洩[XSA-220]不十分なエラーチェックによる古いP2Mマッピング[XSA-222] ARMゲストによる割り込みの無効化によりXenがクラッシュする可能性があります[XSA-223]許可表操作が参照カウントを誤って処理します[XSA-224] arm：vgic：SGIを送信する際の領域外アクセス[XSA-225]イベントチャネルポーリングのNULLポインターデリファレンス[XSA-221]（#1463231）

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

xen: various flaws (#1463247) blkif responses leak backend stack data [XSA-216] page transfer may allow PV guest to elevate privilege [XSA-217] Races in the grant table unmap code [XSA-218] x86:
insufficient reference counts during shadow emulation [XSA-219] x86:
PKRU and BND* leakage between vCPU-s [XSA-220] stale P2M mappings due to insufficient error checking [XSA-222] ARM guest disabling interrupt may crash Xen [XSA-223] grant table operations mishandle reference counts [XSA-224] arm: vgic: Out-of-bound access when sending SGIs [XSA-225] NULL pointer deref in event channel poll [XSA-221] (#1463231)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xen: various flaws (#1463247) blkif responses leak backend stack data [XSA-216] page transfer may allow PV guest to elevate privilege [XSA-217] Races in the grant table unmap code [XSA-218] x86:
insufficient reference counts during shadow emulation [XSA-219] x86:
PKRU and BND* leakage between vCPU-s [XSA-220] NULL pointer deref in event channel poll [XSA-221] (#1463231) stale P2M mappings due to insufficient error checking [XSA-222] ARM guest disabling interrupt may crash Xen [XSA-223] grant table operations mishandle reference counts [XSA-224] arm: vgic: Out-of-bound access when sending SGIs [XSA-225]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
407881	Alpine: xen: security update to 4.7.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	critical
407890	Alpine: xen: security update to 4.8.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	critical
407867	Alpine: xen: security update to 4.6.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	critical
407867	Alpine: xen: security update to 4.6.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	critical
407881	Alpine: xen: security update to 4.7.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	critical
407890	Alpine: xen: security update to 4.8.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	critical
424718	Alpine: multiple xen packages: security update to 4.9.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/4/4	2026/7/2	critical
424718	Alpine: multiple xen packages: security update to 4.9.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/4/4	2026/7/2	critical
101638	Fedora 26：xen（2017-5c6a9b07a3）	Nessus	Fedora Local Security Checks	2017/7/17	2025/12/10	critical
101183	Fedora 24：xen（2017-b3bdaf58bc）	Nessus	Fedora Local Security Checks	2017/7/3	2025/12/12	critical
101028	Fedora 25：xen（2017-c3149b5fcb）	Nessus	Fedora Local Security Checks	2017/6/23	2025/12/15	critical
101183	Fedora 24 : xen (2017-b3bdaf58bc)	Nessus	Fedora Local Security Checks	2017/7/3	2025/12/12	critical
101638	Fedora 26 : xen (2017-5c6a9b07a3)	Nessus	Fedora Local Security Checks	2017/7/17	2025/12/10	critical
101028	Fedora 25 : xen (2017-c3149b5fcb)	Nessus	Fedora Local Security Checks	2017/6/23	2025/12/15	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical