Xen 4.1.1 and earlier allows local guest OS kernels with control of a PCI[E] device to cause a denial of service (CPU consumption and host hang) via many crafted DMA requests that are denied by the IOMMU, which triggers a livelock.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Passthrough: disable bus-mastering on any card that     causes an IOMMU fault (Tim Deegan) (CVE-2011-3131)

  - Serialize iptables calls in hotplug scripts (rhbz     460410)

  - Fix iptables service check bug (orabug 11727087)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1386 advisory.

    - Revert: [xen] passthrough: block VT-d MSI trap injection (Paolo Bonzini) [716301 716302] {CVE-2011-1898}
    - [net] bridge: fix use after free in __br_deliver (Amerigo Wang) [730949 703045] {CVE-2011-2942}
    - [misc] remove div_long_long_rem (Prarit Bhargava) [732879 732614] {CVE-2011-3209}
    - [net] be2net: fix crash receiving non-member VLAN packets (Ivan Vecera) [736430 730239] {CVE-2011-3347}
    - [net] be2net: Use NTWK_RX_FILTER command for promiscous mode (Ivan Vecera) [736430 730239]     {CVE-2011-3347}
    - [net] be2net: non-member vlan pkts not received in promisc mode (Ivan Vecera) [736430 730239]     {CVE-2011-3347}
    - [net] be2net: remove bogus unlikely on vlan check (Ivan Vecera) [736430 730239] {CVE-2011-3347}
    - [net] Compute protocol seq numbers and fragment IDs using MD5 (Jiri Pirko) [732662 732663]     {CVE-2011-3188}
    - [crypto] Move md5_transform to lib/md5.c (Jiri Pirko) [732662 732663] {CVE-2011-3188}
    - [mm] avoid wrapping vm_pgoff in mremap and stack expansion (Jerome Marchand) [716543 716544]     {CVE-2011-2496}
    - [fs] ecryptfs: Add mount option to check uid of mounting device (Eric Sandeen) [731173 731174]     {CVE-2011-1833}
    - [net] ipv6: make fragment identifications less predictable (Jiri Pirko) [723430 723431] {CVE-2011-2699}
    - [net] ipv6: Remove unused skb argument of ipv6_select_ident (Jiri Pirko) [723430 723431] {CVE-2011-2699}
    - [misc] taskstats: don't allow duplicate entries in listener mode (Jerome Marchand) [715449 715450]     {CVE-2011-2484}
    - [net] gro: Only reset frag0 when skb can be pulled (Herbert Xu) [726553 679682] {CVE-2011-2723}
    - [xen] passthrough: block VT-d MSI trap injection (Paolo Bonzini) [716301 716302] {CVE-2011-1898}
    - [xen] iommu: disable bus-mastering on hw that causes IOMMU fault (Laszlo Ersek) [730342 730343]     {CVE-2011-3131}
    - [usb] auerswald: fix buffer overflow (Don Zickus) [722395 722396] {CVE-2009-4067}
    - [fs] cifs: fix possible memory corruption in CIFSFindNext (Jeff Layton) [732870 736654 732869 732471]     {CVE-2011-3191}
    - [fs] cifs: revert special handling for matching krb5 sessions (Jeff Layton) [697395 697396]     {CVE-2011-1585}
    - [fs] cifs: check for NULL session password (Jeff Layton) [697395 697396] {CVE-2011-1585}
    - [fs] cifs: fix NULL pointer dereference in cifs_find_smb_ses (Jeff Layton) [697395 697396]     {CVE-2011-1585}
    - [fs] cifs: clean up cifs_find_smb_ses (Jeff Layton) [697395 697396] {CVE-2011-1585}
    - [char] tpm: Fix uninitialized usage of data buffer (Stanislaw Gruszka) [684672 684673] {CVE-2011-1160}
    - [fs] ext4: Fix max size and logical block counting of extent file (Lukas Czerner) [722562 722563]     {CVE-2011-2695}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple denial of service vulnerabilities have been discovered in the Xen Hypervisor. One of the issue (CVE-2012-5513 ) could even lead to privilege escalation from guest to host.

Some of the recently published Xen Security Advisories ( XSA 25and 28) are not fixed by this update and should be fixed in a future release.

  - CVE-2011-3131 ( XSA 5): DoS using I/OMMU faults from     PCI-passthrough guest     A VM that controls a PCI[E] device directly can cause it     to issue DMA requests to invalid addresses. Although     these requests are denied by the I/OMMU, the hypervisor     needs to handle the interrupt and clear the error from     the I/OMMU, and this can be used to live-lock a CPU and     potentially hang the host.

  - CVE-2012-4535 ( XSA 20): Timer overflow DoS     vulnerability

    A guest which sets a VCPU with an inappropriate deadline     can cause an infinite loop in Xen, blocking the affected     physical CPU indefinitely.

  - CVE-2012-4537 ( XSA 22): Memory mapping failure DoS     vulnerability

    When set_p2m_entry fails, Xen's internal data structures     (the p2m and m2p tables) can get out of sync. This     failure can be triggered by unusual guest behaviour     exhausting the memory reserved for the p2m table. If it     happens, subsequent guest-invoked memory operations can     cause Xen to fail an assertion and crash.

  - CVE-2012-4538 ( XSA 23): Unhooking empty PAE entries DoS     vulnerability

    The HVMOP_pagetable_dying hypercall does not correctly     check the caller's pagetable state, leading to a     hypervisor crash.

  - CVE-2012-4539 ( XSA 24): Grant table hypercall infinite     loop DoS vulnerability

    Due to inappropriate duplicate use of the same loop     control variable, passing bad arguments to     GNTTABOP_get_status_frames can cause an infinite loop in     the compat hypercall handler.

  - CVE-2012-5510 ( XSA 26): Grant table version switch list     corruption vulnerability

    Downgrading the grant table version of a guest involves     freeing its status pages. This freeing was incomplete -     the page(s) are freed back to the allocator, but not     removed from the domain's tracking list. This would     cause list corruption, eventually leading to a     hypervisor crash.

  - CVE-2012-5513 ( XSA 29): XENMEM_exchange may overwrite     hypervisor memory

    The handler for XENMEM_exchange accesses guest memory     without range checking the guest provided addresses,     thus allowing these accesses to include the hypervisor     reserved range.

  A malicious guest administrator can cause Xen to crash. If the out   of address space bounds access does not lead to a crash, a carefully   crafted privilege escalation cannot be excluded, even though the   guest doesn't itself control the values written.

  - CVE-2012-5514 ( XSA 30): Broken error handling in     guest_physmap_mark_populate_on_demand()

    guest_physmap_mark_populate_on_demand(), before carrying     out its actual operation, checks that the subject GFNs     are not in use. If that check fails, the code prints a     message and bypasses the gfn_unlock() matching the     gfn_lock() carried out before entering the loop. A     malicious guest administrator can then use it to cause     Xen to hang.

  - CVE-2012-5515 ( XSA 31): Several memory hypercall     operations allow invalid extent order values

    Allowing arbitrary extent_order input values for     XENMEM_decrease_reservation, XENMEM_populate_physmap,     and XENMEM_exchange can cause arbitrarily long time     being spent in loops without allowing vital other code     to get a chance to execute. This may also cause     inconsistent state resulting at the completion of these     hypercalls.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

  - The maximum file offset handling for ext4 file systems     could allow a local, unprivileged user to cause a denial     of service. (CVE-2011-2695, Important)

  - IPv6 fragment identification value generation could     allow a remote attacker to disrupt a target system's     networking, preventing legitimate users from accessing     its services. (CVE-2011-2699, Important)

  - A malicious CIFS (Common Internet File System) server     could send a specially crafted response to a directory     read request that would result in a denial of service or     privilege escalation on a system that has a CIFS share     mounted. (CVE-2011-3191, Important)

  - A local attacker could use mount.ecryptfs_private to     mount (and then access) a directory they would otherwise     not have access to. Note: To correct this issue, a     ecryptfs-utils update must also be installed.
    (CVE-2011-1833, Moderate)

  - A flaw in the taskstats subsystem could allow a local,     unprivileged user to cause excessive CPU time and memory     use. (CVE-2011-2484, Moderate)

  - Mapping expansion handling could allow a local,     unprivileged user to cause a denial of service.
    (CVE-2011-2496, Moderate)

  - GRO (Generic Receive Offload) fields could be left in an     inconsistent state. An attacker on the local network     could use this flaw to cause a denial of service. GRO is     enabled by default in all network drivers that support     it. (CVE-2011-2723, Moderate)

  - A previous update introduced a regression in the     Ethernet bridge implementation. If a system had an     interface in a bridge, and an attacker on the local     network could send packets to that interface, they could     cause a denial of service on that system. Xen hypervisor     and KVM (Kernel-based Virtual Machine) hosts often     deploy bridge interfaces. (CVE-2011-2942, Moderate)

  - A flaw in the Xen hypervisor IOMMU error handling     implementation could allow a privileged guest user,     within a guest operating system that has direct control     of a PCI device, to cause performance degradation on the     host and possibly cause it to hang. (CVE-2011-3131,     Moderate)

  - IPv4 and IPv6 protocol sequence number and fragment ID     generation could allow a man-in-the-middle attacker to     inject packets and possibly hijack connections. Protocol     sequence number and fragment IDs are now more random.
    (CVE-2011-3188, Moderate)

  - A flaw in the kernel's clock implementation could allow     a local, unprivileged user to cause a denial of service.
    (CVE-2011-3209, Moderate)

  - Non-member VLAN (virtual LAN) packet handling for     interfaces in promiscuous mode and also using the be2net     driver could allow an attacker on the local network to     cause a denial of service. (CVE-2011-3347, Moderate)

  - A flaw in the auerswald USB driver could allow a local,     unprivileged user to cause a denial of service or     escalate their privileges by inserting a specially     crafted USB device. (CVE-2009-4067, Low)

  - A flaw in the Trusted Platform Module (TPM)     implementation could allow a local, unprivileged user to     leak information to user space. (CVE-2011-1160, Low)

  - A local, unprivileged user could possibly mount a CIFS     share that requires authentication without knowing the     correct password if the mount was already mounted by     another local user. (CVE-2011-1585, Low)

This update fixes a denial of service (Host Crash) in the XEN hypervisor. (CVE-2011-2901)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1386 advisory.

  - kernel: usb: buffer overflow in auerswald_probe() (CVE-2009-4067)

  - kernel: tpm infoleaks (CVE-2011-1160)

  - kernel: cifs session reuse (CVE-2011-1585)

  - kernel: ecryptfs: mount source TOCTOU race (CVE-2011-1833)

  - kernel: taskstats: duplicate entries in listener mode can lead to DoS (CVE-2011-2484)

  - kernel: mm: avoid wrapping vm_pgoff in mremap() and stack expansions (CVE-2011-2496)

  - kernel: ext4: kernel panic when writing data to the last block of sparse file (CVE-2011-2695)

  - kernel: ipv6: make fragment identifications less predictable (CVE-2011-2699)

  - kernel: gro: only reset frag0 when skb can be pulled (CVE-2011-2723)

  - kernel: bridge: null pointer dereference in __br_deliver (CVE-2011-2942)

  - kernel: xen: IOMMU fault livelock (CVE-2011-3131)

  - kernel: net: improve sequence number generation (CVE-2011-3188)

  - kernel: cifs: signedness issue in CIFSFindNext() (CVE-2011-3191)

  - kernel: panic occurs when clock_gettime() is called (CVE-2011-3209)

  - kernel: be2net: promiscuous mode and non-member VLAN packets DoS (CVE-2011-3347)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* The maximum file offset handling for ext4 file systems could allow a local, unprivileged user to cause a denial of service. (CVE-2011-2695, Important)

* IPv6 fragment identification value generation could allow a remote attacker to disrupt a target system's networking, preventing legitimate users from accessing its services. (CVE-2011-2699, Important)

* A malicious CIFS (Common Internet File System) server could send a specially crafted response to a directory read request that would result in a denial of service or privilege escalation on a system that has a CIFS share mounted. (CVE-2011-3191, Important)

* A local attacker could use mount.ecryptfs_private to mount (and then access) a directory they would otherwise not have access to. Note: To correct this issue, the RHSA-2011:1241 ecryptfs-utils update must also be installed. (CVE-2011-1833, Moderate)

* A flaw in the taskstats subsystem could allow a local, unprivileged user to cause excessive CPU time and memory use. (CVE-2011-2484, Moderate)

* Mapping expansion handling could allow a local, unprivileged user to cause a denial of service. (CVE-2011-2496, Moderate)

* GRO (Generic Receive Offload) fields could be left in an inconsistent state. An attacker on the local network could use this flaw to cause a denial of service. GRO is enabled by default in all network drivers that support it. (CVE-2011-2723, Moderate)

* RHSA-2011:1065 introduced a regression in the Ethernet bridge implementation. If a system had an interface in a bridge, and an attacker on the local network could send packets to that interface, they could cause a denial of service on that system. Xen hypervisor and KVM (Kernel-based Virtual Machine) hosts often deploy bridge interfaces. (CVE-2011-2942, Moderate)

* A flaw in the Xen hypervisor IOMMU error handling implementation could allow a privileged guest user, within a guest operating system that has direct control of a PCI device, to cause performance degradation on the host and possibly cause it to hang. (CVE-2011-3131, Moderate)

* IPv4 and IPv6 protocol sequence number and fragment ID generation could allow a man-in-the-middle attacker to inject packets and possibly hijack connections. Protocol sequence number and fragment IDs are now more random. (CVE-2011-3188, Moderate)

* A flaw in the kernel's clock implementation could allow a local, unprivileged user to cause a denial of service. (CVE-2011-3209, Moderate)

* Non-member VLAN (virtual LAN) packet handling for interfaces in promiscuous mode and also using the be2net driver could allow an attacker on the local network to cause a denial of service.
(CVE-2011-3347, Moderate)

* A flaw in the auerswald USB driver could allow a local, unprivileged user to cause a denial of service or escalate their privileges by inserting a specially crafted USB device. (CVE-2009-4067, Low)

* A flaw in the Trusted Platform Module (TPM) implementation could allow a local, unprivileged user to leak information to user space.
(CVE-2011-1160, Low)

* A local, unprivileged user could possibly mount a CIFS share that requires authentication without knowing the correct password if the mount was already mounted by another local user. (CVE-2011-1585, Low)

Red Hat would like to thank Fernando Gont for reporting CVE-2011-2699;
Darren Lavender for reporting CVE-2011-3191; the Ubuntu Security Team for reporting CVE-2011-1833; Vasiliy Kulikov of Openwall for reporting CVE-2011-2484; Robert Swiecki for reporting CVE-2011-2496; Brent Meshier for reporting CVE-2011-2723; Dan Kaminsky for reporting CVE-2011-3188; Yasuaki Ishimatsu for reporting CVE-2011-3209; Somnath Kotur for reporting CVE-2011-3347; Rafael Dominguez Vega for reporting CVE-2009-4067; and Peter Huewe for reporting CVE-2011-1160. The Ubuntu Security Team acknowledges Vasiliy Kulikov of Openwall and Dan Rosenberg as the original reporters of CVE-2011-1833.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2011-1386.

ID	Name	Product	Family	Severity
79474	OracleVM 2.2 : xen (OVMSA-2011-0008)	Nessus	OracleVM Local Security Checks	medium
68375	Oracle Linux 5 : kernel (ELSA-2011-1386)	Nessus	Oracle Linux Local Security Checks	critical
63188	Debian DSA-2582-1 : xen - several vulnerabilities	Nessus	Debian Local Security Checks	medium
61162	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
57267	SuSE 10 Security Update : Xen (ZYPP Patch Number 7699)	Nessus	SuSE Local Security Checks	medium
56577	RHEL 5 : kernel (RHSA-2011:1386)	Nessus	Red Hat Local Security Checks	critical
56569	CentOS 5 : kernel (CESA-2011:1386)	Nessus	CentOS Local Security Checks	critical
801510	CentOS RHSA-2011-1386 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2011-3131

medium

Tenable Plugins

medium

critical

medium

critical

medium

critical

critical

high