Xen 3.4, 4.0, and 4.1, when the guest OS has not registered a handler for a syscall or sysenter instruction, does not properly clear a flag for exception injection when injecting a General Protection Fault, which allows local PV guest OS users to cause a denial of service (guest crash) by later triggering an exception that would normally be handled within Xen.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2012-0217 CVE-2012-0218: guest DoS on     syscall/sysenter exception generation [orabug 13993157]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86-64: detect processors subject to AMD erratum #121     and refuse to boot(CVE-2006-0744)

  - guest denial of service on syscall/sysenter exception     generation (CVE-2012-0217),(CVE-2012-0218)

  - Remove unnecessary balloon retries on vm create. This is     a backport from fix for bug 14143327.

This update of XEN fixed multiple security flaws that could be exploited by local attackers to cause a Denial of Service or potentially escalate privileges. Additionally, several other upstream changes were backported.

The remote host is affected by the vulnerability described in GLSA-201309-24 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Guest domains could possibly gain privileges, execute arbitrary code, or       cause a Denial of Service on the host domain (Dom0). Additionally, guest       domains could gain information about other virtual machines running on       the same host or read arbitrary files on the host.
  Workaround :

    The CVEs listed below do not currently have fixes, but only apply to Xen       setups which have &ldquo;tmem&rdquo; specified on the hypervisor command line.
      TMEM is not currently supported for use in production systems, and       administrators using tmem should disable it.
      Relevant CVEs:
      * CVE-2012-2497
      * CVE-2012-6030
      * CVE-2012-6031
      * CVE-2012-6032
      * CVE-2012-6033
      * CVE-2012-6034
      * CVE-2012-6035
      * CVE-2012-6036

Three security issues were found in XEN.

Two security issues are fixed by this update :

  - Due to incorrect fault handling in the XEN hypervisor it     was possible for a XEN guest domain administrator to     execute code in the XEN host environment.
    (CVE-2012-0217)

  - Also a guest user could crash the guest XEN kernel due     to a protection fault bounce. The third fix is changing     the Xen behaviour on certain hardware:. (CVE-2012-0218)

  - The issue is a denial of service issue on older pre-SVM     AMD CPUs (AMD Erratum 121). AMD Erratum #121 is     described in 'Revision Guide for AMD Athlon 64 and AMD     Opteron Processors':
    http://support.amd.com/us/Processor_TechDocs/25759.pdf.
    (CVE-2012-2934)

    The following 130nm and 90nm (DDR1-only) AMD processors     are subject to this erratum :

  - First-generation AMD-Opteron(tm) single and dual core     processors in either 939 or 940 packages :

  - AMD Opteron(tm) 100-Series Processors

  - AMD Opteron(tm) 200-Series Processors

  - AMD Opteron(tm) 800-Series Processors

  - AMD Athlon(tm) processors in either 754, 939 or 940     packages

  - AMD Sempron(tm) processor in either 754 or 939 packages

  - AMD Turion(tm) Mobile Technology in 754 package This     issue does not effect Intel processors.

    The impact of this flaw is that a malicious PV guest     user can halt the host system.

    As this is a hardware flaw, it is not fixable except by     upgrading your hardware to a newer revision, or not     allowing untrusted 64bit guestsystems.

    The patch changes the behaviour of the host system     booting, which makes it unable to create guest machines     until a specific boot option is set.

    There is a new XEN boot option 'allow_unsafe' for GRUB     which allows the host to start guests again.

    This is added to /boot/grub/menu.lst in the line looking     like this :

    kernel /boot/xen.gz .... allow_unsafe

    Note: .... in this example represents the existing boot     options for the host.

Several vulnerabilities were discovered in Xen, a hypervisor.

  - CVE-2012-0217     Xen does not properly handle uncanonical return     addresses on Intel amd64 CPUs, allowing amd64 PV guests     to elevate to hypervisor privileges. AMD processors, HVM     and i386 guests are not affected.

  - CVE-2012-0218     Xen does not properly handle SYSCALL and SYSENTER     instructions in PV guests, allowing unprivileged users     inside a guest system to crash the guest system.

  - CVE-2012-2934     Xen does not detect old AMD CPUs affected by AMD Erratum     #121.

For CVE-2012-2934, Xen refuses to start domUs on affected systems unless the 'allow_unsafe' option is passed.

Three security issues were found in XEN.

Two security issues are fixed by this update :

  - Due to incorrect fault handling in the XEN hypervisor it     was possible for a XEN guest domain administrator to     execute code in the XEN host environment.
    (CVE-2012-0217)

  - Also a guest user could crash the guest XEN kernel due     to a protection fault bounce. (CVE-2012-0218)

The third fix is changing the Xen behaviour on certain hardware :

  - The issue is a denial of service issue on older pre-SVM     AMD CPUs (AMD Erratum 121). (CVE-2012-2934)

    AMD Erratum #121 is described in 'Revision Guide for AMD     Athlon 64 and AMD Opteron Processors':
    http://support.amd.com/us/Processor_TechDocs/25759.pdf

    The following 130nm and 90nm (DDR1-only) AMD processors     are subject to this erratum :

o

First-generation AMD-Opteron(tm) single and dual core processors in either 939 or 940 packages :

  - AMD Opteron(tm) 100-Series Processors

  - AMD Opteron(tm) 200-Series Processors

  - AMD Opteron(tm) 800-Series Processors

  - AMD Athlon(tm) processors in either 754, 939 or 940     packages

  - AMD Sempron(tm) processor in either 754 or 939 packages

  - AMD Turion(tm) Mobile Technology in 754 package This     issue does not effect Intel processors.

    The impact of this flaw is that a malicious PV guest     user can halt the host system.

    As this is a hardware flaw, it is not fixable except by     upgrading your hardware to a newer revision, or not     allowing untrusted 64bit guestsystems.

    The patch changes the behaviour of the host system     booting, which makes it unable to create guest machines     until a specific boot option is set.

    There is a new XEN boot option 'allow_unsafe' for GRUB     which allows the host to start guests again.

    This is added to /boot/grub/menu.lst in the line looking     like this :

    kernel /boot/xen.gz .... allow_unsafe

    Note: .... in this example represents the existing boot     options for the host.

ID	Name	Product	Family	Severity
79478	OracleVM 2.2 : xen (OVMSA-2012-0022)	Nessus	OracleVM Local Security Checks	high
79477	OracleVM 3.1 : xen (OVMSA-2012-0021)	Nessus	OracleVM Local Security Checks	high
74683	openSUSE Security Update : xen (openSUSE-2012-404)	Nessus	SuSE Local Security Checks	high
74682	openSUSE Security Update : xen (openSUSE-SU-2012:0886-1)	Nessus	SuSE Local Security Checks	high
70184	GLSA-201309-24 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
64233	SuSE 11.1 Security Update : Xen (SAT Patch Number 6399)	Nessus	SuSE Local Security Checks	high
59779	Debian DSA-2501-1 : xen - several vulnerabilities	Nessus	Debian Local Security Checks	high
59469	SuSE 10 Security Update : Xen (ZYPP Patch Number 8180)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2012-0218

medium

Tenable Plugins

high

high

high

high

high

high

high

high