Xen 4.0 and 4.1 allows local HVM guest OS kernels to cause a denial of service (domain 0 VCPU hang and kernel panic) by modifying the physical address space in a way that triggers excessive shared page search time during the p2m teardown.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Xen Security Advisory CVE-2012-3433 / XSA-11 HVM guest     destroy p2m teardown host DoS vulnerability An HVM guest     is able to manipulate its physical address space such     that tearing down the guest takes an extended period     amount of time searching for shared pages. This causes     the domain 0 VCPU which tears down the domain to be     blocked in the destroy hypercall. This causes that     domain 0 VCPU to become unavailable and may cause the     domain 0 kernel to panic. There is no requirement for     memory sharing to be in use. From the patch description:
    xen: only check for shared pages while any exist on     teardown Avoids worst case behavour when guest has a     large p2m. This is XSA-11 / CVE-2012-nnn

  - Xen Security Advisory XSA-10 HVM guest user mode MMIO     emulation DoS vulnerability Internal data of the     emulator for MMIO operations may, under certain rare     conditions, at the end of one emulation cycle be left in     a state affecting a subsequent emulation such that this     second emulation would fail, causing an exception to be     reported to the guest kernel where none is expected.
    NOTE: No CVE number! The patch description is as follow:
    x86/hvm: don't leave emulator in inconsistent state The     fact that handle_mmio, and thus the instruction     emulator, is being run through twice for emulations that     require involvement of the device model, allows for the     second run to see a different guest state than the first     one. Since only the MMIO-specific emulation routines     update the vCPU's io_state, if they get invoked on the     second pass, internal state (and particularly this     variable) can be left in a state making successful     emulation of a subsequent MMIO operation impossible.
    Consequently, whenever the emulator invocation returns     without requesting a retry of the guest instruction,     reset io_state.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Xen Security Advisory CVE-2012-3433 / XSA-11 HVM guest     destroy p2m teardown host DoS vulnerability An HVM guest     is able to manipulate its physical address space such     that tearing down the guest takes an extended period     amount of time searching for shared pages. This causes     the domain 0 VCPU which tears down the domain to be     blocked in the destroy hypercall. This causes that     domain 0 VCPU to become unavailable and may cause the     domain 0 kernel to panic. There is no requirement for     memory sharing to be in use. From the patch description:
    xen: only check for shared pages while any exist on     teardown Avoids worst case behavour when guest has a     large p2m. This is XSA-11 / CVE-2012-nnn

  - Xen Security Advisory XSA-10 HVM guest user mode MMIO     emulation DoS vulnerability Internal data of the     emulator for MMIO operations may, under certain rare     conditions, at the end of one emulation cycle be left in     a state affecting a subsequent emulation such that this     second emulation would fail, causing an exception to be     reported to the guest kernel where none is expected.
    NOTE: No CVE number! The patch description is as follow:
    x86/hvm: don't leave emulator in inconsistent state The     fact that handle_mmio, and thus the instruction     emulator, is being run through twice for emulations that     require involvement of the device model, allows for the     second run to see a different guest state than the first     one. Since only the MMIO-specific emulation routines     update the vCPU's io_state, if they get invoked on the     second pass, internal state (and particularly this     variable) can be left in a state making successful     emulation of a subsequent MMIO operation impossible.
    Consequently, whenever the emulator invocation returns     without requesting a retry of the guest instruction,     reset io_state.

  - Add 'allowhugepage' flag as a synonym for     'allowsuperpage' for compatibility with previous     releases.

Security Update for Xen

Following bug and security fixes were applied :

  - bnc#776995 - attaching scsi control luns with pvscsi

  - xend/pvscsi: fix passing of SCSI control LUNs     xen-bug776995-pvscsi-no-devname.patch

  - xend/pvscsi: fix usage of persistant device names for     SCSI devices xen-bug776995-pvscsi-persistent-names.patch

  - xend/pvscsi: update sysfs parser for Linux 3.0     xen-bug776995-pvscsi-sysfs-parser.patch

  - bnc#777090 - CVE-2012-3494: xen: hypercall set_debugreg     vulnerability (XSA-12) CVE-2012-3494-xsa12.patch

  - bnc#777088 - CVE-2012-3495: xen: hypercall     physdev_get_free_pirq vulnerability (XSA-13)     CVE-2012-3495-xsa13.patch

  - bnc#777091 - CVE-2012-3496: xen: XENMEM_populate_physmap     DoS vulnerability (XSA-14) CVE-2012-3496-xsa14.patch

  - bnc#777086 - CVE-2012-3498: xen: PHYSDEVOP_map_pirq     index vulnerability (XSA-16) CVE-2012-3498-xsa16.patch

  - bnc#777084 - CVE-2012-3515: xen: Qemu VT100 emulation     vulnerability (XSA-17) CVE-2012-3515-xsa17.patch

  - Upstream patches from Jan     25734-x86-MCG_CTL-default.patch     25735-x86-cpuid-masking-XeonE5.patch     25744-hypercall-return-long.patch

  - Update to Xen 4.1.3 c/s 23336 

  - Upstream or pending upstream patches from Jan     25587-fix-off-by-one-parsing-error.patch     25616-x86-MCi_CTL-default.patch     25617-vtd-qinval-addr.patch 25688-x86-nr_irqs_gsi.patch

  - bnc#773393 - VUL-0: CVE-2012-3433: xen: HVM guest     destroy p2m teardown host DoS vulnerability     CVE-2012-3433-xsa11.patch

  - bnc#773401 - VUL-1: CVE-2012-3432: xen: HVM guest user     mode MMIO emulation DoS     25682-x86-inconsistent-io-state.patch

  - bnc#762484 - VUL-1: CVE-2012-2625: xen: pv bootloader     doesn't check the size of the bzip2 or lzma compressed     kernel, leading to denial of service     25589-pygrub-size-limits.patch

  - bnc#767273 - unsupported /var/lock/subsys is still used     by xendomains init.xendomains

  - bnc#766283 - opensuse 12.2 pv guests can not start after     installation due to lack of grub2 support in the host     23686-pygrub-solaris.patch 23697-pygrub-grub2.patch     23944-pygrub-debug.patch 23998-pygrub-GPT.patch     23999-pygrub-grub2.patch 24000-pygrub-grub2.patch     24001-pygrub-grub2.patch 24002-pygrub-grub2.patch     24064-pygrub-HybridISO.patch     24401-pygrub-scrolling.patch 24402-pygrub-edit-fix.patch     24460-pygrub-extlinux.patch 24706-pygrub-extlinux.patch

Security Update for Xen Following fixes were done :

  - bnc#776995 - attaching scsi control luns with pvscsi

  - xend/pvscsi: fix passing of SCSI control LUNs     xen-bug776995-pvscsi-no-devname.patch

  - xend/pvscsi: fix usage of persistant device names for     SCSI devices xen-bug776995-pvscsi-persistent-names.patch

  - xend/pvscsi: update sysfs parser for Linux 3.0     xen-bug776995-pvscsi-sysfs-parser.patch

  - bnc#777090 - VUL-0: CVE-2012-3494: xen: hypercall     set_debugreg vulnerability (XSA-12)     CVE-2012-3494-xsa12.patch

  - bnc#777091 - VUL-0: CVE-2012-3496: xen:
    XENMEM_populate_physmap DoS vulnerability (XSA-14)     CVE-2012-3496-xsa14.patch

  - bnc#777084 - VUL-0: CVE-2012-3515: xen: Qemu VT100     emulation vulnerability (XSA-17)     CVE-2012-3515-xsa17.patch

  - bnc#744771 - VM with passed through PCI card fails to     reboot under dom0 load 24888-pci-release-devices.patch

  - Upstream patches from Jan     25431-x86-EDD-MBR-sig-check.patch     25459-page-list-splice.patch     25478-x86-unknown-NMI-deadlock.patch     25480-x86_64-sysret-canonical.patch     25481-x86_64-AMD-erratum-121.patch     25485-x86_64-canonical-checks.patch     25587-param-parse-limit.patch     25617-vtd-qinval-addr.patch 25688-x86-nr_irqs_gsi.patch

  - bnc#773393 - VUL-0: CVE-2012-3433: xen: HVM guest     destroy p2m teardown host DoS vulnerability     CVE-2012-3433-xsa11.patch

  - bnc#773401 - VUL-1: CVE-2012-3432: xen: HVM guest user     mode MMIO emulation DoS     25682-x86-inconsistent-io-state.patch

  - bnc#762484 - VUL-1: CVE-2012-2625: xen: pv bootloader     doesn't check the size of the bzip2 or lzma compressed     kernel, leading to denial of service     25589-pygrub-size-limits.patch

The remote host is affected by the vulnerability described in GLSA-201309-24 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Guest domains could possibly gain privileges, execute arbitrary code, or       cause a Denial of Service on the host domain (Dom0). Additionally, guest       domains could gain information about other virtual machines running on       the same host or read arbitrary files on the host.
  Workaround :

    The CVEs listed below do not currently have fixes, but only apply to Xen       setups which have &ldquo;tmem&rdquo; specified on the hypervisor command line.
      TMEM is not currently supported for use in production systems, and       administrators using tmem should disable it.
      Relevant CVEs:
      * CVE-2012-2497
      * CVE-2012-6030
      * CVE-2012-6031
      * CVE-2012-6032
      * CVE-2012-6033
      * CVE-2012-6034
      * CVE-2012-6035
      * CVE-2012-6036

Xen was updated to fix several security issues :

  - A xen HVM guest destroy p2m teardown host DoS     vulnerability was fixed, where malicious guest could     lock/crash the host. (CVE-2012-3433)

  - A xen HVM guest user mode MMIO emulation DoS was fixed.
    (CVE-2012-3432)

  - The xen pv bootloader doesn't check the size of the     bzip2 or lzma compressed kernel, leading to denial of     service (crash). (CVE-2012-2625)

Also the following bug in XEN has been fixed :

  - Xen HVM DomU crash during Windows Server 2008 R2     install, when maxmem > memory This update also included     bugfixes for:. (bnc#746702)

  - vm-install: - bnc#762963 - ReaR: Unable to recover a     paravirtualized XEN guest

  - virt-manager - SLE11-SP2 ONLY

  - virt-manager fails to start after upgrade to SLES11 SP2     from SLES10. (bnc#764982)

Xen was updated to fix several security issues :

  - A xen HVM guest destroy p2m teardown host DoS     vulnerability was fixed, where malicious guest could     lock/crash the host. (CVE-2012-3433)

  - A xen HVM guest user mode MMIO emulation DoS was fixed.
    (CVE-2012-3432)

  - The xen pv bootloader doesn't check the size of the     bzip2 or lzma compressed kernel, leading to denial of     service (crash). (CVE-2012-2625)

Also the following bug in XEN was fixed :

  - Xen HVM DomU crash during Windows Server 2008 R2     install, when maxmem > memory This update also included     bugfixes for:. (bnc#746702)

  - vm-install: - bnc#762963 - ReaR: Unable to recover a     paravirtualized XEN guest

update to 4.1.3 - fixes untrusted HVM guest can cause the dom0 to hang or crash [XSA-11, CVE-2012-3433] (#843582) remove some unnecessary cache flushing that slow things down (#841330)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

fix for (#845444) broke xend under systemd, update to 4.1.3, includes fix for untrusted HVM guest can cause the dom0 to hang or crash [XSA-11, CVE-2012-3433] (#843582) remove some unnecessary cache flushing that slow things down, change python options on xend to reduce selinux problems (#845444)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several denial-of-service vulnerabilities have been discovered in Xen, the popular virtualization software. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2012-3432     Guest mode unprivileged code, which has been granted the     privilege to access MMIO regions, may leverage that     access to crash the whole guest. Since this can be used     to crash a client from within, this vulnerability is     considered to have low impact.

  - CVE-2012-3433     A guest kernel can cause the host to become unresponsive     for a period of time, potentially leading to a DoS.
    Since an attacker with full control in the guest can     impact the host, this vulnerability is considered to     have high impact.

ID	Name	Product	Family	Severity
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	low
79480	OracleVM 3.0 : xen (OVMSA-2012-0035)	Nessus	OracleVM Local Security Checks	medium
79479	OracleVM 3.1 : xen (OVMSA-2012-0034)	Nessus	OracleVM Local Security Checks	medium
74751	openSUSE Security Update : Xen (openSUSE-SU-2012:1176-1)	Nessus	SuSE Local Security Checks	high
74750	openSUSE Security Update : Xen (openSUSE-SU-2012:1172-1)	Nessus	SuSE Local Security Checks	high
74749	openSUSE Security Update : Xen (openSUSE-SU-2012:1174-1)	Nessus	SuSE Local Security Checks	high
70184	GLSA-201309-24 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
64235	SuSE 11.2 Security Update : Xen and libvirt (SAT Patch Number 6640)	Nessus	SuSE Local Security Checks	medium
64234	SuSE 11.1 Security Update : Xen (SAT Patch Number 6653)	Nessus	SuSE Local Security Checks	medium
61616	Fedora 16 : xen-4.1.3-1.fc16 (2012-11785)	Nessus	Fedora Local Security Checks	medium
61614	Fedora 17 : xen-4.1.3-2.fc17 (2012-11755)	Nessus	Fedora Local Security Checks	medium
61578	Debian DSA-2531-1 : xen - Denial of Service	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-3433

medium

Tenable Plugins

low

medium

medium

high

high

high

high

medium

medium

medium

medium

medium