The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.

The remote host is affected by the vulnerability described in GLSA-201604-03 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly cause a Denial of Service condition or       obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - console: bounds check whenever changing the cursor due     to an escape code The device model used by fully     virtualised (HVM) domains, qemu, does not properly     handle escape VT100 sequences when emulating certain     devices with a virtual console backend. (CVE-2012-3515)

  - x86/pvhvm: properly range-check     PHYSDEVOP_map_pirq/MAP_PIRQ_TYPE_GSI PHYSDEVOP_map_pirq     with MAP_PIRQ_TYPE_GSI does not range check map->index.
    This is being used as a array index, and hence must be     validated before use. A malicious HVM guest kernel can     crash the host. It might also be able to read hypervisor     or guest memory. (CVE-2012-3496)

  - xen: Don't BUG_ON PoD operations on a non-translated     guest. XENMEM_populate_physmap can be called with     invalid flags. By calling it with     MEMF_populate_on_demand flag set, a BUG can be triggered     if a translating paging mode is not being used.
    (CVE-2012-3496)

  - xen: handle out-of-pirq condition correctly in     PHYSDEVOP_get_free_pirq PHYSDEVOP_get_free_pirq does not     check that its call to get_free_pirq succeeded, and if     it fails will use the error code as an array index.
    (CVE-2012-3495)

  - xen: prevent a 64 bit guest setting reserved bits in DR7     The upper 32 bits of this register are reserved and     should be written as zero. (CVE-2012-3494)

This security update of XEN fixes various bugs and security issues.

  - Upstream patch 26088-xend-xml-filesize-check.patch

  - bnc#787163 - CVE-2012-4544: xen: Domain builder Out-of-     memory due to malicious kernel/ramdisk (XSA 25)     CVE-2012-4544-xsa25.patch

  - bnc#779212 - CVE-2012-4411: XEN / qemu: guest     administrator can access qemu monitor console (XSA-19)     CVE-2012-4411-xsa19.patch

  - bnc#786516 - CVE-2012-4535: xen: Timer overflow DoS     vulnerability CVE-2012-4535-xsa20.patch

  - bnc#786518 - CVE-2012-4536: xen: pirq range check DoS     vulnerability CVE-2012-4536-xsa21.patch

  - bnc#786517 - CVE-2012-4537: xen: Memory mapping failure     DoS vulnerability CVE-2012-4537-xsa22.patch

  - bnc#786519 - CVE-2012-4538: xen: Unhooking empty PAE     entries DoS vulnerability CVE-2012-4538-xsa23.patch

  - bnc#786520 - CVE-2012-4539: xen: Grant table hypercall     infinite loop DoS vulnerability     CVE-2012-4539-xsa24.patch

  - bnc#784087 - L3: Xen BUG at io_apic.c:129     26102-x86-IOAPIC-legacy-not-first.patch

  - Upstream patches from Jan     26054-x86-AMD-perf-ctr-init.patch     26055-x86-oprof-hvm-mode.patch     26056-page-alloc-flush-filter.patch     26061-x86-oprof-counter-range.patch     26062-ACPI-ERST-move-data.patch     26063-x86-HPET-affinity-lock.patch     26093-HVM-PoD-grant-mem-type.patch

  - Upstream patches from Jan     25931-x86-domctl-iomem-mapping-checks.patch     25952-x86-MMIO-remap-permissions.patch

------------------------------------------------------------------- Mon Sep 24 16:41:58 CEST 2012 - ohering@suse.de

  - use BuildRequires: gcc46 only in sles11sp2 or 12.1 to     fix build in 11.4

------------------------------------------------------------------- Thu Sep 20 10:03:40 MDT 2012 - carnold@novell.com

  - Upstream patches from Jan     25808-domain_create-return-value.patch     25814-x86_64-set-debugreg-guest.patch     25815-x86-PoD-no-bug-in-non-translated.patch     25816-x86-hvm-map-pirq-range-check.patch     25833-32on64-bogus-pt_base-adjust.patch     25834-x86-S3-MSI-resume.patch     25835-adjust-rcu-lock-domain.patch     25836-VT-d-S3-MSI-resume.patch 25850-tmem-xsa-15-1.patch     25851-tmem-xsa-15-2.patch 25852-tmem-xsa-15-3.patch     25853-tmem-xsa-15-4.patch 25854-tmem-xsa-15-5.patch     25855-tmem-xsa-15-6.patch 25856-tmem-xsa-15-7.patch     25857-tmem-xsa-15-8.patch 25858-tmem-xsa-15-9.patch     25859-tmem-missing-break.patch 25860-tmem-cleanup.patch     25883-pt-MSI-cleanup.patch     25927-x86-domctl-ioport-mapping-range.patch     25929-tmem-restore-pool-version.patch

  - bnc#778105 - first XEN-PV VM fails to spawn xend:
    Increase wait time for disk to appear in host bootloader     Modified existing xen-domUloader.diff

  - Upstream patches from Jan     25752-ACPI-pm-op-valid-cpu.patch     25754-x86-PoD-early-access.patch     25755-x86-PoD-types.patch     25756-x86-MMIO-max-mapped-pfn.patch     25757-x86-EPT-PoD-1Gb-assert.patch     25764-x86-unknown-cpu-no-sysenter.patch     25765-x86_64-allow-unsafe-adjust.patch     25771-grant-copy-status-paged-out.patch     25773-x86-honor-no-real-mode.patch     25786-x86-prefer-multiboot-meminfo-over-e801.patch

  - bnc#777890 - CVE-2012-3497: xen: multiple TMEM hypercall     vulnerabilities (XSA-15)     CVE-2012-3497-tmem-xsa-15-1.patch     CVE-2012-3497-tmem-xsa-15-2.patch     CVE-2012-3497-tmem-xsa-15-3.patch     CVE-2012-3497-tmem-xsa-15-4.patch     CVE-2012-3497-tmem-xsa-15-5.patch     CVE-2012-3497-tmem-xsa-15-6.patch     CVE-2012-3497-tmem-xsa-15-7.patch     CVE-2012-3497-tmem-xsa-15-8.patch     CVE-2012-3497-tmem-xsa-15-9.patch     tmem-missing-break.patch

This security update of XEN fixes various bugs and security issues.

  - Upstream patch 26088-xend-xml-filesize-check.patch

  - bnc#787163 - CVE-2012-4544: xen: Domain builder Out-of-     memory due to malicious kernel/ramdisk (XSA 25)     CVE-2012-4544-xsa25.patch

  - bnc#779212 - CVE-2012-4411: XEN / qemu: guest     administrator can access qemu monitor console (XSA-19)     CVE-2012-4411-xsa19.patch

  - bnc#786516 - CVE-2012-4535: xen: Timer overflow DoS     vulnerability CVE-2012-4535-xsa20.patch

  - bnc#786518 - CVE-2012-4536: xen: pirq range check DoS     vulnerability CVE-2012-4536-xsa21.patch

  - bnc#786517 - CVE-2012-4537: xen: Memory mapping failure     DoS vulnerability CVE-2012-4537-xsa22.patch

  - bnc#786519 - CVE-2012-4538: xen: Unhooking empty PAE     entries DoS vulnerability CVE-2012-4538-xsa23.patch

  - bnc#786520 - CVE-2012-4539: xen: Grant table hypercall     infinite loop DoS vulnerability     CVE-2012-4539-xsa24.patch

  - bnc#784087 - L3: Xen BUG at io_apic.c:129     26102-x86-IOAPIC-legacy-not-first.patch

  - Upstream patches from Jan     26054-x86-AMD-perf-ctr-init.patch     26055-x86-oprof-hvm-mode.patch     26056-page-alloc-flush-filter.patch     26061-x86-oprof-counter-range.patch     26062-ACPI-ERST-move-data.patch     26063-x86-HPET-affinity-lock.patch     26093-HVM-PoD-grant-mem-type.patch

  - Upstream patches from Jan     25931-x86-domctl-iomem-mapping-checks.patch     25952-x86-MMIO-remap-permissions.patch

  - Upstream patches from Jan     25808-domain_create-return-value.patch     25814-x86_64-set-debugreg-guest.patch     25815-x86-PoD-no-bug-in-non-translated.patch     25816-x86-hvm-map-pirq-range-check.patch     25833-32on64-bogus-pt_base-adjust.patch     25834-x86-S3-MSI-resume.patch     25835-adjust-rcu-lock-domain.patch     25836-VT-d-S3-MSI-resume.patch 25850-tmem-xsa-15-1.patch     25851-tmem-xsa-15-2.patch 25852-tmem-xsa-15-3.patch     25853-tmem-xsa-15-4.patch 25854-tmem-xsa-15-5.patch     25855-tmem-xsa-15-6.patch 25856-tmem-xsa-15-7.patch     25857-tmem-xsa-15-8.patch 25858-tmem-xsa-15-9.patch     25859-tmem-missing-break.patch 25860-tmem-cleanup.patch     25883-pt-MSI-cleanup.patch     25927-x86-domctl-ioport-mapping-range.patch     25929-tmem-restore-pool-version.patch

  - bnc#778105 - first XEN-PV VM fails to spawn xend:
    Increase wait time for disk to appear in host bootloader     Modified existing xen-domUloader.diff

  - Upstream patches from Jan     25752-ACPI-pm-op-valid-cpu.patch     25754-x86-PoD-early-access.patch     25755-x86-PoD-types.patch     25756-x86-MMIO-max-mapped-pfn.patch     25757-x86-EPT-PoD-1Gb-assert.patch     25764-x86-unknown-cpu-no-sysenter.patch     25765-x86_64-allow-unsafe-adjust.patch     25771-grant-copy-status-paged-out.patch     25773-x86-honor-no-real-mode.patch     25786-x86-prefer-multiboot-meminfo-over-e801.patch

  - bnc#777890 - CVE-2012-3497: xen: multiple TMEM hypercall     vulnerabilities (XSA-15)     CVE-2012-3497-tmem-xsa-15-1.patch     CVE-2012-3497-tmem-xsa-15-2.patch     CVE-2012-3497-tmem-xsa-15-3.patch     CVE-2012-3497-tmem-xsa-15-4.patch     CVE-2012-3497-tmem-xsa-15-5.patch     CVE-2012-3497-tmem-xsa-15-6.patch     CVE-2012-3497-tmem-xsa-15-7.patch     CVE-2012-3497-tmem-xsa-15-8.patch     CVE-2012-3497-tmem-xsa-15-9.patch     tmem-missing-break.patch

Security Update for Xen

Following bug and security fixes were applied :

  - bnc#776995 - attaching scsi control luns with pvscsi

  - xend/pvscsi: fix passing of SCSI control LUNs     xen-bug776995-pvscsi-no-devname.patch

  - xend/pvscsi: fix usage of persistant device names for     SCSI devices xen-bug776995-pvscsi-persistent-names.patch

  - xend/pvscsi: update sysfs parser for Linux 3.0     xen-bug776995-pvscsi-sysfs-parser.patch

  - bnc#777090 - CVE-2012-3494: xen: hypercall set_debugreg     vulnerability (XSA-12) CVE-2012-3494-xsa12.patch

  - bnc#777088 - CVE-2012-3495: xen: hypercall     physdev_get_free_pirq vulnerability (XSA-13)     CVE-2012-3495-xsa13.patch

  - bnc#777091 - CVE-2012-3496: xen: XENMEM_populate_physmap     DoS vulnerability (XSA-14) CVE-2012-3496-xsa14.patch

  - bnc#777086 - CVE-2012-3498: xen: PHYSDEVOP_map_pirq     index vulnerability (XSA-16) CVE-2012-3498-xsa16.patch

  - bnc#777084 - CVE-2012-3515: xen: Qemu VT100 emulation     vulnerability (XSA-17) CVE-2012-3515-xsa17.patch

  - Upstream patches from Jan     25734-x86-MCG_CTL-default.patch     25735-x86-cpuid-masking-XeonE5.patch     25744-hypercall-return-long.patch

  - Update to Xen 4.1.3 c/s 23336 

  - Upstream or pending upstream patches from Jan     25587-fix-off-by-one-parsing-error.patch     25616-x86-MCi_CTL-default.patch     25617-vtd-qinval-addr.patch 25688-x86-nr_irqs_gsi.patch

  - bnc#773393 - VUL-0: CVE-2012-3433: xen: HVM guest     destroy p2m teardown host DoS vulnerability     CVE-2012-3433-xsa11.patch

  - bnc#773401 - VUL-1: CVE-2012-3432: xen: HVM guest user     mode MMIO emulation DoS     25682-x86-inconsistent-io-state.patch

  - bnc#762484 - VUL-1: CVE-2012-2625: xen: pv bootloader     doesn't check the size of the bzip2 or lzma compressed     kernel, leading to denial of service     25589-pygrub-size-limits.patch

  - bnc#767273 - unsupported /var/lock/subsys is still used     by xendomains init.xendomains

  - bnc#766283 - opensuse 12.2 pv guests can not start after     installation due to lack of grub2 support in the host     23686-pygrub-solaris.patch 23697-pygrub-grub2.patch     23944-pygrub-debug.patch 23998-pygrub-GPT.patch     23999-pygrub-grub2.patch 24000-pygrub-grub2.patch     24001-pygrub-grub2.patch 24002-pygrub-grub2.patch     24064-pygrub-HybridISO.patch     24401-pygrub-scrolling.patch 24402-pygrub-edit-fix.patch     24460-pygrub-extlinux.patch 24706-pygrub-extlinux.patch

The remote host is affected by the vulnerability described in GLSA-201309-24 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Guest domains could possibly gain privileges, execute arbitrary code, or       cause a Denial of Service on the host domain (Dom0). Additionally, guest       domains could gain information about other virtual machines running on       the same host or read arbitrary files on the host.
  Workaround :

    The CVEs listed below do not currently have fixes, but only apply to Xen       setups which have &ldquo;tmem&rdquo; specified on the hypervisor command line.
      TMEM is not currently supported for use in production systems, and       administrators using tmem should disable it.
      Relevant CVEs:
      * CVE-2012-2497
      * CVE-2012-6030
      * CVE-2012-6031
      * CVE-2012-6032
      * CVE-2012-6033
      * CVE-2012-6034
      * CVE-2012-6035
      * CVE-2012-6036

XEN was updated 4.1.3 to fix multiple bugs and security issues.

The following security issues have been fixed :

  - xen: hypercall set_debugreg vulnerability (XSA-12).
    (CVE-2012-3494)

  - xen: hypercall physdev_get_free_pirq vulnerability     (XSA-13). (CVE-2012-3495)

  - xen: XENMEM_populate_physmap DoS vulnerability (XSA-14).
    (CVE-2012-3496)

  - xen: PHYSDEVOP_map_pirq index vulnerability (XSA-16).
    (CVE-2012-3498)

  - xen: Qemu VT100 emulation vulnerability (XSA-17) Also     the following bugs have been fixed:. (CVE-2012-3515)

  - pvscsi support of attaching Luns - (bnc#776995) The     following related bugs in vm-install 0.5.12 have been     fixed :

  - vm-install does not pass --extra-args in --upgrade.
    (bnc#776300)

  - Add for support Open Enterprise Server 11

  - Add support for Windows 8 and Windows Server 2012

  - Add support for Ubuntu 12 (Precise Pangolin)

a malicious 64-bit PV guest can crash the dom0 [XSA-12, CVE-2012-3494] (#854585) a malicious crash might be able to crash the dom0 or escalate privileges [XSA-13, CVE-2012-3495] (#854589) a malicious PV guest can crash the dom0 [XSA-14, CVE-2012-3496] (#854590) a malicious HVM guest can crash the dom0 and might be able to read hypervisor or guest memory [XSA-16, CVE-2012-3498] (#854593) an HVM guest could use VT100 escape sequences to escalate privileges to that of the qemu process [XSA-17, CVE-2012-3515] (#854599) disable qemu monitor by default [XSA-19, CVE-2012-4411] (#855141)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
90380	GLSA-201604-03 : Xen: Multiple vulnerabilities (Venom)	Nessus	Gentoo Local Security Checks	critical
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	low
79482	OracleVM 3.1 : xen (OVMSA-2012-0039)	Nessus	OracleVM Local Security Checks	high
74821	openSUSE Security Update : XEN (openSUSE-SU-2012:1573-1)	Nessus	SuSE Local Security Checks	high
74820	openSUSE Security Update : XEN (openSUSE-SU-2012:1572-1)	Nessus	SuSE Local Security Checks	high
74751	openSUSE Security Update : Xen (openSUSE-SU-2012:1176-1)	Nessus	SuSE Local Security Checks	high
74750	openSUSE Security Update : Xen (openSUSE-SU-2012:1172-1)	Nessus	SuSE Local Security Checks	high
70184	GLSA-201309-24 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
64237	SuSE 11.2 Security Update : Xen (SAT Patch Number 6748)	Nessus	SuSE Local Security Checks	high
64236	SuSE 11.2 Security Update : Xen (SAT Patch Number 6748)	Nessus	SuSE Local Security Checks	high
62155	Fedora 16 : xen-4.1.3-2.fc16 (2012-13443)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2012-3495

high

Tenable Plugins

critical

low

high

high

high

high

high

high

high

high

high