oxenstored in Xen 4.1.x, Xen 4.2.x, and xen-unstable does not properly consider the state of the Xenstore ring during read operations, which allows guest OS users to cause a denial of service (daemon crash and host-control outage, or memory consumption) or obtain sensitive control-plane data by leveraging guest administrative access.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - oxenstored incorrect handling of certain Xenbus ring     states Xen Security Advisory 38 (CVE-2013-0215) Patch     xsa38.patch The oxenstored daemon (the ocaml version of     the xenstore daemon) does not correctly handle unusual     or malicious contents in the xenstore ring. A malicious     guest can exploit this to cause oxenstored to read past     the end of the ring (and very likely crash) or to     allocate large amounts of RAM. Signed-off-by Chuck     Anderson (CVE-2013-0215)

  - ACPI: acpi_table_parse should return handler's error     code Currently, the error code returned by     acpi_table_parse's handler is ignored. This patch will     propagate handler's return value to acpi_table_parse's     caller. AMD,IOMMU: Clean up old entries in remapping     tables when creating new interrupt mapping. When     changing the affinity of an IRQ associated with a passed     through PCI device, clear previous mapping. In addition,     because some BIOSes may incorrectly program IVRS entries     for IOAPIC try to check for entry's consistency.
    Specifically, if conflicting entries are found disable     IOMMU if per-device remapping table is used. If entries     refer to bogus IOAPIC IDs disable IOMMU unconditionally     AMD,IOMMU: Disable IOMMU if SATA Combined mode is on     AMD's SP5100 chipset can be placed into SATA Combined     mode that may cause prevent dom0 from booting when IOMMU     is enabled and per-device interrupt remapping table is     used. While SP5100 erratum 28 requires BIOSes to disable     this mode, some may still use it. This patch checks     whether this mode is on and, if per-device table is in     use, disables IOMMU. AMD,IOMMU: Make per-device     interrupt remapping table default Using global interrupt     remapping table may be insecure, as described by XSA-36.
    This patch makes per-device mode default. This is XSA-36     / CVE-2013-0153. (CVE-2013-0153)

The remote host is affected by the vulnerability described in GLSA-201309-24 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Guest domains could possibly gain privileges, execute arbitrary code, or       cause a Denial of Service on the host domain (Dom0). Additionally, guest       domains could gain information about other virtual machines running on       the same host or read arbitrary files on the host.
  Workaround :

    The CVEs listed below do not currently have fixes, but only apply to Xen       setups which have &ldquo;tmem&rdquo; specified on the hypervisor command line.
      TMEM is not currently supported for use in production systems, and       administrators using tmem should disable it.
      Relevant CVEs:
      * CVE-2012-2497
      * CVE-2012-6030
      * CVE-2012-6031
      * CVE-2012-6032
      * CVE-2012-6033
      * CVE-2012-6034
      * CVE-2012-6035
      * CVE-2012-6036

adjust gcc 4.8 fixes guest using oxenstored can crash host or exhaust memory [XSA-38, CVE-2013-0215] (#907888), guest using AMD-Vi for PCI passthrough can cause denial of service [XSA-36, CVE-2013-0153] (#910914), fixes for gcc 4.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

guest using oxenstored can crash host or exhaust memory [XSA-38, CVE-2013-0215] (#907888), guest using AMD-Vi for PCI passthrough can cause denial of service [XSA-36, CVE-2013-0153](#910914)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	low
79500	OracleVM 3.2 : xen (OVMSA-2013-0011)	Nessus	OracleVM Local Security Checks	medium
79498	OracleVM 3.1 : xen (OVMSA-2013-0009)	Nessus	OracleVM Local Security Checks	medium
70184	GLSA-201309-24 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
64678	Fedora 18 : xen-4.2.1-7.fc18 (2013-2225)	Nessus	Fedora Local Security Checks	medium
64650	Fedora 17 : xen-4.1.4-4.fc17 (2013-2002)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-0215

critical

Tenable Plugins

low

medium

medium

high

medium

medium