Xen 4.0.2 through 4.0.4, 4.1.x, and 4.2.x allows local PV guest users to cause a denial of service (hypervisor crash) via certain bit combinations to the XSETBV instruction.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/xsave: properly check guest input to XSETBV Other     than the HVM emulation path, the PV case so far failed     to check that YMM state requires SSE state to be     enabled, allowing for a #GP to occur upon passing the     inputs to XSETBV inside the hypervisor. This is     CVE-2013-2078 / XSA-54. (CVE-2013-2078)

  - 86/xsave: recover from faults on XRSTOR Just like     FXRSTOR, XRSTOR can raise #GP if bad content is being     passed to it in the memory block (i.e. aspects not under     the control of the hypervisor, other than e.g. proper     alignment of the block). Also correct the comment     explaining why FXRSTOR needs exception recovery code to     not wrongly state that this can only be a result of the     control tools passing a bad image. This is CVE-2013-2077     / XSA-53. (CVE-2013-2077)

  - x86/xsave: fix information leak on AMD CPUs Just like     for FXSAVE/FXRSTOR, XSAVE/XRSTOR also don't save/restore     the last instruction and operand pointers as well as the     last opcode if there's no pending unmasked exception     (see CVE-2006-1056 and commit 9747:4d667a139318). While     the FXSR solution sits in the save path, I prefer to     have this in the restore path because there the handling     is simpler (namely in the context of the pending changes     to properly save the selector values for 32-bit guest     code). Also this is using FFREE instead of EMMS, as it     doesn't seem unlikely that in the future we may see CPUs     with x87 and SSE/AVX but no MMX support. The goal here     anyway is just to avoid an FPU stack overflow. I would     have preferred to use FFREEP instead of FFREE (freeing     two stack slots at once), but AMD doesn't document that     instruction. This is CVE-2013-2076 / XSA-52.
    (CVE-2013-2076)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Other than the HVM emulation path, the PV case so far     failed to check that YMM state requires SSE state to be     enabled, allowing for a #GP to occur upon passing the     inputs to XSETBV inside the hypervisor. This is     CVE-2013-2078 / XSA-54. (CVE-2013-2078)

  - x86/xsave: recover from faults on XRSTOR Just like     FXRSTOR, XRSTOR can raise #GP if bad content is being     passed to it in the memory block (i.e. aspects not under     the control of the hypervisor, other than e.g. proper     alignment of the block). Also correct the comment     explaining why FXRSTOR needs exception recovery code to     not wrongly state that this can only be a result of the     control tools passing a bad image. This is CVE-2013-2077     / XSA-53. (CVE-2013-2077)

  - x86/xsave: fix information leak on AMD CPUs Just like     for FXSAVE/FXRSTOR, XSAVE/XRSTOR also don't save/restore     the last instruction and operand pointers as well as the     last opcode if there's no pending unmasked exception     (see CVE-2006-1056 and commit 9747:4d667a139318). While     the FXSR solution sits in the save path, I prefer to     have this in the restore path because there the handling     is simpler (namely in the context of the pending changes     to properly save the selector values for 32-bit guest     code). Also this is using FFREE instead of EMMS, as it     doesn't seem unlikely that in the future we may see CPUs     with x87 and SSE/AVX but no MMX support. The goal here     anyway is just to avoid an FPU stack overflow. I would     have preferred to use FFREEP instead of FFREE (freeing     two stack slots at once), but AMD doesn't document that     instruction. This is CVE-2013-2076 / XSA-52.
    (CVE-2013-2076)

Multiple security issues have been discovered in the Xen virtualisation solution which may result in information leaks or denial of service.

XEN was updated to 4.2.2, fixing lots of bugs and several security issues.

Various upstream patches were also merged into this version by our developers.

Detailed buglist :

  - bnc#824676 - Failed to setup devices for vm instance     when start multiple vms simultaneously

  - bnc#817799 - sles9sp4 guest fails to start after     upgrading to sles11 sp3

  - bnc#826882 - xen: CVE-2013-1432: XSA-58: Page reference     counting error due to XSA-45/CVE-2013-1918 fixes

  - Add upstream patch to fix devid assignment in libxl     27184-libxl-devid-fix.patch

  - bnc#823608 - xen: XSA-57: libxl allows guest write     access to sensitive console related xenstore keys     27178-libxl-Restrict-permissions-on-PV-console-device-xe     nstore-nodes.patch

  - bnc#823011 - xen: XSA-55: Multiple vulnerabilities in     libelf PV kernel handling

  - bnc#808269 - Fully Virtualized Windows VM install is     failed on Ivy Bridge platforms with Xen kernel

  - bnc#801663 - performance of mirror lvm unsuitable for     production block-dmmd

  - bnc#817904 - [SLES11SP3 BCS Bug] Crashkernel fails to     boot after panic on XEN kernel SP3 Beta 4 and RC1

  - Upstream AMD Erratum patch from Jan

  - bnc#813675 - - xen: CVE-2013-1919: XSA-46: Several     access permission issues with IRQs for unprivileged     guests

  - bnc#820917 - CVE-2013-2076: xen: Information leak on     XSAVE/XRSTOR capable AMD CPUs (XSA-52)

  - bnc#820919 - CVE-2013-2077: xen: Hypervisor crash due to     missing exception recovery on XRSTOR (XSA-53)

  - bnc#820920 - CVE-2013-2078: xen: Hypervisor crash due to     missing exception recovery on XSETBV (XSA-54)

  - bnc#808085 - aacraid driver panics mapping INT A when     booting kernel-xen

  - bnc#817210 - openSUSE 12.3 Domain 0 doesn't boot with     i915 graphics controller under Xen with VT-d enabled

  - bnc#819416 - xen: CVE-2013-2072: XSA-56: Buffer overflow     in xencontrol Python bindings affecting xend

  - bnc#818183 - xen: CVE-2013-2007: XSA-51: qga set umask     0077 when daemonizing

  - add lndir to BuildRequires

  - remove     xen.migrate.tools_notify_restore_to_hangup_during_migrat     ion_--abort_if_busy.patch It changed migration protocol     and upstream wants a different solution

  - bnc#802221 - fix xenpaging readd     xenpaging.qemu.flush-cache.patch

  - bnc#808269 - Fully Virtualized Windows VM install is     failed on Ivy Bridge platforms with Xen kernel

  - Additional fix for bnc#816159     CVE-2013-1918-xsa45-followup.patch

  - bnc#817068 - Xen guest with >1 sr-iov vf won't start

  - Update to Xen 4.2.2 c/s 26064 The following recent     security patches are included in the tarball     CVE-2013-0151-xsa34.patch (bnc#797285)     CVE-2012-6075-xsa41.patch (bnc#797523)     CVE-2013-1917-xsa44.patch (bnc#813673)     CVE-2013-1919-xsa46.patch (bnc#813675)

  - bnc#816159 - xen: CVE-2013-1918: XSA-45: Several long     latency operations are not preemptible

  - bnc#816163 - xen: CVE-2013-1952: XSA-49: VT-d interrupt     remapping source validation flaw for bridges

  - bnc#809662 - can't use pv-grub to start domU (pygrub     does work) xen.spec

  - bnc#814709 - Unable to create XEN virtual machines in     SLED 11 SP2 on Kyoto

  - bnc#813673 - CVE-2013-1917: xen: Xen PV DoS     vulnerability with SYSENTER

  - bnc#813675 - CVE-2013-1919: xen: Several access     permission issues with IRQs for unprivileged guests

  - bnc#814059 - xen: qemu-nbd format-guessing due to     missing format specification

XEN was updated to 4.1.5 release. It fixes various bugs and security issues.

Issues fixed separately from the 4.1.5 release :

  - bnc#824676 - Failed to setup devices for vm instance     when start multiple vms simultaneously 

  - bnc#XXXXXX - xen: CVE-2013-XXXX: XSA-61: suppress device     assignment to HVM guest when there is no IOMMU

  - Various upstream patches from Jan were integrated.

  - bnc#823786 - migrate.py support of short options dropped     by PTF

  - bnc#803712 - after live migration rcu_sched_state     detected stalls add new option xm migrate --min_remaing     <num>

  - CVE-2013-1432 / bnc#826882 - xen: XSA-58: x86: fix page     refcount handling in page table pin error path

  - CVE-2013-2211 / bnc#823608 - xen: XSA-57: libxl allows     guest write access to sensitive console related xenstore     keys

  - bnc#823011 - xen: XSA-55: Multiple vulnerabilities in     libelf PV kernel handling

  - bnc#801663 - performance of mirror lvm unsuitable for     production

  - CVE-2013-1918/ bnc#816159 - xen: CVE-2013-1918: XSA-45:
    Several long latency operations are not preemptible

  - CVE-2013-1952 / bnc#816163 - xen: CVE-2013-1952: XSA-49:
    VT-d interrupt remapping source validation flaw for     bridges

  - CVE-2013-2076 / bnc#820917 - CVE-2013-2076: xen:
    Information leak on XSAVE/XRSTOR capable AMD CPUs     (XSA-52)

  - CVE-2013-2077 / bnc#820919 - CVE-2013-2077: xen:
    Hypervisor crash due to missing exception recovery on     XRSTOR (XSA-53)

  - CVE-2013-2078 / bnc#820920 - CVE-2013-2078: xen:
    Hypervisor crash due to missing exception recovery on     XSETBV (XSA-54)

  - CVE-2013-2072 / bnc#819416 - xen: CVE-2013-2072: XSA-56:
    Buffer overflow in xencontrol Python bindings affecting     xend 

  - Update to Xen 4.1.5 c/s 23509 There were many xen.spec     file patches dropped as now being included in the 4.1.5     tarball.

  - CVE-2013-1918 / bnc#816159 - xen: XSA-45: Several long     latency operations are not preemptible

  - CVE-2013-1952 / bnc#816163 - xen: XSA-49: VT-d interrupt     remapping source validation flaw for bridges

  - bnc#809662 - can't use pv-grub to start domU (pygrub     does work)

  - CVE-2013-1917 / bnc#813673 - xen: Xen PV DoS     vulnerability with SYSENTER

  - CVE-2013-1919 / bnc#813675 - xen: Several access     permission issues with IRQs for unprivileged guests

  - CVE-2013-1920 / bnc#813677 - xen: Potential use of freed     memory in event channel operations

  - bnc#814709 - Unable to create XEN virtual machines in     SLED 11 SP2 on Kyoto

The remote host is affected by the vulnerability described in GLSA-201309-24 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Guest domains could possibly gain privileges, execute arbitrary code, or       cause a Denial of Service on the host domain (Dom0). Additionally, guest       domains could gain information about other virtual machines running on       the same host or read arbitrary files on the host.
  Workaround :

    The CVEs listed below do not currently have fixes, but only apply to Xen       setups which have &ldquo;tmem&rdquo; specified on the hypervisor command line.
      TMEM is not currently supported for use in production systems, and       administrators using tmem should disable it.
      Relevant CVEs:
      * CVE-2012-2497
      * CVE-2012-6030
      * CVE-2012-6031
      * CVE-2012-6032
      * CVE-2012-6033
      * CVE-2012-6034
      * CVE-2012-6035
      * CVE-2012-6036

The Xen hypervisor and toolset has been updated to 4.2.2_06 to fix various bugs and security issues :

The following security issues have been addressed :

  - Various integer overflows in the ELF loader were fixed.
    (XSA-55). (CVE-2013-2194)

  - Various pointer dereferences issues in the ELF loader     were fixed. (XSA-55). (CVE-2013-2195)

  - Various other problems in the ELF loader were fixed.
    (XSA-55). (CVE-2013-2196)

  - A Hypervisor crash due to missing exception recovery on     XSETBV was fixed. (XSA-54). (CVE-2013-2078)

  - A Hypervisor crash due to missing exception recovery on     XRSTOR was fixed. (XSA-53). (CVE-2013-2077)

  - libxl allowed guest write access to sensitive console     related xenstore keys. (XSA-57). (CVE-2013-2211)

  - An information leak on XSAVE/XRSTOR capable AMD CPUs     (XSA-52) was fixed, where parts of this state could leak     to other VMs. (CVE-2013-2076)

Also the following bugs have been fixed :

  - performance issues in mirror lvm. (bnc#801663)

  - aacraid driver panics mapping INT A when booting     kernel-xen. (bnc#808085)

  - Fully Virtualized Windows VM install failed on Ivy     Bridge platforms with Xen kernel. (bnc#808269)

  - Did not boot with i915 graphics controller with VT-d     enabled (bnc#817210)

Information leak on XSAVE/XRSTOR capable AMD CPUs [XSA-52, CVE-2013-2076] (#970206) Hypervisor crash due to missing exception recovery on XRSTOR [XSA-53, CVE-2013-2077] (#970204) Hypervisor crash due to missing exception recovery on XSETBV [XSA-54, CVE-2013-2078] (#970202) Multiple vulnerabilities in libelf PV kernel handling [XSA-55] (#970640)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

XEN has been updated to 4.1.5 c/s 23509 to fix various bugs and security issues.

The following security issues have been fixed :

  - Certain page table manipulation operations in Xen 4.1.x,     4.2.x, and earlier were not preemptible, which allowed     local PV kernels to cause a denial of service via     vectors related to deep page table traversal.
    (CVE-2013-1918)

  - Xen 4.x, when using Intel VT-d for a bus mastering     capable PCI device, did not properly check the source     when accessing a bridge devices interrupt remapping     table entries for MSI interrupts, which allowed local     guest domains to cause a denial of service (interrupt     injection) via unspecified vectors. (CVE-2013-1952)

  - A information leak in the XSAVE/XRSTOR instructions     could be used to determine state of floating point     operations in other domains. (CVE-2013-2076)

  - A denial of service (hypervisor crash) was possible due     to missing exception recovery on XRSTOR, that could be     used to crash the machine by PV guest users.
    (CVE-2013-2077)

  - A denial of service (hypervisor crash) was possible due     to missing exception recovery on XSETBV, that could be     used to crash the machine by PV guest users.
    (CVE-2013-2078)

  - Systems which allow untrusted administrators to     configure guest vcpu affinity may be exploited to     trigger a buffer overrun and corrupt memory.
    (CVE-2013-2072)

  - Xen 3.1 through 4.x, when running 64-bit hosts on Intel     CPUs, did not clear the NT flag when using an IRET after     a SYSENTER instruction, which allowed PV guest users to     cause a denial of service (hypervisor crash) by     triggering a #GP fault, which is not properly handled by     another IRET instruction. (CVE-2013-1917)

  - Xen 4.2.x and 4.1.x did not properly restrict access to     IRQs, which allowed local stub domain clients to gain     access to IRQs and cause a denial of service via vectors     related to 'passed-through IRQs or PCI devices.'.
    (CVE-2013-1919)

  - Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is     running 'under memory pressure' and the Xen Security     Module (XSM) is enabled, used the wrong ordering of     operations when extending the per-domain event channel     tracking table, which caused a use-after-free and     allowed local guest kernels to inject arbitrary events     and gain privileges via unspecified vectors.
    (CVE-2013-1920)

  - Xen 4.0.x and 4.1.x incorrectly released a grant     reference when releasing a non-v1, non-transitive grant,     which allowed local guest administrators to cause a     denial of service (host crash), obtain sensitive     information, or possible have other impacts via     unspecified vectors. (CVE-2013-1964)

Bugfixes :

  - Upstream patches from Jan     26956-x86-mm-preemptible-cleanup.patch     27071-x86-IO-APIC-fix-guest-RTE-write-corner-cases.patch     27072-x86-shadow-fix-off-by-one-in-MMIO-permission-check     .patch 27079-fix-XSA-46-regression-with-xend-xm.patch     27083-AMD-iommu-SR56x0-Erratum-64-Reset-all-head-tail-po     inters.patch

  - Update to Xen 4.1.5 c/s 23509 There were many xen.spec     file patches dropped as now being included in the 4.1.5     tarball.

  - can't use pv-grub to start domU (pygrub does work)     xen.spec. (bnc#809662)

  - Upstream patches from Jan     26702-powernow-add-fixups-for-AMD-P-state-figures.patch     26704-x86-MCA-suppress-bank-clearing-for-certain-injecte     d-events.patch     26731-AMD-IOMMU-Process-softirqs-while-building-dom0-iom     mu-mappings.patch     26733-VT-d-Enumerate-IOMMUs-when-listing-capabilities.pa     tch     26734-ACPI-ERST-Name-table-in-otherwise-opaque-error-mes     sages.patch     26736-ACPI-APEI-Unlock-apei_iomaps_lock-on-error-path.pa     tch 26737-ACPI-APEI-Add-apei_exec_run_optional.patch     26742-IOMMU-properly-check-whether-interrupt-remapping-i     s-enabled.patch     26743-VT-d-deal-with-5500-5520-X58-errata.patch     26744-AMD-IOMMU-allow-disabling-only-interrupt-remapping     .patch     26749-x86-reserve-pages-when-SandyBridge-integrated-grap     hics.patch     26765-hvm-Clean-up-vlapic_reg_write-error-propagation.pa     tch     26770-x86-irq_move_cleanup_interrupt-must-ignore-legacy-     vectors.patch     26771-x86-S3-Restore-broken-vcpu-affinity-on-resume.patc     h     26772-VMX-Always-disable-SMEP-when-guest-is-in-non-pagin     g-mode.patch     26773-x86-mm-shadow-spurious-warning-when-unmapping-xenh     eap-pages.patch     26799-x86-don-t-pass-negative-time-to-gtime_to_gtsc.patc     h     26851-iommu-crash-Interrupt-remapping-is-also-disabled-o     n-crash.patch

  - Unable to create XEN virtual machines in SLED 11 SP2 on     Kyoto xend-cpuinfo-model-name.patch. (bnc#814709)

  - Upstream patches from Jan 26536-xenoprof-div-by-0.patch     26578-AMD-IOMMU-replace-BUG_ON.patch     26656-x86-fix-null-pointer-dereference-in-intel_get_exte     nded_msrs.patch     26659-AMD-IOMMU-erratum-746-workaround.patch     26660-x86-fix-CMCI-injection.patch     26672-vmx-fix-handling-of-NMI-VMEXIT.patch     26673-Avoid-stale-pointer-when-moving-domain-to-another-     cpupool.patch     26676-fix-compat-memory-exchange-op-splitting.patch     26677-x86-make-certain-memory-sub-ops-return-valid-value     s.patch 26678-SEDF-avoid-gathering-vCPU-s-on-pCPU0.patch     26679-x86-defer-processing-events-on-the-NMI-exit-path.p     atch     26683-credit1-Use-atomic-bit-operations-for-the-flags-st     ructure.patch     26692-x86-MSI-fully-protect-MSI-X-table.patch

ID	Name	Product	Family	Severity
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	low
79511	OracleVM 3.1 : xen (OVMSA-2013-0043)	Nessus	OracleVM Local Security Checks	medium
79510	OracleVM 3.2 : xen (OVMSA-2013-0042)	Nessus	OracleVM Local Security Checks	medium
77240	Debian DSA-3006-1 : xen - security update	Nessus	Debian Local Security Checks	high
75130	openSUSE Security Update : xen (openSUSE-SU-2013:1404-1)	Nessus	SuSE Local Security Checks	high
75129	openSUSE Security Update : xen (openSUSE-SU-2013:1392-1)	Nessus	SuSE Local Security Checks	high
70184	GLSA-201309-24 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
69297	SuSE 11.3 Security Update : Xen (SAT Patch Number 8063)	Nessus	SuSE Local Security Checks	high
67395	Fedora 19 : xen-4.2.2-6.fc19 (2013-9986)	Nessus	Fedora Local Security Checks	medium
67275	Fedora 17 : xen-4.1.5-5.fc17 (2013-10247)	Nessus	Fedora Local Security Checks	medium
67269	Fedora 18 : xen-4.2.2-6.fc18 (2013-10136)	Nessus	Fedora Local Security Checks	medium
66985	SuSE 11.2 Security Update : Xen (SAT Patch Number 7798)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2013-2078

medium

Tenable Plugins

low

medium

medium

high

high

high

high

high

medium

medium

medium

high