The Ocaml xenstored implementation (oxenstored) in Xen 4.1.x, 4.2.x, and 4.3.x allows local guest domains to cause a denial of service (domain shutdown) via a large message reply.

XEN has been updated to version 4.2.3 c/s 26170, fixing various bugs and security issues.

  - CVE-2013-4416: XSA-72: Fixed ocaml xenstored that     mishandled oversized message replies

  - CVE-2013-4355: XSA-63: Fixed information leaks through     I/O instruction emulation

  - CVE-2013-4361: XSA-66: Fixed information leak through     fbld instruction emulation

  - CVE-2013-4368: XSA-67: Fixed information leak through     outs instruction emulation

  - CVE-2013-4369: XSA-68: Fixed possible null dereference     when parsing vif ratelimiting info

  - CVE-2013-4370: XSA-69: Fixed misplaced free in ocaml     xc_vcpu_getaffinity stub

  - CVE-2013-4371: XSA-70: Fixed use-after-free in     libxl_list_cpupool under memory pressure

  - CVE-2013-4375: XSA-71: xen: qemu disk backend (qdisk)     resource leak

  - CVE-2013-1442: XSA-62: Fixed information leak on AVX     and/or LWP capable CPUs

  - CVE-2013-1432: XSA-58: Page reference counting error due     to XSA-45/CVE-2013-1918 fixes.

Various bugs have also been fixed :

  - Boot failure with xen kernel in UEFI mode with error 'No     memory for trampoline' (bnc#833483)

  - Improvements to block-dmmd script (bnc#828623)

  - MTU size on Dom0 gets reset when booting DomU with e1000     device (bnc#840196)

  - In HP's UEFI x86_64 platform and with xen environment,     in booting stage, xen hypervisor will panic.
    (bnc#833251)

  - Xen: migration broken from xsave-capable to     xsave-incapable host (bnc#833796)

  - In xen, 'shutdown -y 0 -h' cannot power off system     (bnc#834751)

  - In HP's UEFI x86_64 platform with xen environment, xen     hypervisor will panic on multiple blades nPar.
    (bnc#839600)

  - vcpus not started after upgrading Dom0 from SLES 11 SP2     to SP3 (bnc#835896)

  - SLES 11 SP3 Xen security patch does not automatically     update UEFI boot binary (bnc#836239)

  - Failed to setup devices for vm instance when start     multiple vms simultaneously (bnc#824676)

  - SLES 9 SP4 guest fails to start after upgrading to SLES     11 SP3 (bnc#817799)

  - Various upstream fixes have been included.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201407-03 (Xen: Multiple Vunlerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can utilize multiple vectors to execute arbitrary       code, cause Denial of Service, or gain access to data on the host.
  Workaround :

    There is no known workaround at this time.

Xen was updated to 4.3.1 and also to fix various security issues and bugs :

  - bnc#851749 - Xen service file does not call xend     properly xend.service 

  - Add missing requires to pciutils package for xend-tools

  - bnc#851386 - xen: XSA-78: Insufficient TLB flushing in     VT-d (iommu) code

  - Make -devel package depend on libuuid-devel, since     libxl.h includes uuid.h

  - bnc#849667 - CVE-2013-4553: xen: XSA-74: Lock order     reversal between page_alloc_lock and mm_rwlock

  - bnc#849665 - CVE-2013-4551: xen: XSA-75: Host crash due     to guest VMX instruction execution

  - bnc#849668 - CVE-2013-4554: xen: XSA-76: Hypercalls     exposed to privilege rings 1 and 2 of HVM guests

  - bnc#848657 - xen: CVE-2013-4494: XSA-73: Lock order     reversal between page allocation and grant table locks

  - Update to Xen 4.3.1 

  - bnc#845520 - CVE-2013-4416: xen: ocaml xenstored     mishandles oversized message replies

Xen was updated to 4.1.6 c/s 23588 to fix various bugs and security issues.

Following changes are listed :

  - Comment out the -include directive in Config.mk as the     build service build seems to error out not finding     '.config' xen-config.diff

  - bnc#845520 - CVE-2013-4416: xen: ocaml xenstored     mishandles oversized message replies

  - Improvements to block-dmmd script bnc#828623

  - bnc#840196 - MTU size on Dom0 gets reset when booting     DomU with e1000 device

  - bnc#840592 - CVE-2013-4355: XSA-63: xen: Information     leaks through I/O instruction emulation

  - bnc#841766 - CVE-2013-4361: XSA-66: xen: Information     leak through fbld instruction emulation

  - bnc#842511 - CVE-2013-4368: XSA-67: xen: Information     leak through outs instruction emulation

  - xen/27397-ACPI-fix-acpi_os_map_memory.patch: address     regression

  - bnc#839596 - CVE-2013-1442: XSA-62: xen: Information     leak on AVX and/or LWP capable CPUs

  - bnc#833251 - In HP&rsquo;s UEFI x86_64 platform and with     xen environment, in booting stage ,xen hypervisor will     panic.

  - bnc#833796 - Xen: migration broken from xsave-capable to     xsave-incapable host

  - bnc#834751 - In xen, &ldquo;shutdown &ndash;y 0     &ndash;h&rdquo; cannot power off system

  - bnc#833251 - In HP&rsquo;s UEFI x86_64 platform and with     xen environment, in booting stage ,xen hypervisor will     panic.

  - bnc#839600 - In HP&rsquo;s UEFI x86_64 platform and     sles11sp3 with xen environment, xen hypervisor will     panic on multiple blades nPar.

Xen was updated to 4.2.3 c/s 26170 to fix various bugs and security issues.

Following issues were fixed :

  - bnc#845520 - CVE-2013-4416: xen: ocaml xenstored     mishandles oversized message replies

  - bnc#833483 - Boot Failure with xen kernel in UEFI mode     with error 'No memory for trampoline'

  - Improvements to block-dmmd script bnc#828623

  - bnc#840196 - MTU size on Dom0 gets reset when booting     DomU with e1000 device

  - bnc#840592 - CVE-2013-4355: XSA-63: xen: Information     leaks through I/O instruction emulation

  - bnc#841766 - CVE-2013-4361: XSA-66: xen: Information     leak through fbld instruction emulation

  - bnc#842511 - CVE-2013-4368: XSA-67: xen: Information     leak through outs instruction emulation

  - bnc#842512 - CVE-2013-4369: XSA-68: xen: possible null     dereference when parsing vif ratelimiting info

  - bnc#842513 - CVE-2013-4370: XSA-69: xen: misplaced free     in ocaml xc_vcpu_getaffinity stub

  - bnc#842514 - CVE-2013-4371: XSA-70: xen: use-after-free     in libxl_list_cpupool under memory pressure

  - bnc#842515 - CVE-2013-4375: XSA-71: xen: qemu disk     backend (qdisk) resource leak

  - bnc#839596 - CVE-2013-1442: XSA-62: xen: Information     leak on AVX and/or LWP capable CPUs

  - bnc#833251 - [HP BCS SLES11 Bug]: In HP&rsquo;s UEFI     x86_64 platform and with xen environment, in booting     stage ,xen hypervisor will panic.

  - bnc#833796 - Xen: migration broken from xsave-capable to     xsave-incapable host

  - bnc#834751 - [HP BCS SLES11 Bug]: In xen,     &ldquo;shutdown &ndash;y 0 &ndash;h&rdquo; cannot power     off system

  - bnc#839600 - [HP BCS SLES11 Bug]: In HP&rsquo;s UEFI     x86_64 platform and sles11sp3 with xen environment, xen     hypervisor will panic on multiple blades nPar. 

  - bnc#833251 - [HP BCS SLES11 Bug]: In HP&rsquo;s UEFI     x86_64 platform and with xen environment, in booting     stage ,xen hypervisor will panic.

  - bnc#835896 - vcpus not started after upgrading Dom0 from     11SP2 to SP3

  - bnc#836239 - SLES 11 SP3 Xen security patch does not     automatically update UEFI boot binary

The Xen hypervisor and tool-suite have been updated to fix security issues and bugs :

  - XSA-73: A lock order reversal between page allocation     and grant table locks could lead to host crashes or even     host code execution. (CVE-2013-4494)

  - XSA-74: A lock order reversal between page_alloc_lock     and mm_rwlock could lead to deadlocks. (CVE-2013-4553)

  - XSA-76: Hypercalls exposed to privilege rings 1 and 2 of     HVM guests which might lead to Hypervisor escalation     under specific circumstances. (CVE-2013-4554)

  - XSA-78: Insufficient TLB flushing in VT-d (iommu) code     could lead to access of memory that was revoked.
    (CVE-2013-6375)

  - XSA-75: A host crash due to guest VMX instruction     execution was fixed. Non-security bugs have also been     fixed:. (CVE-2013-4551)

  - It is possible to start a VM twice on the same node.
    (bnc#840997)

  - In HP's UEFI x86_64 platform and SLES 11-SP3, dom0 will     could lock-up on multiple blades nPar. (bnc#842417)

  - Xen Hypervisor panics on 8-blades nPar with 46-bit     memory addressing. (bnc#848014)

  - Soft lock-up with PCI pass-through and many VCPUs.
    (bnc#846849)

  - Boot Failure with Xen kernel in UEFI mode with error 'No     memory for trampoline'. (bnc#833483)

  - Increase the maximum supported CPUs in the Hypervisor to     512.

XEN has been updated to version 4.2.3 c/s 26170, fixing various bugs and security issues.

  - XSA-72: Fixed ocaml xenstored that mishandled oversized     message replies. (CVE-2013-4416)

  - XSA-63: Fixed information leaks through I/O instruction     emulation. (CVE-2013-4355)

  - XSA-66: Fixed information leak through fbld instruction     emulation. (CVE-2013-4361)

  - XSA-67: Fixed information leak through outs instruction     emulation. (CVE-2013-4368)

  - XSA-68: Fixed possible null dereference when parsing vif     ratelimiting info. (CVE-2013-4369)

  - XSA-69: Fixed misplaced free in ocaml     xc_vcpu_getaffinity stub. (CVE-2013-4370)

  - XSA-70: Fixed use-after-free in libxl_list_cpupool under     memory pressure. (CVE-2013-4371)

  - XSA-71: xen: qemu disk backend (qdisk) resource leak.
    (CVE-2013-4375)

  - XSA-62: Fixed information leak on AVX and/or LWP capable     CPUs. (CVE-2013-1442)

  - XSA-58: Page reference counting error due to     XSA-45/CVE-2013-1918 fixes. Various bugs have also been     fixed:. (CVE-2013-1432)

  - Boot failure with xen kernel in UEFI mode with error 'No     memory for trampoline'. (bnc#833483)

  - Improvements to block-dmmd script. (bnc#828623)

  - MTU size on Dom0 gets reset when booting DomU with e1000     device. (bnc#840196)

  - In HP's UEFI x86_64 platform and with xen environment,     in booting stage, xen hypervisor will panic.
    (bnc#833251)

  - Xen: migration broken from xsave-capable to     xsave-incapable host. (bnc#833796)

  - In xen, 'shutdown -y 0 -h' cannot power off system.
    (bnc#834751)

  - In HP's UEFI x86_64 platform with xen environment, xen     hypervisor will panic on multiple blades nPar.
    (bnc#839600)

  - vcpus not started after upgrading Dom0 from SLES 11 SP2     to SP3. (bnc#835896)

  - SLES 11 SP3 Xen security patch does not automatically     update UEFI boot binary. (bnc#836239)

  - Failed to setup devices for vm instance when start     multiple vms simultaneously. (bnc#824676)

  - SLES 9 SP4 guest fails to start after upgrading to SLES     11 SP3. (bnc#817799)

  - Various upstream fixes have been included.

Lock order reversal between page allocation and grant table locks ocaml xenstored mishandles oversized message replies systemd changes to allow oxenstored to be used instead of xenstored

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update to xen-4.3.1, Lock order reversal between page allocation and grant table lock ocaml xenstored mishandles oversized message replies systemd changes to allow oxenstored to be used instead of xenstored

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
83602	SUSE SLED11 / SLES11 Security Update : Xen (SUSE-SU-2013:1774-1)	Nessus	SuSE Local Security Checks	high
76544	GLSA-201407-03 : Xen: Multiple Vunlerabilities	Nessus	Gentoo Local Security Checks	high
75232	openSUSE Security Update : xen (openSUSE-SU-2013:1876-1)	Nessus	SuSE Local Security Checks	medium
75189	openSUSE Security Update : xen (openSUSE-SU-2013:1636-1)	Nessus	SuSE Local Security Checks	medium
74865	openSUSE Security Update : xen (openSUSE-SU-2013:1953-1)	Nessus	SuSE Local Security Checks	medium
71562	SuSE 11.3 Security Update : Xen (SAT Patch Number 8588)	Nessus	SuSE Local Security Checks	high
70969	SuSE 11.2 / 11.3 Security Update : Xen (SAT Patch Numbers 8478 / 8479)	Nessus	SuSE Local Security Checks	high
70831	Fedora 19 : xen-4.2.3-7.fc19 (2013-20555)	Nessus	Fedora Local Security Checks	medium
70830	Fedora 18 : xen-4.2.3-7.fc18 (2013-20544)	Nessus	Fedora Local Security Checks	medium
70813	Fedora 20 : xen-4.3.1-1.fc20 (2013-20517)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4416

medium

Tenable Plugins

high

high

medium

medium

medium

high

high

medium

medium

medium