Xen 4.2.x and 4.3.x, when using Intel VT-d for PCI passthrough, does not properly flush the TLB after clearing a present translation table entry, which allows local guest administrators to cause a denial of service or gain privileges via unspecified vectors related to an "inverted boolean parameter."

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2016-0081 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - VT-d: fix TLB flushing in dma_pte_clear_one From: Jan     Beulich The TLB flush code was wrong since     xen-4.1.3-25.el5.127.20 (commit:
    vtd-Refactor-iotlb-flush-code.patch), both ovm-3.2.9 and     ovm-3.2.10 were affected. The third parameter of
    __intel_iommu_iotlb_flush is to indicate whether the to     be flushed entry was a present one. A few lines before,     we bailed if !dma_pte_present(*pte), so there's no need     to check the flag here again - we can simply always pass     TRUE here. This is CVE-2013-6375 / XSA-78. Suggested-by:
    Cheng Yueqiang 

    (cherry picked from commit     85c72f9fe764ed96f5c149efcdd69ab7c18bfe3d)     (CVE-2013-6375)

  - x86/VMX: prevent INVVPID failure due to non-canonical     guest address While INVLPG (and on SVM INVLPGA) don't     fault on non-canonical addresses, INVVPID fails (in the     'individual address' case) when passed such an address.
    Since such intercepted INVLPG are effectively no-ops     anyway, don't fix this in vmx_invlpg_intercept, but     instead have paging_invlpg never return true in such a     case. This is XSA-168. (CVE-2016-1571)

  - x86/mm: PV superpage handling lacks sanity checks     MMUEXT_[,UN]MARK_SUPER fail to check the input MFN for     validity before dereferencing pointers into the     superpage frame table. get_superpage has a similar     issue. This is XSA-167. (CVE-2016-1570)

  - xend/image: Don't throw VMException when using backend     domains for disks. If we are using backend domains the     disk image may not be accessible within the host     (domain0). As such it is OK to continue on. The     'addStoreEntries' in DevController.py already does the     check to make sure that when the 'backend' configuration     is used - that said domain exists. As such the only     change we need to do is to exclude the disk image     location if the domain is not dom0.

  - memory: fix XENMEM_exchange error handling assign_pages     can fail due to the domain getting killed in parallel,     which should not result in a hypervisor crash. Also     delete a redundant put_gfn - all relevant paths leading     to the 'fail' label already do this (and there are also     paths where it was plain wrong). All of the put_gfn-s     got introduced by 51032ca058 ('Modify naming of queries     into the p2m'), including the otherwise unneeded     initializer for k (with even a kind of misleading     comment - the compiler warning could actually have     served as a hint that the use is wrong). This is     XSA-159.

    Based on xen.org's xsa159.patch Conflicts: OVM 3.2 does     not have the change (51032ca058) that is backed out in     xen/common/memory.c or the put_gfn in     xen/common/memory.c

(CVE-2015-8339, CVE-2015-8340)

The remote host is affected by the vulnerability described in GLSA-201407-03 (Xen: Multiple Vunlerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can utilize multiple vectors to execute arbitrary       code, cause Denial of Service, or gain access to data on the host.
  Workaround :

    There is no known workaround at this time.

Disaggregated domain management security status update, IOMMU TLB flushing may be inadvertently suppressed Lock order reversal between page_alloc_lock and mm_rwlock, Hypercalls exposed to privilege rings 1 and 2 of HVM guests Insufficient TLB flushing in VT-d (iommu) code

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Xen hypervisor and tool-suite have been updated to fix security issues and bugs :

  - XSA-73: A lock order reversal between page allocation     and grant table locks could lead to host crashes or even     host code execution. (CVE-2013-4494)

  - XSA-74: A lock order reversal between page_alloc_lock     and mm_rwlock could lead to deadlocks. (CVE-2013-4553)

  - XSA-76: Hypercalls exposed to privilege rings 1 and 2 of     HVM guests which might lead to Hypervisor escalation     under specific circumstances. (CVE-2013-4554)

  - XSA-78: Insufficient TLB flushing in VT-d (iommu) code     could lead to access of memory that was revoked.
    (CVE-2013-6375)

  - XSA-75: A host crash due to guest VMX instruction     execution was fixed. Non-security bugs have also been     fixed:. (CVE-2013-4551)

  - It is possible to start a VM twice on the same node.
    (bnc#840997)

  - In HP's UEFI x86_64 platform and SLES 11-SP3, dom0 will     could lock-up on multiple blades nPar. (bnc#842417)

  - Xen Hypervisor panics on 8-blades nPar with 46-bit     memory addressing. (bnc#848014)

  - Soft lock-up with PCI pass-through and many VCPUs.
    (bnc#846849)

  - Boot Failure with Xen kernel in UEFI mode with error 'No     memory for trampoline'. (bnc#833483)

  - Increase the maximum supported CPUs in the Hypervisor to     512.

Lock order reversal between page_alloc_lock and mm_rwlock, Hypercalls exposed to privilege rings 1 and 2 of HVM guests, Insufficient TLB flushing in VT-d (iommu) code

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
91756	OracleVM 3.2 : xen (OVMSA-2016-0081)	Nessus	OracleVM Local Security Checks	high
88171	OracleVM 3.2 : xen (OVMSA-2016-0008)	Nessus	OracleVM Local Security Checks	high
76544	GLSA-201407-03 : Xen: Multiple Vunlerabilities	Nessus	Gentoo Local Security Checks	high
71590	Fedora 20 : xen-4.3.1-6.fc20 (2013-23251)	Nessus	Fedora Local Security Checks	high
71562	SuSE 11.3 Security Update : Xen (SAT Patch Number 8588)	Nessus	SuSE Local Security Checks	high
71248	Fedora 19 : xen-4.2.3-10.fc19 (2013-22325)	Nessus	Fedora Local Security Checks	high
71247	Fedora 18 : xen-4.2.3-10.fc18 (2013-22312)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2013-6375

medium

Tenable Plugins

high

high

high

high

high

high

high