The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 4.4.x and earlier does not properly check supervisor mode permissions, which allows local HVM users to cause a denial of service (guest crash) or gain guest kernel mode privileges via vectors involving an (1) HLT, (2) LGDT, (3) LIDT, or (4) LMSW instruction.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

xen was updated to fix 10 security issues :

  - Guest effectable page reference leak in     MMU_MACHPHYS_UPDATE handling (CVE-2014-9030).

  - Insufficient bounding of 'REP MOVS' to MMIO emulated     inside the hypervisor (CVE-2014-8867).

  - Missing privilege level checks in x86 emulation of far     branches (CVE-2014-8595).

  - Missing privilege level checks in x86 HLT, LGDT, LIDT,     and LMSW emulation (CVE-2014-7155).

  - Hypervisor heap contents leaked to guests     (CVE-2014-4021).

  - Missing privilege level checks in x86 emulation of far     branches (CVE-2014-8595).

  - Insufficient restrictions on certain MMU update     hypercalls (CVE-2014-8594).

  - Intel VT-d Interrupt Remapping engines can be evaded by     native NMI interrupts (CVE-2013-3495).

  - Missing privilege level checks in x86 emulation of     software interrupts (CVE-2014-7156).

  - Race condition in HVMOP_track_dirty_vram     (CVE-2014-7154).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xen was updated to fix 14 security issues :

  - Guest effectable page reference leak in     MMU_MACHPHYS_UPDATE handling (CVE-2014-9030).

  - Insufficient bounding of 'REP MOVS' to MMIO emulated     inside the hypervisor (CVE-2014-8867).

  - Missing privilege level checks in x86 HLT, LGDT, LIDT,     and LMSW emulation (CVE-2014-7155).

  - Hypervisor heap contents leaked to guests     (CVE-2014-4021).

  - Missing privilege level checks in x86 emulation of far     branches (CVE-2014-8595).

  - Insufficient restrictions on certain MMU update     hypercalls (CVE-2014-8594).

  - Intel VT-d Interrupt Remapping engines can be evaded by     native NMI interrupts (CVE-2013-3495).

  - Missing privilege level checks in x86 emulation of     software interrupts (CVE-2014-7156).

  - Race condition in HVMOP_track_dirty_vram     (CVE-2014-7154).

  - Improper MSR range used for x2APIC emulation     (CVE-2014-7188).

  - HVMOP_set_mem_type allows invalid P2M entries to be     created (CVE-2014-3124).

  - HVMOP_set_mem_access is not preemptible (CVE-2014-2599).

  - Excessive checking in compatibility mode hypercall     argument translation (CVE-2014-8866).

  - Guest user mode triggerable VM exits not handled by     hypervisor (bnc#903850).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Xen has been updated to fix six security issues :

  - Guest effectable page reference leak in     MMU_MACHPHYS_UPDATE handling (CVE-2014-9030).

  - Insufficient bounding of 'REP MOVS' to MMIO emulated     inside the hypervisor (CVE-2014-8867).

  - Missing privilege level checks in x86 emulation of far     branches (CVE-2014-8595).

  - Guest user mode triggerable VM exits not handled by     hypervisor (bnc#903850).

  - Missing privilege level checks in x86 HLT, LGDT, LIDT,     and LMSW emulation (CVE-2014-7155).

  - Hypervisor heap contents leaked to guests     (CVE-2014-4021).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201412-42 (Xen: Denial of Service)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local user could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/HVM: properly bound x2APIC MSR range This is     XSA-108. Additional changelog comments added to     4.1.3-25.el5.94.1.3 (CVE-2014-7188)

  - Fix for bug 19698532

  - x86emul: only emulate software interrupt injection for     real mode Protected mode emulation currently lacks     proper privilege checking of the referenced IDT entry,     and there's currently no legitimate way for any of the     respective instructions to reach the emulator when the     guest is in protected mode. This is XSA-106.
    (CVE-2014-7156)

  - x86/emulate: check cpl for all privileged instructions     Without this, it is possible for userspace to load its     own IDT or GDT. This is XSA-105. (CVE-2014-7155)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/HVM: properly bound x2APIC MSR range This is     XSA-108. Additional changelog comments added to     4.3.0-55.el6.0.0.3 (CVE-2014-7188)

  - Fix for bug 19698535

  - x86emul: only emulate software interrupt injection for     real mode Protected mode emulation currently lacks     proper privilege checking of the referenced IDT entry,     and there's currently no legitimate way for any of the     respective instructions to reach the emulator when the     guest is in protected mode. This is XSA-106.
    (CVE-2014-7156)

  - x86/emulate: check cpl for all privileged instructions     Without this, it is possible for userspace to load its     own IDT or GDT. This is XSA-105. (CVE-2014-7155)

The SUSE Linux Enterprise 11 Service Pack 3 Xen package was updated to fix various bugs and security issues.

The following security issues have been fixed :

  - XSA-108: CVE-2014-7188: Improper MSR range used for     x2APIC emulation. (bnc#897657)

  - XSA-106: CVE-2014-7156: Missing privilege level checks     in x86 emulation of software interrupts. (bnc#895802)

  - XSA-105: CVE-2014-7155: Missing privilege level checks     in x86 HLT, LGDT, LIDT, and LMSW emulation. (bnc#895799)

  - XSA-104: CVE-2014-7154: Race condition in     HVMOP_track_dirty_vram. (bnc#895798)

  - XSA-100: CVE-2014-4021: Hypervisor heap contents leaked     to guests. (bnc#880751)

  - XSA-96: CVE-2014-3967 / CVE-2014-3968: Vulnerabilities     in HVM MSI injection. (bnc#878841)

  - XSA-89: CVE-2014-2599: HVMOP_set_mem_access is not     preemptible. (bnc#867910)

  - XSA-65: CVE-2013-4344: qemu SCSI REPORT LUNS buffer     overflow. (bnc#842006)

  - qemu: zaurus: buffer overrun on invalid state load     (bnc#864801) The following non-security issues have been     fixed:. (CVE-2013-4540)

  - xend: Fix netif convertToDeviceNumber for running     domains. (bnc#891539)

  - Installing SLES12 as a VM on SLES11 SP3 fails because of     btrfs in the VM. (bnc#882092)

  - XEN kernel panic do_device_not_available(). (bnc#881900)

  - Boot Failure with xen kernel in UEFI mode with error 'No     memory for trampoline'. (bnc#833483)

  - SLES 11 SP3 vm-install should get RHEL 7 support when     released. (bnc#862608)

  - SLES 11 SP3 XEN kiso version cause softlockup on 8     blades npar(480 cpu). (bnc#858178)

  - Local attach support for PHY backends using scripts     local_attach_support_for_phy.patch. (bnc#865682)

  - Improve multipath support for npiv devices block-npiv     (bnc#798770)

Improper MSR range used for x2APIC emulation [XSA-108, CVE-2014-7188] Race condition in HVMOP_track_dirty_vram [XSA-104] (#1145736) Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation [XSA-105] (#1145737) Missing privilege level checks in x86 emulation of software interrupts [XSA-106] (#1145738)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

XEN was updated to fix security issues and bugs.

Security issues fixed :

  - bnc#897657 - CVE-2014-7188: XSA-108 Improper MSR range     used for x2APIC emulation

  - bnc#895802 - CVE-2014-7156: XSA-106: Missing privilege     level checks in x86 emulation of software interrupts

  - bnc#895799 - CVE-2014-7155: XSA-105: Missing privilege     level checks in x86 HLT, LGDT, LIDT, and LMSW emulation

  - bnc#895798 - CVE-2014-7154: XSA-104: Race condition in     HVMOP_track_dirty_vram

  - bnc#864801 - CVE-2013-4540: qemu: zaurus: buffer overrun     on invalid state load

  - bnc#875668 - CVE-2014-3124: XSA-92: HVMOP_set_mem_type     allows invalid P2M entries to be created

  - bnc#878841 - CVE-2014-3967, CVE-2014-3968: XSA-96: Xen:
    Vulnerabilities in HVM MSI injection

  - bnc#880751 - CVE-2014-4021: XSA-100: Hypervisor heap     contents leaked to guests

  - bnc#842006 - CVE-2013-4344: XSA-65: xen: qemu SCSI     REPORT LUNS buffer overflow 

Other bugs fixed :

  - bnc#896023 - Adjust xentop column layout

  - bnc#820873 - The 'long' option doesn't work with 'xl     list'

  - bnc#882127 - Xen kernel panics on booting SLES12 Beta 8

  - bnc#865682 - Local attach support for PHY backends using     scripts

  - bnc#798770 - Improve multipath support for npiv devices

XEN was updated to fix various bugs and security issues.

Security issues fixed :

  - bnc#897657 - CVE-2014-7188: XSA-108 Improper MSR range     used for x2APIC emulation

  - bnc#895802 - CVE-2014-7156: XSA-106: Missing privilege     level checks in x86 emulation of software interrupts

  - bnc#895799 - CVE-2014-7155: XSA-105: Missing privilege     level checks in x86 HLT, LGDT, LIDT, and LMSW emulation

  - bnc#895798 - CVE-2014-7154: XSA-104: Race condition in     HVMOP_track_dirty_vram

  - bnc#864801 - CVE-2013-4540: qemu: zaurus: buffer overrun     on invalid state load 

  - bnc#880751 - CVE-2014-4021: XSA-100: Hypervisor heap     contents leaked to guests

  - bnc#878841 - CVE-2014-3967,CVE-2014-3968: XSA-96:
    Vulnerabilities in HVM MSI injection

  - bnc#867910 - CVE-2014-2599: XSA-89: HVMOP_set_mem_access     is not preemptible

  - bnc#842006 - CVE-2013-4344: XSA-65: xen: qemu SCSI     REPORT LUNS buffer overflow

Other bugs fixed :

  - bnc#896023 - Adjust xentop column layout

  - bnc#891539 - xend: fix netif convertToDeviceNumber for     running domains

  - bnc#820873 - The 'long' option doesn't work with 'xl     list'

  - bnc#881900 - XEN kernel panic do_device_not_available()

  - bnc#833483 - Boot Failure with xen kernel in UEFI mode     with error 'No memory for trampoline'

  - bnc#862608 - SLES 11 SP3 vm-install should get RHEL 7     support when released

  - bnc#858178 - [HP HPS Bug]: SLES11sp3 XEN kiso version     cause softlockup on 8 blades npar(480 cpu)

  - bnc#865682 - Local attach support for PHY backends using     scripts

  - bnc#798770 - Improve multipath support for npiv devices

Multiple security issues have been discovered in the Xen virtualisation solution which may result in denial of service, information disclosure or privilege escalation.

Race condition in HVMOP_track_dirty_vram [XSA-104] (#1145736) Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation [XSA-105] (#1145737) Missing privilege level checks in x86 emulation of software interrupts [XSA-106] (#1145738)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	low
83659	SUSE SLES11 Security Update : xen (SUSE-SU-2014:1732-1)	Nessus	SuSE Local Security Checks	high
83654	SUSE SLES11 Security Update : xen (SUSE-SU-2014:1710-1)	Nessus	SuSE Local Security Checks	high
83651	SUSE SLES10 Security Update : Xen (SUSE-SU-2014:1691-1)	Nessus	SuSE Local Security Checks	high
80263	GLSA-201412-42 : Xen: Denial of Service	Nessus	Gentoo Local Security Checks	high
79542	OracleVM 3.2 : xen (OVMSA-2014-0026)	Nessus	OracleVM Local Security Checks	high
79541	OracleVM 3.3 : xen (OVMSA-2014-0025)	Nessus	OracleVM Local Security Checks	high
78652	SuSE 11.3 Security Update : Xen (SAT Patch Number 9828)	Nessus	SuSE Local Security Checks	high
78376	Fedora 20 : xen-4.3.3-3.fc20 (2014-12036)	Nessus	Fedora Local Security Checks	high
78375	Fedora 19 : xen-4.2.5-3.fc19 (2014-12000)	Nessus	Fedora Local Security Checks	high
78117	openSUSE Security Update : xen (openSUSE-SU-2014:1281-1)	Nessus	SuSE Local Security Checks	high
78116	openSUSE Security Update : xen (openSUSE-SU-2014:1279-1)	Nessus	SuSE Local Security Checks	high
78027	Debian DSA-3041-1 : xen - security update	Nessus	Debian Local Security Checks	high
77933	Fedora 21 : xen-4.4.1-4.fc21 (2014-11271)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-7155

critical

Tenable Plugins

low

high

high

high

high

high

high

high

high

high

high

high

high

medium