The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0039 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details.

The Xen Project reports :

Emulation routines in the hypervisor dealing with certain system devices check whether the access size by the guest is a supported one.
When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that hypervisor stack contents are copied into the destination of the operation, thus becoming visible to the guest.

A malicious HVM guest might be able to read sensitive data relating to other guests.

Xen was updated to 4.4.2 to fix multiple vulnerabilities and non-security bugs.

The following vulnerabilities were fixed :

  - CVE-2015-4103: Potential unintended writes to host MSI     message data field via qemu (XSA-128) (boo#931625)

  - CVE-2015-4104: PCI MSI mask bits inadvertently exposed     to guests (XSA-129) (boo#931626)

  - CVE-2015-4105: Guest triggerable qemu MSI-X pass-through     error messages (XSA-130) (boo#931627)

  - CVE-2015-4106: Unmediated PCI register access in qemu     (XSA-131) (boo#931628)

  - CVE-2015-4164: DoS through iret hypercall handler     (XSA-136) (boo#932996)

  - CVE-2015-4163: GNTTABOP_swap_grant_ref operation     misbehavior (XSA-134) (boo#932790)

  - CVE-2015-3209: heap overflow in qemu pcnet controller     allowing guest to host escape (XSA-135) (boo#932770)

  - CVE-2015-3456: Fixed a buffer overflow in the floppy     drive emulation, which could be used to denial of     service attacks or potential code execution against the     host. ()

  - CVE-2015-3340: Xen did not initialize certain fields,     which allowed certain remote service domains to obtain     sensitive information from memory via a (1)     XEN_DOMCTL_gettscinfo or (2)     XEN_SYSCTL_getdomaininfolist request. ()

  - CVE-2015-2752: Long latency MMIO mapping operations are     not preemptible (XSA-125 boo#922705)

  - CVE-2015-2756: Unmediated PCI command register access in     qemu (XSA-126 boo#922706)

  - CVE-2015-2751: Certain domctl operations may be abused     to lock up the host (XSA-127 boo#922709)

  - CVE-2015-2151: Hypervisor memory corruption due to x86     emulator flaw (boo#919464 XSA-123)

  - CVE-2015-2045: Information leak through version     information hypercall (boo#918998 XSA-122)

  - CVE-2015-2044: Information leak via internal x86 system     device emulation (boo#918995 (XSA-121)

  - CVE-2015-2152: HVM qemu unexpectedly enabling emulated     VGA graphics backends (boo#919663 XSA-119)

  - CVE-2014-3615: information leakage when guest sets high     resolution (boo#895528)

The following non-security bugs were fixed :

  - xentop: Fix memory leak on read failure 

  - boo#923758: xen dmesg contains bogus output in early     boot

  - boo#921842: Xentop doesn't display disk statistics for     VMs using qdisks

  - boo#919098: L3: XEN blktap device intermittently fails     to connect 

  - boo#882089: Windows 2012 R2 fails to boot up with     greater than 60 vcpus

  - boo#903680: Problems with detecting free loop devices on     Xen guest startup

  - boo#861318: xentop reports 'Found interface vif101.0 but     domain 101 does not exist.'

  - boo#901488: Intel ixgbe driver assigns rx/tx queues per     core resulting in irq problems on servers with a large     amount of CPU cores

  - boo#910254: SLES11 SP3 Xen VT-d igb NIC doesn't work

  - boo#912011: high ping latency after upgrade to latest     SLES11SP3 on xen Dom0

  - boo#906689: let systemd schedule xencommons after     network-online.target and remote-fs.target so that     xendomains has access to remote shares

The following functionality was enabled or enhanced :

  - Enable spice support in qemu for x86_64

  - Add Qxl vga support

  - Enhancement to virsh/libvirtd 'send-key' command     (FATE#317240)

  - Add domain_migrate_constraints_set API to Xend's http     interface (FATE#317239)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

The Virtualization service XEN was updated to fix various bugs and security issues.

The following security issues have been fixed :

CVE-2015-2756: XSA-126: Unmediated PCI command register access in qemu could have lead to denial of service attacks against the host, if PCI cards are passed through to guests.

XSA-125: Long latency MMIO mapping operations were not preemptible.

CVE-2015-2151: XSA-123: Instructions with register operands ignored eventual segment overrides encoded for them. Due to an insufficiently conditional assignment such a bogus segment override could have, however, corrupted a pointer used subsequently to store the result of the instruction.

CVE-2015-2045: XSA-122: The code handling certain sub-operations of the HYPERVISOR_xen_version hypercall failed to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

CVE-2015-2044: XSA-121: Emulation routines in the hypervisor dealing with certain system devices checked whether the access size by the guest is a supported one. When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

Also fixed :

Fully virtualized guest install from network source failed with 'cannot find guest domain' in XEN. (bsc#919341)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Virtualization service XEN was updated to fix various bugs and security issues.

The following security issues have been fixed :

CVE-2015-2756: XSA-126: Unmediated PCI command register access in qemu could have lead to denial of service attacks against the host, if PCI cards are passed through to guests.

XSA-125: Long latency MMIO mapping operations were not preemptible.

CVE-2015-2151: XSA-123: Instructions with register operands ignored eventual segment overrides encoded for them. Due to an insufficiently conditional assignment such a bogus segment override could have, however, corrupted a pointer used subsequently to store the result of the instruction.

CVE-2015-2045: XSA-122: The code handling certain sub-operations of the HYPERVISOR_xen_version hypercall failed to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

CVE-2015-2044: XSA-121: Emulation routines in the hypervisor dealing with certain system devices checked whether the access size by the guest is a supported one. When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

Also fixed :

Regular crashes of dom-0 on different servers due to races in MCE access were fixed. bsc#907755

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Virtualization service XEN was updated to fix various bugs and security issues.

The following security issues have been fixed :

CVE-2015-2756: XSA-126: Unmediated PCI command register access in qemu could have lead to denial of service attacks against the host, if PCI cards are passed through to guests.

XSA-125: Long latency MMIO mapping operations were not preemptible.

CVE-2015-2151: XSA-123: Instructions with register operands ignored eventual segment overrides encoded for them. Due to an insufficiently conditional assignment such a bogus segment override could have, however, corrupted a pointer used subsequently to store the result of the instruction.

CVE-2015-2045: XSA-122: The code handling certain sub-operations of the HYPERVISOR_xen_version hypercall failed to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

CVE-2015-2044: XSA-121: Emulation routines in the hypervisor dealing with certain system devices checked whether the access size by the guest is a supported one. When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Virtualization service XEN was updated to fix various bugs and security issues.

The following security issues have been fixed :

XSA-125: Long latency MMIO mapping operations were not preemptible.

CVE-2015-2151: XSA-123: Instructions with register operands ignored eventual segment overrides encoded for them. Due to an insufficiently conditional assignment such a bogus segment override could have, however, corrupted a pointer used subsequently to store the result of the instruction.

CVE-2015-2045: XSA-122: The code handling certain sub-operations of the HYPERVISOR_xen_version hypercall failed to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

CVE-2015-2044: XSA-121: Emulation routines in the hypervisor dealing with certain system devices checked whether the access size by the guest is a supported one. When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The XEN hypervisor received updates to fix various security issues and bugs.

The following security issues were fixed :

  - CVE-2015-2151: XSA-123: A hypervisor memory corruption     due to x86 emulator flaw.

  - CVE-2015-2045: XSA-122: Information leak through version     information hypercall.

  - CVE-2015-2044: XSA-121: Information leak via internal     x86 system device emulation.

  - CVE-2015-2152: XSA-119: HVM qemu was unexpectedly     enabling emulated VGA graphics backends.

  - CVE-2014-3615: Information leakage when guest sets high     graphics resolution.

  - CVE-2015-0361: XSA-116: A xen crash due to use after     free on hvm guest teardown.

  - CVE-2014-9065, CVE-2014-9066: XSA-114: xen: p2m lock     starvation.

Also the following bugs were fixed :

  - bnc#919098 - XEN blktap device intermittently fails to     connect

  - bnc#882089 - Windows 2012 R2 fails to boot up with     greater than 60 vcpus

  - bnc#903680 - Problems with detecting free loop devices     on Xen guest startup

  - bnc#861318 - xentop reports 'Found interface vif101.0     but domain 101 does not exist.'

  - Update seabios to rel-1.7.3.1 which is the correct     version for Xen 4.4

  - Enhancement to virsh/libvirtd 'send-key' command The xen     side small fix. (FATE#317240)

  - bnc#901488 - Intel ixgbe driver assigns rx/tx queues per     core resulting in irq problems on servers with a large     amount of CPU cores

  - bnc#910254 - SLES11 SP3 Xen VT-d igb NIC doesn't work

  - Add domain_migrate_constraints_set API to Xend's http     interface (FATE#317239)

  - Restore missing fixes from block-dmmd script

  - bnc#904255 - XEN boot hangs in early boot on UEFI system

  - bsc#912011 - high ping latency after upgrade to latest     SLES11SP3 on xen Dom0

  - Fix missing banner by restoring the figlet program.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Virtualization service XEN was updated to fix various bugs and security issues.

The following security issues have been fixed :

  - XSA-126: Unmediated PCI command register access in qemu     could have lead to denial of service attacks against the     host, if PCI cards are passed through to guests.
    (CVE-2015-2756)

  - XSA-125: Long latency MMIO mapping operations were not     preemptible.

  - XSA-123: Instructions with register operands ignored     eventual segment overrides encoded for them. Due to an     insufficiently conditional assignment such a bogus     segment override could have, however, corrupted a     pointer used subsequently to store the result of the     instruction. (CVE-2015-2151)

  - XSA-122: The code handling certain sub-operations of the     HYPERVISOR_xen_version hypercall failed to fully     initialize all fields of structures subsequently copied     back to guest memory. Due to this hypervisor stack     contents were copied into the destination of the     operation, thus becoming visible to the guest.
    (CVE-2015-2045)

  - XSA-121: Emulation routines in the hypervisor dealing     with certain system devices checked whether the access     size by the guest is a supported one. When the access     size is unsupported these routines failed to set the     data to be returned to the guest for read accesses, so     that hypervisor stack contents were copied into the     destination of the operation, thus becoming visible to     the guest. (CVE-2015-2044)

Also fixed :

  - Fully virtualized guest install from network source     failed with 'cannot find guest domain' in XEN.
    (bsc#919341)

Xen was updated to 4.3.4 to fix multiple vulnerabities and non-security bugs.

The following vulnerabilities were fixed :

  - Long latency MMIO mapping operations are not preemptible     (XSA-125 CVE-2015-2752 bnc#922705)

  - Unmediated PCI command register access in qemu (XSA-126     CVE-2015-2756 bnc#922706)

  - Hypervisor memory corruption due to x86 emulator flaw     (bnc#919464 CVE-2015-2151 XSA-123)

  - Information leak through version information hypercall     (bnc#918998 CVE-2015-2045 XSA-122)

  - Information leak via internal x86 system device     emulation (bnc#918995 (CVE-2015-2044 XSA-121)

  - HVM qemu unexpectedly enabling emulated VGA graphics     backends (bnc#919663 CVE-2015-2152 XSA-119)

  - information leakage when guest sets high resolution     (bnc#895528 CVE-2014-3615)

The following non-security bugs were fixed :

  - L3: XEN blktap device intermittently fails to connect     (bnc#919098) 

  - Problems with detecting free loop devices on Xen guest     startup (bnc#903680)

  - xentop reports 'Found interface vif101.0 but domain 101     does not exist.' (bnc#861318) 

  - Intel ixgbe driver assigns rx/tx queues per core     resulting in irq problems on servers with a large amount     of CPU cores (bnc#901488)

  - SLES11 SP3 Xen VT-d igb NIC doesn't work (bnc#910254)

The remote host is affected by the vulnerability described in GLSA-201504-04 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen.  Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly cause a Denial of Service condition or       obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

Additional patch for XSA-98 on arm64 HVM qemu unexpectedly enabling emulated VGA graphics backends [XSA-119, CVE-2015-2152] Hypervisor memory corruption due to x86 emulator flaw [XSA-123, CVE-2015-2151] enable building pngs from fig files which is working again, fix oxenstored.service preset preuninstall script, arm: vgic: incorrect rate limiting of guest triggered logging, Information leak via internal x86 system device emulation, Information leak through version information hypercall

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

HVM qemu unexpectedly enabling emulated VGA graphics backends [XSA-119, CVE-2015-2152] Hypervisor memory corruption due to x86 emulator flaw [XSA-123, CVE-2015-2151] Information leak via internal x86 system device emulation, Information leak through version information hypercall

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Additional patch for XSA-98 on arm64 HVM qemu unexpectedly enabling emulated VGA graphics backends [XSA-119, CVE-2015-2152] Hypervisor memory corruption due to x86 emulator flaw [XSA-123, CVE-2015-2151] Information leak via internal x86 system device emulation, Information leak through version information hypercall, fix a typo in xen.fedora.systemd.patch

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been found in the Xen virtualisation solution :

  - CVE-2015-2044     Information leak via x86 system device emulation.

  - CVE-2015-2045     Information leak in the HYPERVISOR_xen_version()     hypercall.

  - CVE-2015-2151     Missing input sanitising in the x86 emulator could     result in information disclosure, denial of service or     potentially privilege escalation.

In addition the Xen developers reported an unfixable limitation in the handling of non-standard PCI devices. Please refer to for further information.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0028 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - XSA-122: pre-fill structures for certain     HYPERVISOR_xen_version sub-ops (Jan Beulich) [20588670]     [CVE-2015-2045]

  - XSA-121: return all ones on wrong-sized reads of system     device I/O ports (Jan Beulich) [20588358]     [CVE-2015-2044]

The remote OracleVM system is missing necessary patches to address critical security updates :

  - pre-fill structures for certain HYPERVISOR_xen_version     sub-ops ... avoiding to pass hypervisor stack contents     back to the caller through space unused by the     respective strings. This is XSA-122. (CVE-2015-2045)

  - x86/HVM: return all ones on wrong-sized reads of system     device I/O ports So far the value presented to the guest     remained uninitialized. This is XSA-121. (CVE-2015-2044)

ID	Name	Product	Family	Severity
140019	OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
111992	OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
84701	FreeBSD : xen-kernel -- Information leak via internal x86 system device emulation (5023f559-27e2-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	low
84333	openSUSE Security Update : xen (openSUSE-2015-434) (Venom)	Nessus	SuSE Local Security Checks	high
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	low
83720	SUSE SLED11 / SLES11 Security Update : Xen (SUSE-SU-2015:0747-1)	Nessus	SuSE Local Security Checks	high
83719	SUSE SLES11 Security Update : Xen (SUSE-SU-2015:0746-1)	Nessus	SuSE Local Security Checks	high
83718	SUSE SLES11 Security Update : Xen (SUSE-SU-2015:0745-1)	Nessus	SuSE Local Security Checks	high
83717	SUSE SLES10 Security Update : Xen (SUSE-SU-2015:0744-1)	Nessus	SuSE Local Security Checks	high
83707	SUSE SLED12 / SLES12 Security Update : Xen (SUSE-SU-2015:0613-1)	Nessus	SuSE Local Security Checks	high
82990	SuSE 11.3 Security Update : Xen (SAT Patch Number 10560)	Nessus	SuSE Local Security Checks	high
82907	openSUSE Security Update : xen (openSUSE-2015-314)	Nessus	SuSE Local Security Checks	high
82734	GLSA-201504-04 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
82054	Fedora 21 : xen-4.4.1-16.fc21 (2015-3944)	Nessus	Fedora Local Security Checks	high
82051	Fedora 20 : xen-4.3.3-12.fc20 (2015-3721)	Nessus	Fedora Local Security Checks	high
81987	Fedora 22 : xen-4.5.0-6.fc22 (2015-3935)	Nessus	Fedora Local Security Checks	high
81748	Debian DSA-3181-1 : xen - security update	Nessus	Debian Local Security Checks	high
81696	OracleVM 3.2 : xen (OVMSA-2015-0028)	Nessus	OracleVM Local Security Checks	medium
81695	OracleVM 2.2 : xen (OVMSA-2015-0027)	Nessus	OracleVM Local Security Checks	low
81694	OracleVM 3.3 : xen (OVMSA-2015-0026)	Nessus	OracleVM Local Security Checks	low

Detections

Analytics

CVE-2015-2044

medium

Tenable Plugins

critical

critical

low

high

low

high

high

high

high

high

high

high

high

high

high

high

high

medium

low

low