QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.

This security update fixes a number of security issues in Xen in wheezy.

For Debian 7 'Wheezy', these problems have been fixed in version 4.1.6.1-1+deb7u1.

We recommend that you upgrade your libidn packages.

CVE-2015-2752

The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptable, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm).

CVE-2015-2756

QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.

CVE-2015-5165

The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.

CVE-2015-5307

The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c.

CVE-2015-7969

Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of 'teardowns' of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall.

CVE-2015-7970

The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest administrators to cause a denial of service (CPU consumption and possibly reboot) via crafted memory contents that triggers a 'time-consuming linear scan,' related to Populate-on-Demand.

CVE-2015-7971

Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.

CVE-2015-7972

The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through 4.6.x do not properly calculate the balloon size when using the populate-on-demand (PoD) system, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors related to 'heavy memory pressure.'

CVE-2015-8104

The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.

CVE-2015-8339

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.

CVE-2015-8340

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling.

CVE-2015-8550

Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability.

CVE-2015-8554

Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a 'write path.'

CVE-2015-8555

Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.

CVE-2015-8615

The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).

CVE-2016-1570

The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.

CVE-2016-1571

The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check.

CVE-2016-2270

Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.

CVE-2016-2271

VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - XSA-125: Limit XEN_DOMCTL_memory_mapping hypercall to     only process up to 64 GFNs (or less) (Jan Beulich)     [20732412] (CVE-2015-2752)

  - XSA-126: xen: limit guest control of PCI command     register (Jan Beulich) [20739399] (CVE-2015-2756)

  - XSA-128: xen: properly gate host writes of modified PCI     CFG contents (Jan Beulich) [21157440] (CVE-2015-4103)

  - XSA-129: xen: don't allow guest to control MSI mask     register (Jan Beulich) [21158692] (CVE-2015-4104)

  - XSA-130: xen/MSI-X: disable logging by default (Jan     Beulich) [21159408] (CVE-2015-4105)

  - XSA-131: [PATCH 1/8] xen/MSI: don't open-code     pass-through of enable bit modifications (Jan Beulich)     [21164529] (CVE-2015-4106)

  - XSA-131: [PATCH 2/8] xen/pt: consolidate PM capability     emu_mask [21164529] (CVE-2015-4106)

  - XSA-131: [PATCH 3/8] xen/pt: correctly handle PM status     bit [21164529] (CVE-2015-4106)

  - XSA-131: [PATCH 4/8] xen/pt: split out calculation of     throughable mask in PCI config space handling [21164529]     (CVE-2015-4106)

  - XSA-131: [PATCH 5/8] xen/pt: mark all PCIe capability     bits read-only [21164529] (CVE-2015-4106)

  - XSA-131: [PATCH 6/8] xen/pt: mark reserved bits in PCI     config space fields [21164529] (CVE-2015-4106)

  - XSA-131: [PATCH 7/8] xen/pt: add a few PCI config space     field descriptions [21164529] (CVE-2015-4106)

  - XSA-131: [PATCH 8/8] xen/pt: unknown PCI config space     fields should be read-only [21164529] (CVE-2015-4106)

The Xen Project reports :

HVM guests are currently permitted to modify the memory and I/O decode bits in the PCI command register of devices passed through to them.
Unless the device is an SR-IOV virtual function, after disabling one or both of these bits subsequent accesses to the MMIO or I/O port ranges would - on PCI Express devices - lead to Unsupported Request responses. The treatment of such errors is platform specific.

Furthermore (at least) devices under control of the Linux pciback driver in the host are handed to guests with the aforementioned bits turned off. This means that such accesses can similarly lead to Unsupported Request responses until these flags are set as needed by the guest.

In the event that the platform surfaces aforementioned UR responses as Non-Maskable Interrupts, and either the OS is configured to treat NMIs as fatal or (e.g. via ACPI's APEI) the platform tells the OS to treat these errors as fatal, the host would crash, leading to a Denial of Service.

Xen was updated to 4.4.2 to fix multiple vulnerabilities and non-security bugs.

The following vulnerabilities were fixed :

  - CVE-2015-4103: Potential unintended writes to host MSI     message data field via qemu (XSA-128) (boo#931625)

  - CVE-2015-4104: PCI MSI mask bits inadvertently exposed     to guests (XSA-129) (boo#931626)

  - CVE-2015-4105: Guest triggerable qemu MSI-X pass-through     error messages (XSA-130) (boo#931627)

  - CVE-2015-4106: Unmediated PCI register access in qemu     (XSA-131) (boo#931628)

  - CVE-2015-4164: DoS through iret hypercall handler     (XSA-136) (boo#932996)

  - CVE-2015-4163: GNTTABOP_swap_grant_ref operation     misbehavior (XSA-134) (boo#932790)

  - CVE-2015-3209: heap overflow in qemu pcnet controller     allowing guest to host escape (XSA-135) (boo#932770)

  - CVE-2015-3456: Fixed a buffer overflow in the floppy     drive emulation, which could be used to denial of     service attacks or potential code execution against the     host. ()

  - CVE-2015-3340: Xen did not initialize certain fields,     which allowed certain remote service domains to obtain     sensitive information from memory via a (1)     XEN_DOMCTL_gettscinfo or (2)     XEN_SYSCTL_getdomaininfolist request. ()

  - CVE-2015-2752: Long latency MMIO mapping operations are     not preemptible (XSA-125 boo#922705)

  - CVE-2015-2756: Unmediated PCI command register access in     qemu (XSA-126 boo#922706)

  - CVE-2015-2751: Certain domctl operations may be abused     to lock up the host (XSA-127 boo#922709)

  - CVE-2015-2151: Hypervisor memory corruption due to x86     emulator flaw (boo#919464 XSA-123)

  - CVE-2015-2045: Information leak through version     information hypercall (boo#918998 XSA-122)

  - CVE-2015-2044: Information leak via internal x86 system     device emulation (boo#918995 (XSA-121)

  - CVE-2015-2152: HVM qemu unexpectedly enabling emulated     VGA graphics backends (boo#919663 XSA-119)

  - CVE-2014-3615: information leakage when guest sets high     resolution (boo#895528)

The following non-security bugs were fixed :

  - xentop: Fix memory leak on read failure 

  - boo#923758: xen dmesg contains bogus output in early     boot

  - boo#921842: Xentop doesn't display disk statistics for     VMs using qdisks

  - boo#919098: L3: XEN blktap device intermittently fails     to connect 

  - boo#882089: Windows 2012 R2 fails to boot up with     greater than 60 vcpus

  - boo#903680: Problems with detecting free loop devices on     Xen guest startup

  - boo#861318: xentop reports 'Found interface vif101.0 but     domain 101 does not exist.'

  - boo#901488: Intel ixgbe driver assigns rx/tx queues per     core resulting in irq problems on servers with a large     amount of CPU cores

  - boo#910254: SLES11 SP3 Xen VT-d igb NIC doesn't work

  - boo#912011: high ping latency after upgrade to latest     SLES11SP3 on xen Dom0

  - boo#906689: let systemd schedule xencommons after     network-online.target and remote-fs.target so that     xendomains has access to remote shares

The following functionality was enabled or enhanced :

  - Enable spice support in qemu for x86_64

  - Add Qxl vga support

  - Enhancement to virsh/libvirtd 'send-key' command     (FATE#317240)

  - Add domain_migrate_constraints_set API to Xend's http     interface (FATE#317239)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

The Virtualization service XEN was updated to fix various bugs and security issues.

The following security issues have been fixed :

CVE-2015-2756: XSA-126: Unmediated PCI command register access in qemu could have lead to denial of service attacks against the host, if PCI cards are passed through to guests.

XSA-125: Long latency MMIO mapping operations were not preemptible.

CVE-2015-2151: XSA-123: Instructions with register operands ignored eventual segment overrides encoded for them. Due to an insufficiently conditional assignment such a bogus segment override could have, however, corrupted a pointer used subsequently to store the result of the instruction.

CVE-2015-2045: XSA-122: The code handling certain sub-operations of the HYPERVISOR_xen_version hypercall failed to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

CVE-2015-2044: XSA-121: Emulation routines in the hypervisor dealing with certain system devices checked whether the access size by the guest is a supported one. When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

Also fixed :

Fully virtualized guest install from network source failed with 'cannot find guest domain' in XEN. (bsc#919341)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Virtualization service XEN was updated to fix various bugs and security issues.

The following security issues have been fixed :

CVE-2015-2756: XSA-126: Unmediated PCI command register access in qemu could have lead to denial of service attacks against the host, if PCI cards are passed through to guests.

XSA-125: Long latency MMIO mapping operations were not preemptible.

CVE-2015-2151: XSA-123: Instructions with register operands ignored eventual segment overrides encoded for them. Due to an insufficiently conditional assignment such a bogus segment override could have, however, corrupted a pointer used subsequently to store the result of the instruction.

CVE-2015-2045: XSA-122: The code handling certain sub-operations of the HYPERVISOR_xen_version hypercall failed to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

CVE-2015-2044: XSA-121: Emulation routines in the hypervisor dealing with certain system devices checked whether the access size by the guest is a supported one. When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

Also fixed :

Regular crashes of dom-0 on different servers due to races in MCE access were fixed. bsc#907755

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Virtualization service XEN was updated to fix various bugs and security issues.

The following security issues have been fixed :

CVE-2015-2756: XSA-126: Unmediated PCI command register access in qemu could have lead to denial of service attacks against the host, if PCI cards are passed through to guests.

XSA-125: Long latency MMIO mapping operations were not preemptible.

CVE-2015-2151: XSA-123: Instructions with register operands ignored eventual segment overrides encoded for them. Due to an insufficiently conditional assignment such a bogus segment override could have, however, corrupted a pointer used subsequently to store the result of the instruction.

CVE-2015-2045: XSA-122: The code handling certain sub-operations of the HYPERVISOR_xen_version hypercall failed to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

CVE-2015-2044: XSA-121: Emulation routines in the hypervisor dealing with certain system devices checked whether the access size by the guest is a supported one. When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Xen was updated 4.4.2_01 to address three security issues and functional bugs.

The following vulnerabilities were fixed :

  - Long latency MMIO mapping operations are not preemptible     (XSA-125, CVE-2015-2752, bnc#922705)

  - Unmediated PCI command register access in qemu (XSA-126,     CVE-2015-2756, bnc#922706)

  - Certain domctl operations may be abused to lock up the     host (XSA-127, CVE-2015-2751, bnc#922709)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - force the fifo access to be in bounds of the allocated     buffer This is CVE-2015-3456. [bug 21078935]     (CVE-2015-3456)

  - xen: limit guest control of PCI command register     Otherwise the guest can abuse that control to cause e.g.
    PCIe Unsupported Request responses (by disabling memory     and/or I/O decoding and subsequently causing [CPU side]     accesses to the respective address ranges), which     (depending on system configuration) may be fatal to the     host. This is CVE-2015-2756 / XSA-126.

    Conflicts: tools/ioemu-remote/hw/pass-through.c     (CVE-2015-2756)

  - Limit XEN_DOMCTL_memory_mapping hypercall to only     process up to 64 GFNs (or less) Said hypercall for large     BARs can take quite a while. As such we can require that     the hypercall MUST break up the request in smaller     values. Another approach is to add preemption to it -     whether we do the preemption using     hypercall_create_continuation or returning EAGAIN to     userspace (and have it re-invocate the call) - either     way the issue we cannot easily solve is that in     'map_mmio_regions' if we encounter an error we MUST call     'unmap_mmio_regions' for the whole BAR region. Since the     preemption would re-use input fields such as nr_mfns,     first_gfn, first_mfn - we would lose the original values
    - and only undo what was done in the current round (i.e.
    ignoring anything that was done prior to earlier     preemptions). Unless we re-used the return value as     'EAGAIN|nr_mfns_done<<10' but that puts a limit (since     the return value is a long) on the amount of nr_mfns     that can provided. This patch sidesteps this problem by :

  - Setting an hard limit of nr_mfns having to be 64 or     less.

  - Toolstack adjusts correspondingly to the nr_mfn limit.

  - If the there is an error when adding the toolstack will     call the remove operation to remove the whole region.
    The need to break this hypercall down is for large BARs     can take more than the guest (initial domain usually)     time-slice. This has the negative result in that the     guest is locked out for a long duration and is unable to     act on any pending events. We also augment the code to     return zero if nr_mfns instead of trying to the     hypercall. Suggested-by: Jan Beulich 

    This is CVE-2015-2752 / XSA-125. Conflicts:
    xen/arch/x86/domctl.c (CVE-2015-2752)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fdc: force the fifo access to be in bounds of the     allocated buffer During processing of certain commands     such as FD_CMD_READ_ID and     FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory     access could get out of bounds leading to memory     corruption with values coming from the guest. Fix this     by making sure that the index is always bounded by the     allocated memory. This is CVE-2015-3456.

    XSA-133 (CVE-2015-3456)

  - fdc: force the fifo access to be in bounds of the     allocated buffer During processing of certain commands     such as FD_CMD_READ_ID and     FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory     access could get out of bounds leading to memory     corruption with values coming from the guest. Fix this     by making sure that the index is always bounded by the     allocated memory. This is CVE-2015-3456.

    XSA-133 (CVE-2015-3456)

  - domctl: don't allow a toolstack domain to call     domain_pause on itself These DOMCTL subops were     accidentally declared safe for disaggregation in the     wake of XSA-77. This is XSA-127. (CVE-2015-2751)

  - xen: limit guest control of PCI command register     Otherwise the guest can abuse that control to cause e.g.
    PCIe Unsupported Request responses (by disabling memory     and/or I/O decoding and subsequently causing [CPU side]     accesses to the respective address ranges), which     (depending on system configuration) may be fatal to the     host. This is CVE-2015-2756 / XSA-126.

    Conflicts:
    tools/qemu-xen-traditional-dir/hw/pass-through.c     (CVE-2015-2756)

  - xen: limit guest control of PCI command register     Otherwise the guest can abuse that control to cause e.g.
    PCIe Unsupported Request responses (by disabling memory     and/or I/O decoding and subsequently causing [CPU side]     accesses to the respective address ranges), which     (depending on system configuration) may be fatal to the     host. This is CVE-2015-2756 / XSA-126. (CVE-2015-2756)

  - Limit XEN_DOMCTL_memory_mapping hypercall to only     process up to 64 GFNs (or less) Said hypercall for large     BARs can take quite a while. As such we can require that     the hypercall MUST break up the request in smaller     values. Another approach is to add preemption to it -     whether we do the preemption using     hypercall_create_continuation or returning EAGAIN to     userspace (and have it re-invocate the call) - either     way the issue we cannot easily solve is that in     'map_mmio_regions' if we encounter an error we MUST call     'unmap_mmio_regions' for the whole BAR region. Since the     preemption would re-use input fields such as nr_mfns,     first_gfn, first_mfn - we would lose the original values
    - and only undo what was done in the current round (i.e.
    ignoring anything that was done prior to earlier     preemptions). Unless we re-used the return value as     'EAGAIN|nr_mfns_done<<10' but that puts a limit (since     the return value is a long) on the amount of nr_mfns     that can provided. This patch sidesteps this problem by :

  - Setting an hard limit of nr_mfns having to be 64 or     less.

  - Toolstack adjusts correspondingly to the nr_mfn limit.

  - If the there is an error when adding the toolstack will     call the remove operation to remove the whole region.
    The need to break this hypercall down is for large BARs     can take more than the guest (initial domain usually)     time-slice. This has the negative result in that the     guest is locked out for a long duration and is unable to     act on any pending events. We also augment the code to     return zero if nr_mfns instead of trying to the     hypercall. Suggested-by: Jan Beulich 

    This is CVE-2015-2752 / XSA-125. (CVE-2015-2752)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2608-1 advisory.

    Jason Geffner discovered that QEMU incorrectly handled the virtual floppy driver. This issue is known as     VENOM. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary     code on the host as the user running the QEMU process. In the default installation, when QEMU is used with     libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2015-3456)

    Daniel P. Berrange discovered that QEMU incorrectly handled VNC websockets. A remote attacker could use     this issue to cause QEMU to consume memory, resulting in a denial of service. This issue only affected     Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-1779)

    Jan Beulich discovered that QEMU, when used with Xen, didn't properly restrict access to PCI command     registers. A malicious guest could use this issue to cause a denial of service. This issue only affected     Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-2756)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the qemu virtualisation solution :

  - CVE-2014-9718     It was discovered that the IDE controller emulation is     susceptible to denial of service.

  - CVE-2015-1779     Daniel P. Berrange discovered a denial of service     vulnerability in the VNC web socket decoder.

  - CVE-2015-2756     Jan Beulich discovered that unmediated PCI command     register could result in denial of service.

  - CVE-2015-3456     Jason Geffner discovered a buffer overflow in the     emulated floppy disk drive, resulting in the potential     execution of arbitrary code.

The Virtualization service XEN was updated to fix various bugs and security issues.

The following security issues have been fixed :

  - XSA-126: Unmediated PCI command register access in qemu     could have lead to denial of service attacks against the     host, if PCI cards are passed through to guests.
    (CVE-2015-2756)

  - XSA-125: Long latency MMIO mapping operations were not     preemptible.

  - XSA-123: Instructions with register operands ignored     eventual segment overrides encoded for them. Due to an     insufficiently conditional assignment such a bogus     segment override could have, however, corrupted a     pointer used subsequently to store the result of the     instruction. (CVE-2015-2151)

  - XSA-122: The code handling certain sub-operations of the     HYPERVISOR_xen_version hypercall failed to fully     initialize all fields of structures subsequently copied     back to guest memory. Due to this hypervisor stack     contents were copied into the destination of the     operation, thus becoming visible to the guest.
    (CVE-2015-2045)

  - XSA-121: Emulation routines in the hypervisor dealing     with certain system devices checked whether the access     size by the guest is a supported one. When the access     size is unsupported these routines failed to set the     data to be returned to the guest for read accesses, so     that hypervisor stack contents were copied into the     destination of the operation, thus becoming visible to     the guest. (CVE-2015-2044)

Also fixed :

  - Fully virtualized guest install from network source     failed with 'cannot find guest domain' in XEN.
    (bsc#919341)

Long latency MMIO mapping operations are not preemptible [XSA-125, CVE-2015-2752] Unmediated PCI command register access in qemu [XSA-126, CVE-2015-2756] Certain domctl operations may be abused to lock up the host [XSA-127, CVE-2015-2751]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Xen was updated to 4.3.4 to fix multiple vulnerabities and non-security bugs.

The following vulnerabilities were fixed :

  - Long latency MMIO mapping operations are not preemptible     (XSA-125 CVE-2015-2752 bnc#922705)

  - Unmediated PCI command register access in qemu (XSA-126     CVE-2015-2756 bnc#922706)

  - Hypervisor memory corruption due to x86 emulator flaw     (bnc#919464 CVE-2015-2151 XSA-123)

  - Information leak through version information hypercall     (bnc#918998 CVE-2015-2045 XSA-122)

  - Information leak via internal x86 system device     emulation (bnc#918995 (CVE-2015-2044 XSA-121)

  - HVM qemu unexpectedly enabling emulated VGA graphics     backends (bnc#919663 CVE-2015-2152 XSA-119)

  - information leakage when guest sets high resolution     (bnc#895528 CVE-2014-3615)

The following non-security bugs were fixed :

  - L3: XEN blktap device intermittently fails to connect     (bnc#919098) 

  - Problems with detecting free loop devices on Xen guest     startup (bnc#903680)

  - xentop reports 'Found interface vif101.0 but domain 101     does not exist.' (bnc#861318) 

  - Intel ixgbe driver assigns rx/tx queues per core     resulting in irq problems on servers with a large amount     of CPU cores (bnc#901488)

  - SLES11 SP3 Xen VT-d igb NIC doesn't work (bnc#910254)

The remote host is affected by the vulnerability described in GLSA-201504-04 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen.  Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly cause a Denial of Service condition or       obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

Long latency MMIO mapping operations are not preemptible [XSA-125, CVE-2015-2752] Unmediated PCI command register access in qemu [XSA-126, CVE-2015-2756] Certain domctl operations may be abused to lock up the host [XSA-127, CVE-2015-2751] update to xen-4.3.4

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Long latency MMIO mapping operations are not preemptible [XSA-125, CVE-2015-2752] Unmediated PCI command register access in qemu [XSA-126, CVE-2015-2756] Certain domctl operations may be abused to lock up the host [XSA-127, CVE-2015-2751] update to xen-4.4.2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
91198	Debian DLA-479-1 : xen security update	Nessus	Debian Local Security Checks	high
88737	OracleVM 2.2 : xen (OVMSA-2016-0012)	Nessus	OracleVM Local Security Checks	high
84705	FreeBSD : xen-tools -- Unmediated PCI command register access in qemu (79f401cd-27e6-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
84333	openSUSE Security Update : xen (openSUSE-2015-434) (Venom)	Nessus	SuSE Local Security Checks	high
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	low
83720	SUSE SLED11 / SLES11 Security Update : Xen (SUSE-SU-2015:0747-1)	Nessus	SuSE Local Security Checks	high
83719	SUSE SLES11 Security Update : Xen (SUSE-SU-2015:0746-1)	Nessus	SuSE Local Security Checks	high
83718	SUSE SLES11 Security Update : Xen (SUSE-SU-2015:0745-1)	Nessus	SuSE Local Security Checks	high
83714	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:0701-1)	Nessus	SuSE Local Security Checks	high
83483	OracleVM 3.2 : xen (OVMSA-2015-0058) (Venom)	Nessus	OracleVM Local Security Checks	high
83482	OracleVM 3.3 : xen (OVMSA-2015-0057) (Venom)	Nessus	OracleVM Local Security Checks	high
83435	Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2608-1)	Nessus	Ubuntu Local Security Checks	high
83422	Debian DSA-3259-1 : qemu - security update (Venom)	Nessus	Debian Local Security Checks	high
82990	SuSE 11.3 Security Update : Xen (SAT Patch Number 10560)	Nessus	SuSE Local Security Checks	high
82952	Fedora 22 : xen-4.5.0-7.fc22 (2015-5295)	Nessus	Fedora Local Security Checks	high
82907	openSUSE Security Update : xen (openSUSE-2015-314)	Nessus	SuSE Local Security Checks	high
82734	GLSA-201504-04 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
82730	Fedora 20 : xen-4.3.4-2.fc20 (2015-5402)	Nessus	Fedora Local Security Checks	high
82729	Fedora 21 : xen-4.4.2-2.fc21 (2015-5208)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2015-2756

medium

Tenable Plugins

high

high

medium

high

low

high

high

high

high

high

high

high

high

high

high

high

high

high

high