Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.

The remote host is affected by the vulnerability described in GLSA-201604-03 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly cause a Denial of Service condition or       obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - XSA-125: Limit XEN_DOMCTL_memory_mapping hypercall to     only process up to 64 GFNs (or less) (Jan Beulich)     [20732412] (CVE-2015-2752)

  - XSA-126: xen: limit guest control of PCI command     register (Jan Beulich) [20739399] (CVE-2015-2756)

  - XSA-128: xen: properly gate host writes of modified PCI     CFG contents (Jan Beulich) [21157440] (CVE-2015-4103)

  - XSA-129: xen: don't allow guest to control MSI mask     register (Jan Beulich) [21158692] (CVE-2015-4104)

  - XSA-130: xen/MSI-X: disable logging by default (Jan     Beulich) [21159408] (CVE-2015-4105)

  - XSA-131: [PATCH 1/8] xen/MSI: don't open-code     pass-through of enable bit modifications (Jan Beulich)     [21164529] (CVE-2015-4106)

  - XSA-131: [PATCH 2/8] xen/pt: consolidate PM capability     emu_mask [21164529] (CVE-2015-4106)

  - XSA-131: [PATCH 3/8] xen/pt: correctly handle PM status     bit [21164529] (CVE-2015-4106)

  - XSA-131: [PATCH 4/8] xen/pt: split out calculation of     throughable mask in PCI config space handling [21164529]     (CVE-2015-4106)

  - XSA-131: [PATCH 5/8] xen/pt: mark all PCIe capability     bits read-only [21164529] (CVE-2015-4106)

  - XSA-131: [PATCH 6/8] xen/pt: mark reserved bits in PCI     config space fields [21164529] (CVE-2015-4106)

  - XSA-131: [PATCH 7/8] xen/pt: add a few PCI config space     field descriptions [21164529] (CVE-2015-4106)

  - XSA-131: [PATCH 8/8] xen/pt: unknown PCI config space     fields should be read-only [21164529] (CVE-2015-4106)

The Xen Project reports :

Logic is in place to avoid writes to certain host config space fields when the guest must nevertheless be able to access their virtual counterparts. A bug in how this logic deals with accesses spanning multiple fields allows the guest to write to the host MSI message data field.

While generally the writes write back the values previously read, their value in config space may have got changed by the host between the qemu read and write. In such a case host side interrupt handling could become confused, possibly losing interrupts or allowing spurious interrupt injection into other guests.

Certain untrusted guest administrators may be able to confuse host side interrupt handling, leading to a Denial of Service.

Xen was updated to fix six security issues :

CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu. (XSA-128, bsc#931625)

CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests.
(XSA-129, bsc#931626)

CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages. (XSA-130, bsc#931627)

CVE-2015-4106: Unmediated PCI register access in qemu. (XSA-131, bsc#931628)

CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest to host escape. (XSA-135, bsc#932770)

CVE-2015-4164: DoS through iret hypercall handler. (XSA-136, bsc#932996)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Xen was updated to fix six security issues :

CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu. (XSA-128, bsc#931625)

CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests.
(XSA-129, bsc#931626)

CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages. (XSA-130, bsc#931627)

CVE-2015-4106: Unmediated PCI register access in qemu. (XSA-131, bsc#931628)

CVE-2015-3209: heap overflow in qemu pcnet controller allowing guest to host escape. (XSA-135, bsc#932770)

CVE-2015-4164: DoS through iret hypercall handler. (XSA-136, bsc#932996)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Heap overflow in QEMU PCNET controller, allowing guest->host escape [XSA-135, CVE-2015-3209] (#1230537) GNTTABOP_swap_grant_ref operation misbehavior [XSA-134, CVE-2015-4163] vulnerability in the iret hypercall handler [XSA-136, CVE-2015-4164] Potential unintended writes to host MSI message data field via qemu [XSA-128, CVE-2015-4103], PCI MSI mask bits inadvertently exposed to guests [XSA-129, CVE-2015-4104], Guest triggerable qemu MSI-X pass-through error messages [XSA-130, CVE-2015-4105], Unmediated PCI register access in qemu [XSA-131, CVE-2015-4106]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Xen was updated to fix eight vulnerabilities.

The following vulnerabilities were fixed :

  - CVE-2015-2751: Certain domctl operations may be abused     to lock up the host (XSA-127 boo#922709)

  - CVE-2015-4103: Potential unintended writes to host MSI     message data field via qemu (XSA-128) (boo#931625)

  - CVE-2015-4104: PCI MSI mask bits inadvertently exposed     to guests (XSA-129) (boo#931626)

  - CVE-2015-4105: Guest triggerable qemu MSI-X pass-through     error messages (XSA-130) (boo#931627)

  - CVE-2015-4106: Unmediated PCI register access in qemu     (XSA-131) (boo#931628)

  - CVE-2015-4163: GNTTABOP_swap_grant_ref operation     misbehavior (XSA-134) (boo#932790)

  - CVE-2015-3209: heap overflow in qemu pcnet controller     allowing guest to host escape (XSA-135) (boo#932770)

  - CVE-2015-4164: DoS through iret hypercall handler     (XSA-136) (boo#932996)

Xen was updated to 4.4.2 to fix multiple vulnerabilities and non-security bugs.

The following vulnerabilities were fixed :

  - CVE-2015-4103: Potential unintended writes to host MSI     message data field via qemu (XSA-128) (boo#931625)

  - CVE-2015-4104: PCI MSI mask bits inadvertently exposed     to guests (XSA-129) (boo#931626)

  - CVE-2015-4105: Guest triggerable qemu MSI-X pass-through     error messages (XSA-130) (boo#931627)

  - CVE-2015-4106: Unmediated PCI register access in qemu     (XSA-131) (boo#931628)

  - CVE-2015-4164: DoS through iret hypercall handler     (XSA-136) (boo#932996)

  - CVE-2015-4163: GNTTABOP_swap_grant_ref operation     misbehavior (XSA-134) (boo#932790)

  - CVE-2015-3209: heap overflow in qemu pcnet controller     allowing guest to host escape (XSA-135) (boo#932770)

  - CVE-2015-3456: Fixed a buffer overflow in the floppy     drive emulation, which could be used to denial of     service attacks or potential code execution against the     host. ()

  - CVE-2015-3340: Xen did not initialize certain fields,     which allowed certain remote service domains to obtain     sensitive information from memory via a (1)     XEN_DOMCTL_gettscinfo or (2)     XEN_SYSCTL_getdomaininfolist request. ()

  - CVE-2015-2752: Long latency MMIO mapping operations are     not preemptible (XSA-125 boo#922705)

  - CVE-2015-2756: Unmediated PCI command register access in     qemu (XSA-126 boo#922706)

  - CVE-2015-2751: Certain domctl operations may be abused     to lock up the host (XSA-127 boo#922709)

  - CVE-2015-2151: Hypervisor memory corruption due to x86     emulator flaw (boo#919464 XSA-123)

  - CVE-2015-2045: Information leak through version     information hypercall (boo#918998 XSA-122)

  - CVE-2015-2044: Information leak via internal x86 system     device emulation (boo#918995 (XSA-121)

  - CVE-2015-2152: HVM qemu unexpectedly enabling emulated     VGA graphics backends (boo#919663 XSA-119)

  - CVE-2014-3615: information leakage when guest sets high     resolution (boo#895528)

The following non-security bugs were fixed :

  - xentop: Fix memory leak on read failure 

  - boo#923758: xen dmesg contains bogus output in early     boot

  - boo#921842: Xentop doesn't display disk statistics for     VMs using qdisks

  - boo#919098: L3: XEN blktap device intermittently fails     to connect 

  - boo#882089: Windows 2012 R2 fails to boot up with     greater than 60 vcpus

  - boo#903680: Problems with detecting free loop devices on     Xen guest startup

  - boo#861318: xentop reports 'Found interface vif101.0 but     domain 101 does not exist.'

  - boo#901488: Intel ixgbe driver assigns rx/tx queues per     core resulting in irq problems on servers with a large     amount of CPU cores

  - boo#910254: SLES11 SP3 Xen VT-d igb NIC doesn't work

  - boo#912011: high ping latency after upgrade to latest     SLES11SP3 on xen Dom0

  - boo#906689: let systemd schedule xencommons after     network-online.target and remote-fs.target so that     xendomains has access to remote shares

The following functionality was enabled or enhanced :

  - Enable spice support in qemu for x86_64

  - Add Qxl vga support

  - Enhancement to virsh/libvirtd 'send-key' command     (FATE#317240)

  - Add domain_migrate_constraints_set API to Xend's http     interface (FATE#317239)

Xen was updated to fix seven security vulnerabilities :

CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu. (XSA-128, bnc#931625)

CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests.
(XSA-129, bnc#931626)

CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages. (XSA-130, bnc#931627)

CVE-2015-4106: Unmediated PCI register access in qemu. (XSA-131, bnc#931628)

CVE-2015-4163: GNTTABOP_swap_grant_ref operation misbehavior.
(XSA-134, bnc#932790)

CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest to host escape. (XSA-135, bnc#932770)

CVE-2015-4164: DoS through iret hypercall handler. (XSA-136, bnc#932996)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Potential unintended writes to host MSI message data field via qemu [XSA-128, CVE-2015-4103], PCI MSI mask bits inadvertently exposed to guests [XSA-129, CVE-2015-4104], Guest triggerable qemu MSI-X pass-through error messages [XSA-130, CVE-2015-4105], Unmediated PCI register access in qemu [XSA-131, CVE-2015-4106]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

replace deprecated gnutls use in qemu-xen-traditional based on qemu-xen patches, work around a gcc 5 bug, Potential unintended writes to host MSI message data field via qemu [XSA-128, CVE-2015-4103], PCI MSI mask bits inadvertently exposed to guests [XSA-129, CVE-2015-4104], Guest triggerable qemu MSI-X pass-through error messages [XSA-130, CVE-2015-4105], Unmediated PCI register access in qemu [XSA-131, CVE-2015-4106]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been found in the Xen virtualisation solution :

  - CVE-2015-3209     Matt Tait discovered a flaw in the way QEMU's AMD PCnet     Ethernet emulation handles multi-TMD packets with a     length above 4096 bytes. A privileged guest user in a     guest with an AMD PCNet ethernet card enabled can     potentially use this flaw to execute arbitrary code on     the host with the privileges of the hosting QEMU     process.

  - CVE-2015-4103     Jan Beulich discovered that the QEMU Xen code does not     properly restrict write access to the host MSI message     data field, allowing a malicious guest to cause a denial     of service.

  - CVE-2015-4104     Jan Beulich discovered that the QEMU Xen code does not     properly restrict access to PCI MSI mask bits, allowing     a malicious guest to cause a denial of service.

  - CVE-2015-4105     Jan Beulich reported that the QEMU Xen code enables     logging for PCI MSI-X pass-through error messages,     allowing a malicious guest to cause a denial of service.

  - CVE-2015-4106     Jan Beulich discovered that the QEMU Xen code does not     properly restrict write access to the PCI config space     for certain PCI pass-through devices, allowing a     malicious guest to cause a denial of service, obtain     sensitive information or potentially execute arbitrary     code.

  - CVE-2015-4163     Jan Beulich discovered that a missing version check in     the GNTTABOP_swap_grant_ref hypercall handler may result     in denial of service. This only applies to Debian     stable/jessie.

  - CVE-2015-4164     Andrew Cooper discovered a vulnerability in the iret     hypercall handler, which may result in denial of     service.

Several vulnerabilities were discovered in qemu, a fast processor emulator.

  - CVE-2015-3209     Matt Tait of Google's Project Zero security team     discovered a flaw in the way QEMU's AMD PCnet Ethernet     emulation handles multi-TMD packets with a length above     4096 bytes. A privileged guest user in a guest with an     AMD PCNet ethernet card enabled can potentially use this     flaw to execute arbitrary code on the host with the     privileges of the hosting QEMU process.

  - CVE-2015-4037     Kurt Seifried of Red Hat Product Security discovered     that QEMU's user mode networking stack uses predictable     temporary file names when the -smb option is used. An     unprivileged user can use this flaw to cause a denial of     service.

  - CVE-2015-4103     Jan Beulich of SUSE discovered that the QEMU Xen code     does not properly restrict write access to the host MSI     message data field, allowing a malicious guest to cause     a denial of service.

  - CVE-2015-4104     Jan Beulich of SUSE discovered that the QEMU Xen code     does not properly restrict access to PCI MSI mask bits,     allowing a malicious guest to cause a denial of service.

  - CVE-2015-4105     Jan Beulich of SUSE reported that the QEMU Xen code     enables logging for PCI MSI-X pass-through error     messages, allowing a malicious guest to cause a denial     of service.

  - CVE-2015-4106     Jan Beulich of SUSE discovered that the QEMU Xen code     does not properly restrict write access to the PCI     config space for certain PCI pass-through devices,     allowing a malicious guest to cause a denial of service,     obtain sensitive information or potentially execute     arbitrary code.

Xen was updated to fix seven security issues and one non-security bug.

The following vulnerabilities were fixed :

  - CVE-2015-4103: Potential unintended writes to host MSI     message data field via qemu (XSA-128) (bnc#931625)

  - CVE-2015-4104: PCI MSI mask bits inadvertently exposed     to guests (XSA-129) (bnc#931626)

  - CVE-2015-4105: Guest triggerable qemu MSI-X pass-through     error messages (XSA-130) (bnc#931627)

  - CVE-2015-4106: Unmediated PCI register access in qemu     (XSA-131) (bnc#931628)

  - CVE-2015-4163: GNTTABOP_swap_grant_ref operation     misbehavior (XSA-134) (bnc#932790)

  - CVE-2015-3209: heap overflow in qemu pcnet controller     allowing guest to host escape (XSA-135) (bnc#932770)

  - CVE-2015-4164: DoS through iret hypercall handler     (XSA-136) (bnc#932996)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2630-1 advisory.

    Matt Tait discovered that QEMU incorrectly handled the virtual PCNET driver. A malicious guest could use     this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user     running the QEMU process. In the default installation, when QEMU is used with libvirt, attackers would be     isolated by the libvirt AppArmor profile. (CVE-2015-3209)

    Kurt Seifried discovered that QEMU incorrectly handled certain temporary files. A local attacker could use     this issue to cause a denial of service. (CVE-2015-4037)

    Jan Beulich discovered that the QEMU Xen code incorrectly restricted write access to the host MSI message     data field. A malicious guest could use this issue to cause a denial of service. This issue only applied     to Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-4103)

    Jan Beulich discovered that the QEMU Xen code incorrectly restricted access to the PCI MSI mask bits. A     malicious guest could use this issue to cause a denial of service. This issue only applied to Ubuntu 14.04     LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-4104)

    Jan Beulich discovered that the QEMU Xen code incorrectly handled MSI-X error messages. A malicious guest     could use this issue to cause a denial of service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu     14.10 and Ubuntu 15.04. (CVE-2015-4105)

    Jan Beulich discovered that the QEMU Xen code incorrectly restricted write access to the PCI config space.
    A malicious guest could use this issue to cause a denial of service, obtain sensitive information, or     possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu     15.04. (CVE-2015-4106)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0064 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - xen/pt: unknown PCI config space fields should be     read-only ... by default. Add a per-device 'permissive'     mode similar to pciback's to allow restoring previous     behavior (and hence break security again, i.e. should be     used only for trusted guests). This is part of XSA-131.
    (CVE-2015-4106)

  - xen/pt: add a few PCI config space field descriptions     Since the next patch will turn all not explicitly     described fields read-only by default, those fields that     have guest writable bits need to be given explicit     descriptors. This is a preparatory patch for XSA-131.
    (CVE-2015-4106)

  - xen/pt: mark reserved bits in PCI config space fields     The adjustments are solely to make the subsequent     patches work right (and hence make the patch set     consistent), namely if permissive mode (introduced by     the last patch) gets used (as both reserved registers     and reserved fields must be similarly protected from     guest access in default mode, but the guest should be     allowed access to them in permissive mode). This is a     preparatory patch for XSA-131. (CVE-2015-4106)

  - xen/pt: mark all PCIe capability bits read-only     xen_pt_emu_reg_pcie[]'s PCI_EXP_DEVCAP needs to cover     all bits as read- only to avoid unintended write-back     (just a precaution, the field ought to be read-only in     hardware). This is a preparatory patch for XSA-131.
    (CVE-2015-4106)

  - xen/pt: split out calculation of throughable mask in PCI     config space handling This is just to avoid having to     adjust that calculation later in multiple places. Note     that including ->ro_mask in get_throughable_mask's     calculation is only an apparent (i.e. benign) behavioral     change: For r/o fields it doesn't matter > whether they     get passed through - either the same flag is also set in     emu_mask (then there's no change at all) or the field is     r/o in hardware (and hence a write won't change it     anyway). This is a preparatory patch for XSA-131.
    (CVE-2015-4106)

  - xen/pt: correctly handle PM status bit     xen_pt_pmcsr_reg_write needs an adjustment to deal with     the RW1C nature of the not passed through bit 15     (PCI_PM_CTRL_PME_STATUS). This is a preparatory patch     for XSA-131. (CVE-2015-4106)

  - xen/pt: consolidate PM capability emu_mask There's no     point in xen_pt_pmcsr_reg_[read,write] each ORing     PCI_PM_CTRL_STATE_MASK and PCI_PM_CTRL_NO_SOFT_RESET     into a local emu_mask variable - we can have the same     effect by setting the field descriptor's emu_mask member     suitably right away. Note that xen_pt_pmcsr_reg_write is     being retained in order to allow later patches to be     less intrusive. This is a preparatory patch for XSA-131.
    (CVE-2015-4106)

  - xen/MSI: don't open-code pass-through of enable bit     modifications Without this the actual XSA-131 fix would     cause the enable bit to not get set anymore (due to the     write back getting suppressed there based on the OR of     emu_mask, ro_mask, and res_mask). Note that the fiddling     with the enable bit shouldn't really be done by qemu,     but making this work right (via libxc and the     hypervisor) will require more extensive changes, which     can be postponed until after the security issue got     addressed. This is a preparatory patch for XSA-131.
    (CVE-2015-4106)

  - xen/MSI-X: disable logging by default ... to avoid     allowing the guest to cause the control domain's disk to     fill. This is XSA-130. (CVE-2015-4105)

  - xen: don't allow guest to control MSI mask register It's     being used by the hypervisor. For now simply mimic a     device not capable of masking, and fully emulate any     accesses a guest may issue nevertheless as simple     reads/writes without side effects. This is XSA-129.
    (CVE-2015-4104)

  - xen: properly gate host writes of modified PCI CFG     contents The old logic didn't work as intended when an     access spanned multiple fields (for example a 32-bit     access to the location of the MSI Message Data field     with the high 16 bits not being covered by any known     field). Remove it and derive which fields not to write     to from the accessed fields' emulation masks: When     they're all ones, there's no point in doing any host     write. This fixes a secondary issue at once: We     obviously shouldn't make any host write attempt when     already the host read failed. This is XSA-128.

    Conflicts: tools/ioemu-remote/hw/pass-through.c     (CVE-2015-4103)

ID	Name	Product	Family	Severity
90380	GLSA-201604-03 : Xen: Multiple vulnerabilities (Venom)	Nessus	Gentoo Local Security Checks	critical
88737	OracleVM 2.2 : xen (OVMSA-2016-0012)	Nessus	OracleVM Local Security Checks	high
84711	FreeBSD : xen-tools -- Potential unintended writes to host MSI message data field via qemu (af38cfec-27e7-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
84469	SUSE SLES11 Security Update : Xen (SUSE-SU-2015:1157-1)	Nessus	SuSE Local Security Checks	high
84468	SUSE SLES11 Security Update : Xen (SUSE-SU-2015:1156-1)	Nessus	SuSE Local Security Checks	high
84378	Fedora 20 : xen-4.3.4-6.fc20 (2015-9965)	Nessus	Fedora Local Security Checks	high
84334	openSUSE Security Update : xen (openSUSE-2015-435)	Nessus	SuSE Local Security Checks	high
84333	openSUSE Security Update : xen (openSUSE-2015-434) (Venom)	Nessus	SuSE Local Security Checks	high
84190	SUSE SLED11 / SLES11 Security Update : Xen (SUSE-SU-2015:1045-1)	Nessus	SuSE Local Security Checks	high
84178	Fedora 21 : xen-4.4.2-5.fc21 (2015-9466)	Nessus	Fedora Local Security Checks	high
84177	Fedora 22 : xen-4.5.0-10.fc22 (2015-9456)	Nessus	Fedora Local Security Checks	high
84169	Debian DSA-3286-1 : xen - security update	Nessus	Debian Local Security Checks	high
84167	Debian DSA-3284-1 : qemu - security update	Nessus	Debian Local Security Checks	high
84146	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:1042-1)	Nessus	SuSE Local Security Checks	high
84118	Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2630-1)	Nessus	Ubuntu Local Security Checks	critical
83967	OracleVM 3.3 : xen (OVMSA-2015-0064)	Nessus	OracleVM Local Security Checks	high
83966	OracleVM 3.2 : xen (OVMSA-2015-0063)	Nessus	OracleVM Local Security Checks	high

Detections

Analytics

CVE-2015-4103

medium

Tenable Plugins

critical

high

medium

high

high

high

high

high

high

high

high

high

high

high

critical

high

high