The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0039 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2016-0081 for details.

The remote host is affected by the vulnerability described in GLSA-201604-03 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly cause a Denial of Service condition or       obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

nine security updates CVE-2015-7969 CVE-2015-7970 CVE-2015-7813 CVE-2015-7814 CVE-2015-7812 CVE-2015-7971 CVE-2015-7835 CVE-2015-7972

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#955399 - Fix xm migrate --log_progress. Due to logic     error progress was not logged when requested.

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#955399 - Fix xm migrate --live. The options were not     passed due to a merge error. As a result the migration     was not live, instead the suspended guest was migrated.

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)

  - bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand     balloon size inaccuracy can crash guests (XSA-153)

  - Drop     5604f239-x86-PV-properly-populate-descriptor-tables.patc     h

  - bsc#950703 - CVE-2015-7969: xen: leak of main per-domain     vcpu pointer array (DoS) (XSA-149)

  - bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain     profiling-related vcpu pointer array (DoS) (XSA-151)

  - bsc#950706 - CVE-2015-7971: xen: x86: some pmu and     profiling hypercalls log without rate limiting (XSA-152)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156) CVE-2015-5307-xsa156.patch

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)     563212c9-x86-PoD-Eager-sweep-for-zeroed-pages.patch

  - bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand     balloon size inaccuracy can crash guests (XSA-153)     xsa153-libxl.patch xend-xsa153.patch

  - Drop     5604f239-x86-PV-properly-populate-descriptor-tables.patc     h

  - bsc#950703 - CVE-2015-7969: xen: leak of main per-domain     vcpu pointer array (DoS) (XSA-149)

  - bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain     profiling-related vcpu pointer array (DoS) (XSA-151)

  - bsc#950706 - CVE-2015-7971: xen: x86: some pmu and     profiling hypercalls log without rate limiting (XSA-152)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - Revert x86/IO-APIC: don't create pIRQ mapping from     masked RTE until kernel maintenance release goes out.

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)

This update fixes the following security issues :

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

  - bsc#950704 - CVE-2015-7970 xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)     563212c9-x86-PoD-Eager-sweep-for-zeroed-pages.patch

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix-up bad changelog dates

  - guard against undue super page PTE creation XSA-148 (Jan     Beulich)

Xen was updated to fix 6 security issues.

These security issues were fixed :

  - CVE-2014-0222: Validate L2 table size to avoid integer     overflows (bsc#877642).

  - CVE-2015-4037: Insecure temporary file use in     /net/slirp.c (bsc#932267).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7969: Leak of per-domain profiling-related vcpu     pointer array (DoS) (bsc#950705 bsc#950703).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

  - CVE-2015-7972: Populate-on-demand balloon size     inaccuracy can crash guests (bsc#951845).

xen was updated to fix 12 security issues.

These security issues were fixed :

  - CVE-2015-7972: Populate-on-demand balloon size     inaccuracy can crash guests (bsc#951845).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array (DoS) (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling-related vcpu     pointer array (DoS) (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

  - CVE-2015-4037: Insecure temporary file use in     /net/slirp.c (bsc#932267).

  - CVE-2014-0222: Validate L2 table size to avoid integer     overflows (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7311: libxl fails to honour readonly flag on     disks with qemu-xen (bsc#947165).

  - CVE-2015-5165: QEMU leak of uninitialized heap memory in     rtl8139 device model (bsc#939712).

  - CVE-2015-5166: Use after free in QEMU/Xen block unplug     protocol (bsc#939709).

  - CVE-2015-5154: Host code execution via IDE subsystem     CD-ROM (bsc#938344).

  - CVE-2015-3259: xl command line config handling stack     overflow (bsc#935634).

These non-security issues were fixed :

  - bsc#907514: Bus fatal error and sles12 sudden reboot has     been observed

  - bsc#910258: SLES12 Xen host crashes with FATAL NMI after     shutdown of guest with VT-d NIC

  - bsc#918984: Bus fatal error and sles11-SP4 sudden reboot     has been observed

  - bsc#923967: Partner-L3: Bus fatal error and sles11-SP3     sudden reboot has been observed

  - bsc#901488: Intel ixgbe driver assigns rx/tx queues per     core resulting in irq problems on servers with a large     amount of CPU cores

  - bsc#945167: Running command xl pci-assignable-add     03:10.1 secondly show errors

  - bsc#949138: Setting vcpu affinity under Xen causes     libvirtd abort

  - bsc#944463: VUL-0: CVE-2015-5239: qemu-kvm: Integer     overflow in vnc_client_read() and protocol_client_msg()

  - bsc#944697: VUL-1: CVE-2015-6815: qemu: net: e1000:
    infinite loop issue

  - bsc#925466: Kdump does not work in a XEN environment

xen was updated to fix eight security issues.

These security issues were fixed :

  - CVE-2015-4037: The slirp_smb function in net/slirp.c     created temporary files with predictable names, which     allowed local users to cause a denial of service     (instantiation failure) by creating /tmp/qemu-smb.*-*     files before the program (bsc#932267).

  - CVE-2014-0222: Integer overflow in the qcow_open     function allowed remote attackers to cause a denial of     service (crash) via a large L2 table in a QCOW version 1     image (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-5239: Integer overflow in vnc_client_read() and     protocol_client_msg() (bsc#944463).

  - CVE-2015-6815: With e1000 NIC emulation support it was     possible to enter an infinite loop (bsc#944697).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array leading to denial of service (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling- related     vcpu pointer array leading to denial of service     (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xen was updated to fix 13 security issues.

These security issues were fixed :

  - CVE-2015-7972: Populate-on-demand balloon size     inaccuracy can crash guests (bsc#951845).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array (DoS) (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling-related vcpu     pointer array (DoS) (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

  - CVE-2015-4037: Insecure temporary file use in     /net/slirp.c (bsc#932267).

  - CVE-2014-0222: Validate L2 table size to avoid integer     overflows (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7311: libxl fails to honour readonly flag on     disks with qemu-xen (bsc#947165).

  - CVE-2015-5165: QEMU leak of uninitialized heap memory in     rtl8139 device model (bsc#939712).

  - CVE-2015-5166: Use after free in QEMU/Xen block unplug     protocol (bsc#939709).

  - CVE-2015-5239: Integer overflow in vnc_client_read() and     protocol_client_msg() (bsc#944463).

  - CVE-2015-6815: e1000: infinite loop issue (bsc#944697).

  - CVE-2015-5154: Host code execution via IDE subsystem     CD-ROM (bsc#938344).

This non-security issues was fixed :

  - bsc#941074: VmError: Device 51728 (vbd) could not be     connected. Hotplug scripts not working.

The Xen Project reports :

The code to validate level 2 page table entries is bypassed when certain conditions are satisfied. This means that a PV guest can create writable mappings using super page mappings. Such writable mappings can violate Xen intended invariants for pages which Xen is supposed to keep read-only. This is possible even if the 'allowsuperpage' command line option is not used.

Malicious PV guest administrators can escalate privilege so as to control the whole system.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86: rate-limit logging in do_xen[oprof,pmu]_op Some of     the sub-ops are acessible to all guests, and hence     should be rate-limited. In the xenoprof case, just like     for XSA-146, include them only in debug builds. Since     the vPMU code is rather new, allow them to be always     present, but downgrade them to (rate limited) guest     messages. This is XSA-152. (CVE-2015-7971)

  - xenoprof: free domain's vcpu array This was overlooked     in fb442e2171 ('x86_64: allow more vCPU-s per guest').
    This is XSA-151. (CVE-2015-7969)

  - x86: guard against undue super page PTE creation When     optional super page support got added (commit bd1cd81d64     'x86: PV support for hugepages'), two adjustments were     missed: mod_l2_entry needs to consider the PSE and RW     bits when deciding whether to use the fast path, and the     PSE bit must not be removed from L2_DISALLOW_MASK     unconditionally. This is XSA-148.

    [backport to Xen 4.1] (CVE-2015-7835)

xen was updated to version 4.4.3 to fix nine security issues.

These security issues were fixed :

  - CVE-2015-4037: The slirp_smb function in net/slirp.c     created temporary files with predictable names, which     allowed local users to cause a denial of service     (instantiation failure) by creating /tmp/qemu-smb.*-*     files before the program (bsc#932267).

  - CVE-2014-0222: Integer overflow in the qcow_open     function allowed remote attackers to cause a denial of     service (crash) via a large L2 table in a QCOW version 1     image (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7311: libxl in Xen did not properly handle the     readonly flag on disks when using the qemu-xen device     model, which allowed local guest users to write to a     read-only disk image (bsc#947165).

  - CVE-2015-5239: Integer overflow in vnc_client_read() and     protocol_client_msg() (bsc#944463).

  - CVE-2015-6815: With e1000 NIC emulation support it was     possible to enter an infinite loop (bsc#944697).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array leading to denial of service (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling- related     vcpu pointer array leading to denial of service     (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xen was updated to fix nine security issues.

These security issues were fixed :

  - CVE-2015-4037: The slirp_smb function in net/slirp.c     created temporary files with predictable names, which     allowed local users to cause a denial of service     (instantiation failure) by creating /tmp/qemu-smb.*-*     files before the program (bsc#932267).

  - CVE-2014-0222: Integer overflow in the qcow_open     function allowed remote attackers to cause a denial of     service (crash) via a large L2 table in a QCOW version 1     image (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7311: libxl in Xen did not properly handle the     readonly flag on disks when using the qemu-xen device     model, which allowed local guest users to write to a     read-only disk image (bsc#947165).

  - CVE-2015-5239: Integer overflow in vnc_client_read() and     protocol_client_msg() (bsc#944463).

  - CVE-2015-6815: With e1000 NIC emulation support it was     possible to enter an infinite loop (bsc#944697).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array leading to denial of service (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling- related     vcpu pointer array leading to denial of service     (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the code to validate level 2 page table entries is bypassed when certain conditions are satisfied. A malicious PV guest administrator can take advantage of this flaw to gain privileges via a crafted superpage mapping.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0142 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86: rate-limit logging in do_xen[oprof,pmu]_op Some of     the sub-ops are acessible to all guests, and hence     should be rate-limited. In the xenoprof case, just like     for XSA-146, include them only in debug builds. Since     the vPMU code is rather new, allow them to be always     present, but downgrade them to (rate limited) guest     messages. This is XSA-152. (CVE-2015-7971)

  - xenoprof: free domain's vcpu array This was overlooked     in fb442e2171 ('x86_64: allow more vCPU-s per guest').
    This is XSA-151. (CVE-2015-7969)

  - x86: guard against undue super page PTE creation When     optional super page support got added (commit bd1cd81d64     'x86: PV support for hugepages'), two adjustments were     missed: mod_l2_entry needs to consider the PSE and RW     bits when deciding whether to use the fast path, and the     PSE bit must not be removed from L2_DISALLOW_MASK     unconditionally. This is XSA-148. (CVE-2015-7835)

ID	Name	Product	Family	Severity
140019	OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
111992	OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
91756	OracleVM 3.2 : xen (OVMSA-2016-0081)	Nessus	OracleVM Local Security Checks	high
90380	GLSA-201604-03 : Xen: Multiple vulnerabilities (Venom)	Nessus	Gentoo Local Security Checks	critical
89359	Fedora 23 : xen-4.5.1-14.fc23 (2015-a931b02be2)	Nessus	Fedora Local Security Checks	high
89278	Fedora 22 : xen-4.5.1-14.fc22 (2015-6f6b79efe2)	Nessus	Fedora Local Security Checks	high
89177	Fedora 21 : xen-4.4.3-7.fc21 (2015-242be2c240)	Nessus	Fedora Local Security Checks	high
87650	SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:2338-1)	Nessus	SuSE Local Security Checks	high
87591	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:2328-1)	Nessus	SuSE Local Security Checks	high
87588	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:2324-1)	Nessus	SuSE Local Security Checks	high
87443	openSUSE Security Update : xen (openSUSE-2015-893)	Nessus	SuSE Local Security Checks	high
87393	openSUSE Security Update : xen (openSUSE-2015-892)	Nessus	SuSE Local Security Checks	medium
87273	OracleVM 2.2 : xen (OVMSA-2015-0151)	Nessus	OracleVM Local Security Checks	high
86961	openSUSE Security Update : xen (openSUSE-2015-730)	Nessus	SuSE Local Security Checks	high
86909	openSUSE Security Update : xen (openSUSE-2015-750)	Nessus	SuSE Local Security Checks	medium
86865	SUSE SLES11 Security Update : xen (SUSE-SU-2015:1952-1)	Nessus	SuSE Local Security Checks	medium
86863	openSUSE Security Update : xen (openSUSE-2015-729)	Nessus	SuSE Local Security Checks	medium
86836	FreeBSD : xen-kernel -- Uncontrolled creation of large page mappings by PV guests (3d9f6260-881d-11e5-ab94-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
86802	OracleVM 3.2 : xen (OVMSA-2015-0143)	Nessus	OracleVM Local Security Checks	high
86756	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:1908-1)	Nessus	SuSE Local Security Checks	medium
86753	SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:1894-1)	Nessus	SuSE Local Security Checks	medium
86704	SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:1853-1)	Nessus	SuSE Local Security Checks	medium
86700	Debian DSA-3390-1 : xen - security update	Nessus	Debian Local Security Checks	high
86670	OracleVM 3.2 : xen (OVMSA-2015-0142)	Nessus	OracleVM Local Security Checks	high
86669	OracleVM 3.3 : xen (OVMSA-2015-0141)	Nessus	OracleVM Local Security Checks	high

Detections

Analytics

CVE-2015-7835

high

Tenable Plugins

critical

critical

high

critical

high

high

high

high

high

high

high

medium

high

high

medium

medium

medium

high

high

medium

medium

medium

high

high

high