The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xsa224 xen: grant table operations mishandle reference counts (XSA-224) (CVE-2017-10921)

  - The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or stderr. (CVE-2014-3672)

  - Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary     code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS     set. (CVE-2015-3209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0039 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details.

The remote host is affected by the vulnerability described in GLSA-201611-09 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A malicious guest administrator could escalate their privileges on the       host system or cause a Denial of Service.  Additionally, a malicious       unprivileged guest user may be able to obtain or corrupt sensitive       information (including cryptographic material) in other programs in the       same guest.
  Workaround :

    There is no known workaround at this time.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2016-7094: Buffer overflow in Xen allowed local x86     HVM guest OS administrators on guests running with     shadow paging to cause a denial of service via a     pagetable update (bsc#995792)

  - CVE-2016-7092: The get_page_from_l3e function in     arch/x86/mm.c in Xen allowed local 32-bit PV guest OS     administrators to gain host OS privileges via vectors     related to L3 recursive pagetables (bsc#995785)

  - CVE-2016-5403: Unbounded memory allocation allowed a     guest administrator to cause a denial of service of the     host (bsc#990923)

  - CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c,     when built with ESP/NCR53C9x controller emulation     support, allowed local guest OS administrators to cause     a denial of service (out-of-bounds write and QEMU     process crash) or execute arbitrary code on the host via     vectors involving DMA read into ESP command buffer     (bsc#990843)

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675)

  - CVE-2016-5338: The (1) esp_reg_read and (2)     esp_reg_write functions allowed local guest OS     administrators to cause a denial of service (QEMU     process crash) or execute arbitrary code on the host via     vectors related to the information transfer buffer     (bsc#983984)

  - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c     might have allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via vectors related to reading from the     information transfer buffer in non-DMA mode (bsc#982960)

  - CVE-2016-4453: The vmsvga_fifo_run function allowed     local guest OS administrators to cause a denial of     service (infinite loop and QEMU process crash) via a VGA     command (bsc#982225)

  - CVE-2016-4454: The vmsvga_fifo_read_raw function allowed     local guest OS administrators to obtain sensitive host     memory information or cause a denial of service (QEMU     process crash) by changing FIFO registers and issuing a     VGA command, which triggered an out-of-bounds read     (bsc#982224)

  - CVE-2014-3672: The qemu implementation in libvirt Xen     allowed local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or     stderr (bsc#981264)

  - CVE-2016-4441: The get_cmd function in the 53C9X Fast     SCSI Controller (FSC) support did not properly check DMA     length, which allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via unspecified vectors, involving an     SCSI command (bsc#980724)

  - CVE-2016-4439: The esp_reg_write function in the 53C9X     Fast SCSI Controller (FSC) support did not properly     check command buffer length, which allowed local guest     OS administrators to cause a denial of service     (out-of-bounds write and QEMU process crash) or     potentially execute arbitrary code on the host via     unspecified vectors (bsc#980716)

  - CVE-2016-3710: The VGA module improperly performed     bounds checking on banked access to video memory, which     allowed local guest OS administrators to execute     arbitrary code on the host by changing access modes     after setting the bank register, aka the 'Dark Portal'     issue (bsc#978164)

  - CVE-2016-4480: The guest_walk_tables function in     arch/x86/mm/guest_walk.c in Xen did not properly handle     the Page Size (PS) page table entry bit at the L4 and L3     page table levels, which might have allowed local guest     OS users to gain privileges via a crafted mapping of     memory (bsc#978295)

  - CVE-2016-3960: Integer overflow in the x86 shadow     pagetable code allowed local guest OS users to cause a     denial of service (host crash) or possibly gain     privileges by shadowing a superpage mapping (bsc#974038)

  - CVE-2016-3158: The xrstor function did not properly     handle writes to the hardware FSW.ES bit when running on     AMD64 processors, which allowed local guest OS users to     obtain sensitive register content information from     another guest by leveraging pending exception and mask     bits (bsc#973188)

  - CVE-2016-4001: Buffer overflow in the     stellaris_enet_receive function, when the Stellaris     ethernet controller is configured to accept large     packets, allowed remote attackers to cause a denial of     service (QEMU crash) via a large packet (bsc#975130)

  - CVE-2016-4002: Buffer overflow in the mipsnet_receive     function, when the guest NIC is configured to accept     large packets, allowed remote attackers to cause a     denial of service (memory corruption and QEMU crash) or     possibly execute arbitrary code via a packet larger than     1514 bytes (bsc#975138)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2014-3672: The qemu implementation in libvirt Xen     allowed local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or     stderr (bsc#981264).

  - CVE-2016-3158: The xrstor function did not properly     handle writes to the hardware FSW.ES bit when running on     AMD64 processors, which allowed local guest OS users to     obtain sensitive register content information from     another guest by leveraging pending exception and mask     bits (bsc#973188).

  - CVE-2016-3159: The fpu_fxrstor function in     arch/x86/i387.c did not properly handle writes to the     hardware FSW.ES bit when running on AMD64 processors,     which allowed local guest OS users to obtain sensitive     register content information from another guest by     leveraging pending exception and mask bits (bsc#973188).

  - CVE-2016-3710: The VGA module improperly performed     bounds checking on banked access to video memory, which     allowed local guest OS administrators to execute     arbitrary code on the host by changing access modes     after setting the bank register, aka the 'Dark Portal'     issue (bsc#978164)

  - CVE-2016-3960: Integer overflow in the x86 shadow     pagetable code allowed local guest OS users to cause a     denial of service (host crash) or possibly gain     privileges by shadowing a superpage mapping     (bsc#974038).

  - CVE-2016-4001: Buffer overflow in the     stellaris_enet_receive function, when the Stellaris     ethernet controller is configured to accept large     packets, allowed remote attackers to cause a denial of     service (QEMU crash) via a large packet (bsc#975130).

  - CVE-2016-4002: Buffer overflow in the mipsnet_receive     function, when the guest NIC is configured to accept     large packets, allowed remote attackers to cause a     denial of service (memory corruption and QEMU crash) or     possibly execute arbitrary code via a packet larger than     1514 bytes (bsc#975138).

  - CVE-2016-4020: The patch_instruction function did not     initialize the imm32 variable, which allowed local guest     OS administrators to obtain sensitive information from     host stack memory by accessing the Task Priority     Register (TPR) (bsc#975907)

  - CVE-2016-4037: The ehci_advance_state function in     hw/usb/hcd-ehci.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) via a circular split isochronous transfer     descriptor (siTD) list (bsc#976111)

  - CVE-2016-4439: The esp_reg_write function in the 53C9X     Fast SCSI Controller (FSC) support did not properly     check command buffer length, which allowed local guest     OS administrators to cause a denial of service     (out-of-bounds write and QEMU process crash) or     potentially execute arbitrary code on the host via     unspecified vectors (bsc#980716)

  - CVE-2016-4441: The get_cmd function in the 53C9X Fast     SCSI Controller (FSC) support did not properly check DMA     length, which allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via unspecified vectors, involving an     SCSI command (bsc#980724)

  - CVE-2016-4453: The vmsvga_fifo_run function allowed     local guest OS administrators to cause a denial of     service (infinite loop and QEMU process crash) via a VGA     command (bsc#982225)

  - CVE-2016-4454: The vmsvga_fifo_read_raw function allowed     local guest OS administrators to obtain sensitive host     memory information or cause a denial of service (QEMU     process crash) by changing FIFO registers and issuing a     VGA command, which triggered an out-of-bounds read     (bsc#982224)

  - CVE-2016-4480: The guest_walk_tables function in     arch/x86/mm/guest_walk.c in Xen did not properly handle     the Page Size (PS) page table entry bit at the L4 and L3     page table levels, which might have allowed local guest     OS users to gain privileges via a crafted mapping of     memory (bsc#978295).

  - CVE-2016-4952: Out-of-bounds access issue in     pvsci_ring_init_msg/data routines (bsc#981276)

  - CVE-2016-4962: The libxl device-handling allowed local     OS guest administrators to cause a denial of service     (resource consumption or management facility confusion)     or gain host OS privileges by manipulating information     in guest controlled areas of xenstore (bsc#979620)

  - CVE-2016-4963: The libxl device-handling allowed local     guest OS users with access to the driver domain to cause     a denial of service (management tool confusion) by     manipulating information in the backend directories in     xenstore (bsc#979670)

  - CVE-2016-5105: Stack information leakage while reading     configuration (bsc#982024)

  - CVE-2016-5106: Out-of-bounds write while setting     controller properties (bsc#982025)

  - CVE-2016-5107: Out-of-bounds read in     megasas_lookup_frame() function (bsc#982026)

  - CVE-2016-5126: Heap-based buffer overflow in the     iscsi_aio_ioctl function allowed local guest OS users to     cause a denial of service (QEMU process crash) or     possibly execute arbitrary code via a crafted iSCSI     asynchronous I/O ioctl call (bsc#982286)

  - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c     might have allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via vectors related to reading from the     information transfer buffer in non-DMA mode (bsc#982960)

  - CVE-2016-5337: The megasas_ctrl_get_info function     allowed local guest OS administrators to obtain     sensitive host memory information via vectors related to     reading device control information (bsc#983973)

  - CVE-2016-5338: The (1) esp_reg_read and (2)     esp_reg_write functions allowed local guest OS     administrators to cause a denial of service (QEMU     process crash) or execute arbitrary code on the host via     vectors related to the information transfer buffer     (bsc#983984)

  - CVE-2016-5403: virtio: unbounded memory allocation on     host via guest leading to DoS (XSA-184) (bsc#990923)

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675)

  - CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c,     when built with ESP/NCR53C9x controller emulation     support, allowed local guest OS administrators to cause     a denial of service (out-of-bounds write and QEMU     process crash) or execute arbitrary code on the host via     vectors involving DMA read into ESP command buffer     (bsc#990843).

  - CVE-2016-6833: A use-after-free issue in the VMWARE     VMXNET3 NIC device support allowed privileged user     inside guest to crash the Qemu instance resulting in DoS     (bsc#994775).

  - CVE-2016-6834: A infinite loop during packet     fragmentation in the VMWARE VMXNET3 NIC device support     allowed privileged user inside guest to crash the Qemu     instance resulting in DoS (bsc#994421).

  - CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC     device support, causing an OOB read access (bsc#994625).

  - CVE-2016-6836: VMWARE VMXNET3 NIC device allowed     privileged user inside the guest to leak information. It     occured while processing transmit(tx) queue, when it     reaches the end of packet (bsc#994761).

  - CVE-2016-6888: A integer overflow int the VMWARE VMXNET3     NIC device support, during the initialisation of new     packets in the device, could have allowed a privileged     user inside guest to crash the Qemu instance resulting     in DoS (bsc#994772).

  - CVE-2016-7092: The get_page_from_l3e function in     arch/x86/mm.c in Xen allowed local 32-bit PV guest OS     administrators to gain host OS privileges via vectors     related to L3 recursive pagetables (bsc#995785)

  - CVE-2016-7093: Xen allowed local HVM guest OS     administrators to overwrite hypervisor memory and     consequently gain host OS privileges by leveraging     mishandling of instruction pointer truncation during     emulation (bsc#995789)

  - CVE-2016-7094: Buffer overflow in Xen allowed local x86     HVM guest OS administrators on guests running with     shadow paging to cause a denial of service via a     pagetable update (bsc#995792)

  - CVE-2016-7154: Use-after-free vulnerability in the FIFO     event channel code in Xen allowed local guest OS     administrators to cause a denial of service (host crash)     and possibly execute arbitrary code or obtain sensitive     information via an invalid guest frame number     (bsc#997731).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2016-7094: Buffer overflow in Xen allowed local x86     HVM guest OS administrators on guests running with     shadow paging to cause a denial of service via a     pagetable update (bsc#995792)

  - CVE-2016-7092: The get_page_from_l3e function in     arch/x86/mm.c in Xen allowed local 32-bit PV guest OS     administrators to gain host OS privileges via vectors     related to L3 recursive pagetables (bsc#995785)

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675)

  - CVE-2016-5338: The (1) esp_reg_read and (2)     esp_reg_write functions allowed local guest OS     administrators to cause a denial of service (QEMU     process crash) or execute arbitrary code on the host via     vectors related to the information transfer buffer     (bsc#983984)

  - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c     might have allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via vectors related to reading from the     information transfer buffer in non-DMA mode (bsc#982960)

  - CVE-2014-3672: The qemu implementation in libvirt Xen     allowed local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or     stderr (bsc#981264)

  - CVE-2016-4441: The get_cmd function in the 53C9X Fast     SCSI Controller (FSC) support did not properly check DMA     length, which allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via unspecified vectors, involving an     SCSI command (bsc#980724)

  - CVE-2016-4439: The esp_reg_write function in the 53C9X     Fast SCSI Controller (FSC) support did not properly     check command buffer length, which allowed local guest     OS administrators to cause a denial of service     (out-of-bounds write and QEMU process crash) or     potentially execute arbitrary code on the host via     unspecified vectors (bsc#980716)

  - CVE-2016-3710: The VGA module improperly performed     bounds checking on banked access to video memory, which     allowed local guest OS administrators to execute     arbitrary code on the host by changing access modes     after setting the bank register, aka the 'Dark Portal'     issue (bsc#978164)

  - CVE-2016-4480: The guest_walk_tables function in     arch/x86/mm/guest_walk.c in Xen did not properly handle     the Page Size (PS) page table entry bit at the L4 and L3     page table levels, which might have allowed local guest     OS users to gain privileges via a crafted mapping of     memory (bsc#978295)

  - CVE-2016-3960: Integer overflow in the x86 shadow     pagetable code allowed local guest OS users to cause a     denial of service (host crash) or possibly gain     privileges by shadowing a superpage mapping (bsc#974038)

  - CVE-2016-3158: The xrstor function did not properly     handle writes to the hardware FSW.ES bit when running on     AMD64 processors, which allowed local guest OS users to     obtain sensitive register content information from     another guest by leveraging pending exception and mask     bits (bsc#973188)

  - CVE-2016-4001: Buffer overflow in the     stellaris_enet_receive function, when the Stellaris     ethernet controller is configured to accept large     packets, allowed remote attackers to cause a denial of     service (QEMU crash) via a large packet (bsc#975130)

  - CVE-2016-4002: Buffer overflow in the mipsnet_receive     function, when the guest NIC is configured to accept     large packets, allowed remote attackers to cause a     denial of service (memory corruption and QEMU crash) or     possibly execute arbitrary code via a packet larger than     1514 bytes (bsc#975138)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2016-7092: The get_page_from_l3e function in     arch/x86/mm.c in Xen allowed local 32-bit PV guest OS     administrators to gain host OS privileges via vectors     related to L3 recursive pagetables (bsc#995785)

  - CVE-2016-7093: Xen allowed local HVM guest OS     administrators to overwrite hypervisor memory and     consequently gain host OS privileges by leveraging     mishandling of instruction pointer truncation during     emulation (bsc#995789)

  - CVE-2016-7094: Buffer overflow in Xen allowed local x86     HVM guest OS administrators on guests running with     shadow paging to cause a denial of service via a     pagetable update (bsc#995792)

  - CVE-2016-7154: Use-after-free vulnerability in the FIFO     event channel code in Xen allowed local guest OS     administrators to cause a denial of service (host crash)     and possibly execute arbitrary code or obtain sensitive     information via an invalid guest frame number     (bsc#997731)

  - CVE-2016-6836: VMWARE VMXNET3 NIC device allowed     privileged user inside the guest to leak information. It     occured while processing transmit(tx) queue, when it     reaches the end of packet (bsc#994761)

  - CVE-2016-6888: A integer overflow int the VMWARE VMXNET3     NIC device support, during the initialisation of new     packets in the device, could have allowed a privileged     user inside guest to crash the Qemu instance resulting     in DoS (bsc#994772)

  - CVE-2016-6833: A use-after-free issue in the VMWARE     VMXNET3 NIC device support allowed privileged user     inside guest to crash the Qemu instance resulting in DoS     (bsc#994775)

  - CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC     device support, causing an OOB read access (bsc#994625)

  - CVE-2016-6834: A infinite loop during packet     fragmentation in the VMWARE VMXNET3 NIC device support     allowed privileged user inside guest to crash the Qemu     instance resulting in DoS (bsc#994421)

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

These security issues were fixed :

  - CVE-2016-7092: The get_page_from_l3e function in     arch/x86/mm.c in Xen allowed local 32-bit PV guest OS     administrators to gain host OS privileges via vectors     related to L3 recursive pagetables (bsc#995785)

  - CVE-2016-7093: Xen allowed local HVM guest OS     administrators to overwrite hypervisor memory and     consequently gain host OS privileges by leveraging     mishandling of instruction pointer truncation during     emulation (bsc#995789)

  - CVE-2016-7094: Buffer overflow in Xen allowed local x86     HVM guest OS administrators on guests running with     shadow paging to cause a denial of service via a     pagetable update (bsc#995792)

  - CVE-2016-6836: VMWARE VMXNET3 NIC device support was     leaging information leakage. A privileged user inside     guest could have used this to leak host memory bytes to     a guest (boo#994761)

  - CVE-2016-6888: Integer overflow in packet initialisation     in VMXNET3 device driver. A privileged user inside guest     could have used this flaw to crash the Qemu instance     resulting in DoS (bsc#994772)

  - CVE-2016-6833: Use-after-free issue in the VMWARE     VMXNET3 NIC device support. A privileged user inside     guest could have used this issue to crash the Qemu     instance resulting in DoS (boo#994775)

  - CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC     device support, causing an OOB read access (bsc#994625)

  - CVE-2016-6834: A infinite loop during packet     fragmentation in the VMWARE VMXNET3 NIC device support     allowed privileged user inside guest to crash the Qemu     instance resulting in DoS (bsc#994421)

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675)

  - CVE-2016-6259: Xen did not implement Supervisor Mode     Access Prevention (SMAP) whitelisting in 32-bit     exception and event delivery, which allowed local 32-bit     PV guest OS kernels to cause a denial of service     (hypervisor and VM crash) by triggering a safety check     (bsc#988676)

  - CVE-2016-5403: The virtqueue_pop function in     hw/virtio/virtio.c in QEMU allowed local guest OS     administrators to cause a denial of service (memory     consumption and QEMU process crash) by submitting     requests without waiting for completion (boo#990923)

  - CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c,     when built with ESP/NCR53C9x controller emulation     support, allowed local guest OS administrators to cause     a denial of service (out-of-bounds write and QEMU     process crash) or execute arbitrary code on the host via     vectors involving DMA read into ESP command buffer     (bsc#990843)

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675)

  - CVE-2016-6259: Xen did not implement Supervisor Mode     Access Prevention (SMAP) whitelisting in 32-bit     exception and event delivery, which allowed local 32-bit     PV guest OS kernels to cause a denial of service     (hypervisor and VM crash) by triggering a safety check     (bsc#988676)

  - CVE-2016-5337: The megasas_ctrl_get_info function in     hw/scsi/megasas.c in QEMU allowed local guest OS     administrators to obtain sensitive host memory     information via vectors related to reading device     control information (bsc#983973)

  - CVE-2016-5338: The (1) esp_reg_read and (2)     esp_reg_write functions in hw/scsi/esp.c in QEMU allowed     local guest OS administrators to cause a denial of     service (QEMU process crash) or execute arbitrary code     on the QEMU host via vectors related to the information     transfer buffer (bsc#983984)

  - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c in     QEMU allowed local guest OS administrators to cause a     denial of service (out-of-bounds write and QEMU process     crash) via vectors related to reading from the     information transfer buffer in non-DMA mode (bsc#982960)

  - CVE-2016-4453: The vmsvga_fifo_run function in     hw/display/vmware_vga.c in QEMU allowed local guest OS     administrators to cause a denial of service (infinite     loop and QEMU process crash) via a VGA command     (bsc#982225)

  - CVE-2016-4454: The vmsvga_fifo_read_raw function in     hw/display/vmware_vga.c in QEMU allowed local guest OS     administrators to obtain sensitive host memory     information or cause a denial of service (QEMU process     crash) by changing FIFO registers and issuing a VGA     command, which triggers an out-of-bounds read     (bsc#982224)

  - CVE-2016-5126: Heap-based buffer overflow in the     iscsi_aio_ioctl function in block/iscsi.c in QEMU     allowed local guest OS users to cause a denial of     service (QEMU process crash) or possibly execute     arbitrary code via a crafted iSCSI asynchronous I/O     ioctl call (bsc#982286)

  - CVE-2016-5105: The megasas_dcmd_cfg_read function in     hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS     8708EM2 Host Bus Adapter emulation support, used an     uninitialized variable, which allowed local guest     administrators to read host memory via vectors involving     a MegaRAID Firmware Interface (MFI) command (bsc#982024)

  - CVE-2016-5106: The megasas_dcmd_set_properties function     in hw/scsi/megasas.c in QEMU, when built with MegaRAID     SAS 8708EM2 Host Bus Adapter emulation support, allowed     local guest administrators to cause a denial of service     (out-of-bounds write access) via vectors involving a     MegaRAID Firmware Interface (MFI) command (bsc#982025)

  - CVE-2016-5107: The megasas_lookup_frame function in     QEMU, when built with MegaRAID SAS 8708EM2 Host Bus     Adapter emulation support, allowed local guest OS     administrators to cause a denial of service     (out-of-bounds read and crash) via unspecified vectors     (bsc#982026)

  - CVE-2016-4963: The libxl device-handling allowed local     guest OS users with access to the driver domain to cause     a denial of service (management tool confusion) by     manipulating information in the backend directories in     xenstore (bsc#979670)

  - CVE-2016-4962: The libxl device-handling allowed local     OS guest administrators to cause a denial of service     (resource consumption or management facility confusion)     or gain host OS privileges by manipulating information     in guest controlled areas of xenstore (bsc#979620)

  - CVE-2016-4952: Out-of-bounds access issue in     pvsci_ring_init_msg/data routines (bsc#981276)

  - CVE-2016-3710: The VGA module improperly performed     bounds checking on banked access to video memory, which     allowed local guest OS administrators to execute     arbitrary code on the host by changing access modes     after setting the bank register, aka the 'Dark Portal'     issue (bsc#978164)

  - CVE-2014-3672: The qemu implementation in libvirt Xen     allowed local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or     stderr (bsc#981264)

  - CVE-2016-4441: The get_cmd function in the 53C9X Fast     SCSI Controller (FSC) support did not properly check DMA     length, which allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via unspecified vectors, involving an     SCSI command (bsc#980724)

  - CVE-2016-4439: The esp_reg_write function in the 53C9X     Fast SCSI Controller (FSC) support did not properly     check command buffer length, which allowed local guest     OS administrators to cause a denial of service     (out-of-bounds write and QEMU process crash) or     potentially execute arbitrary code on the host via     unspecified vectors (bsc#980716)

  - CVE-2016-3960: Integer overflow in the x86 shadow     pagetable code allowed local guest OS users to cause a     denial of service (host crash) or possibly gain     privileges by shadowing a superpage mapping (bsc#974038)

  - CVE-2016-3158: The xrstor function did not properly     handle writes to the hardware FSW.ES bit when running on     AMD64 processors, which allowed local guest OS users to     obtain sensitive register content information from     another guest by leveraging pending exception and mask     bits (bsc#973188)

  - CVE-2016-3159: The fpu_fxrstor function in     arch/x86/i387.c did not properly handle writes to the     hardware FSW.ES bit when running on AMD64 processors,     which allowed local guest OS users to obtain sensitive     register content information from another guest by     leveraging pending exception and mask bits (bsc#973188)

  - CVE-2016-4037: The ehci_advance_state function in     hw/usb/hcd-ehci.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) via a circular split isochronous transfer     descriptor (siTD) list (bsc#976111)

  - CVE-2016-4020: The patch_instruction function did not     initialize the imm32 variable, which allowed local guest     OS administrators to obtain sensitive information from     host stack memory by accessing the Task Priority     Register (TPR) (bsc#975907)

  - CVE-2016-4001: Buffer overflow in the     stellaris_enet_receive function, when the Stellaris     ethernet controller is configured to accept large     packets, allowed remote attackers to cause a denial of     service (QEMU crash) via a large packet (bsc#975130)

  - CVE-2016-4002: Buffer overflow in the mipsnet_receive     function, when the guest NIC is configured to accept     large packets, allowed remote attackers to cause a     denial of service (memory corruption and QEMU crash) or     possibly execute arbitrary code via a packet larger than     1514 bytes (bsc#975138)

  - CVE-2016-4480: The guest_walk_tables function in     arch/x86/mm/guest_walk.c in Xen did not properly handle     the Page Size (PS) page table entry bit at the L4 and L3     page table levels, which might have allowed local guest     OS users to gain privileges via a crafted mapping of     memory (bsc#978295)

These non-security issues were fixed :

  - boo#991934: xen hypervisor crash in csched_acct

  - boo#992224: During boot of Xen Hypervisor, Failed to get     contiguous memory for DMA from Xen

  - boo#955104: Virsh reports error 'one or more references     were leaked after disconnect from hypervisor' when     'virsh save' failed due to 'no response from client     after 6 keepalive messages'

  - boo#959552: Migration of HVM guest leads into libvirt     segmentation fault

  - boo#993665: Migration of xen guests finishes in: One or     more references were leaked after disconnect from the     hypervisor

  - boo#959330: Guest migrations using virsh results in     error 'Internal error: received hangup / error event on     socket'

  - boo#990500: VM virsh migration fails with keepalive     error: ':virKeepAliveTimerInternal:143 : No response     from client'

  - boo#953518: Unplug also SCSI disks in     qemu-xen-traditional for upstream unplug protocol

  - boo#953518: xen_platform: unplug also SCSI disks in     qemu-xen

  - boo#971949: Support (by ignoring) xl migrate --live. xl     migrations are always live 

  - boo#970135: New virtualization project clock test     randomly fails on Xen

  - boo#990970: Add PMU support for Intel E7-8867 v4 (fam=6,     model=79)

  - boo#985503: vif-route broken

  - boo#961100: Migrate a fv guest from sles12 to sles12sp1     fails remove patch because it can not fix the bug

  - boo#978413: PV guest upgrade from sles11sp4 to sles12sp2     alpha3 failed on sles11sp4 xen host.

  - boo#986586: Out of memory (oom) during boot on 'modprobe     xenblk' (non xen kernel) init.50-hvm-xen_conf

  - boo#900418: Dump cannot be performed on SLES12 XEN

  - boo#953339, boo#953362, boo#953518, boo#984981:
    Implement SUSE specific unplug protocol for emulated PCI     devices in PVonHVM guests to qemu-xen-upstream 

  - boo#954872: script block-dmmd not working as expected -     libxl: error: libxl_dm.c (Additional fixes) block-dmmd

  - boo#982695: xen-4.5.2 qemu fails to boot HVM guest from     xvda 

  - boo#958848: HVM guest crash at /usr/src/packages/BUILD/     xen-4.4.2-testing/obj/default/balloon/balloon.c:407

  - boo#949889: Fail to install 32-bit paravirt VM under     SLES12SP1Beta3 XEN

  - boo#954872: script block-dmmd not working as expected -     libxl: error: libxl_dm.c (another modification)     block-dmmd

  - boo#961600: Poor performance when Xen HVM domU     configured with max memory greater than current memory

  - boo#963161: Windows VM getting stuck during load while a     VF is assigned to it after upgrading to latest     maintenance updates

  - boo#976058: Xen error running simple HVM guest (Post     Alpha 2 xen+qemu)

  - boo#961100: Migrate a fv guest from sles12 to sles12sp1     on xen fails for 'Domain is not running on destination     host'. qemu-ignore-kvm-tpr-opt-on-migration.patch 

  - boo#973631: AWS EC2 kdump issue

  - boo#964427: Discarding device blocks: failed -     Input/output error

This update for xen fixes the following issues :

These security issues were fixed :

  - CVE-2016-7092: The get_page_from_l3e function in     arch/x86/mm.c in Xen allowed local 32-bit PV guest OS     administrators to gain host OS privileges via vectors     related to L3 recursive pagetables (bsc#995785)

  - CVE-2016-7093: Xen allowed local HVM guest OS     administrators to overwrite hypervisor memory and     consequently gain host OS privileges by leveraging     mishandling of instruction pointer truncation during     emulation (bsc#995789)

  - CVE-2016-7094: Buffer overflow in Xen allowed local x86     HVM guest OS administrators on guests running with     shadow paging to cause a denial of service via a     pagetable update (bsc#995792)

  - CVE-2016-7154: Use-after-free vulnerability in the FIFO     event channel code in Xen allowed local guest OS     administrators to cause a denial of service (host crash)     and possibly execute arbitrary code or obtain sensitive     information via an invalid guest frame number     (bsc#997731)

  - CVE-2016-6836: VMWARE VMXNET3 NIC device support was     leaging information leakage. A privileged user inside     guest could have used this to leak host memory bytes to     a guest (boo#994761)

  - CVE-2016-6888: Integer overflow in packet initialisation     in VMXNET3 device driver. A privileged user inside guest     could have used this flaw to crash the Qemu instance     resulting in DoS (bsc#994772)

  - CVE-2016-6833: Use-after-free issue in the VMWARE     VMXNET3 NIC device support. A privileged user inside     guest could have used this issue to crash the Qemu     instance resulting in DoS (boo#994775)

  - CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC     device support, causing an OOB read access (bsc#994625)

  - CVE-2016-6834: A infinite loop during packet     fragmentation in the VMWARE VMXNET3 NIC device support     allowed privileged user inside guest to crash the Qemu     instance resulting in DoS (bsc#994421)

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675)

  - CVE-2016-5403: The virtqueue_pop function in     hw/virtio/virtio.c in QEMU allowed local guest OS     administrators to cause a denial of service (memory     consumption and QEMU process crash) by submitting     requests without waiting for completion (boo#990923)

  - CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c,     when built with ESP/NCR53C9x controller emulation     support, allowed local guest OS administrators to cause     a denial of service (out-of-bounds write and QEMU     process crash) or execute arbitrary code on the host via     vectors involving DMA read into ESP command buffer     (bsc#990843)

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675)

  - CVE-2016-5337: The megasas_ctrl_get_info function in     hw/scsi/megasas.c in QEMU allowed local guest OS     administrators to obtain sensitive host memory     information via vectors related to reading device     control information (bsc#983973)

  - CVE-2016-5338: The (1) esp_reg_read and (2)     esp_reg_write functions in hw/scsi/esp.c in QEMU allowed     local guest OS administrators to cause a denial of     service (QEMU process crash) or execute arbitrary code     on the QEMU host via vectors related to the information     transfer buffer (bsc#983984)

  - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c in     QEMU allowed local guest OS administrators to cause a     denial of service (out-of-bounds write and QEMU process     crash) via vectors related to reading from the     information transfer buffer in non-DMA mode (bsc#982960)

  - CVE-2016-4453: The vmsvga_fifo_run function in     hw/display/vmware_vga.c in QEMU allowed local guest OS     administrators to cause a denial of service (infinite     loop and QEMU process crash) via a VGA command     (bsc#982225)

  - CVE-2016-4454: The vmsvga_fifo_read_raw function in     hw/display/vmware_vga.c in QEMU allowed local guest OS     administrators to obtain sensitive host memory     information or cause a denial of service (QEMU process     crash) by changing FIFO registers and issuing a VGA     command, which triggers an out-of-bounds read     (bsc#982224)

  - CVE-2016-5126: Heap-based buffer overflow in the     iscsi_aio_ioctl function in block/iscsi.c in QEMU     allowed local guest OS users to cause a denial of     service (QEMU process crash) or possibly execute     arbitrary code via a crafted iSCSI asynchronous I/O     ioctl call (bsc#982286)

  - CVE-2016-5105: The megasas_dcmd_cfg_read function in     hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS     8708EM2 Host Bus Adapter emulation support, used an     uninitialized variable, which allowed local guest     administrators to read host memory via vectors involving     a MegaRAID Firmware Interface (MFI) command (bsc#982024)

  - CVE-2016-5106: The megasas_dcmd_set_properties function     in hw/scsi/megasas.c in QEMU, when built with MegaRAID     SAS 8708EM2 Host Bus Adapter emulation support, allowed     local guest administrators to cause a denial of service     (out-of-bounds write access) via vectors involving a     MegaRAID Firmware Interface (MFI) command (bsc#982025)

  - CVE-2016-5107: The megasas_lookup_frame function in     QEMU, when built with MegaRAID SAS 8708EM2 Host Bus     Adapter emulation support, allowed local guest OS     administrators to cause a denial of service     (out-of-bounds read and crash) via unspecified vectors     (bsc#982026)

  - CVE-2016-4963: The libxl device-handling allowed local     guest OS users with access to the driver domain to cause     a denial of service (management tool confusion) by     manipulating information in the backend directories in     xenstore (bsc#979670)

  - CVE-2016-4962: The libxl device-handling allowed local     OS guest administrators to cause a denial of service     (resource consumption or management facility confusion)     or gain host OS privileges by manipulating information     in guest controlled areas of xenstore (bsc#979620)

  - CVE-2016-4952: Out-of-bounds access issue in     pvsci_ring_init_msg/data routines (bsc#981276)

  - CVE-2014-3672: The qemu implementation in libvirt Xen     allowed local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or     stderr (bsc#981264)

  - CVE-2016-4441: The get_cmd function in the 53C9X Fast     SCSI Controller (FSC) support did not properly check DMA     length, which allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via unspecified vectors, involving an     SCSI command (bsc#980724)

  - CVE-2016-4439: The esp_reg_write function in the 53C9X     Fast SCSI Controller (FSC) support did not properly     check command buffer length, which allowed local guest     OS administrators to cause a denial of service     (out-of-bounds write and QEMU process crash) or     potentially execute arbitrary code on the host via     unspecified vectors (bsc#980716)

  - CVE-2016-3710: The VGA module improperly performed     bounds checking on banked access to video memory, which     allowed local guest OS administrators to execute     arbitrary code on the host by changing access modes     after setting the bank register, aka the 'Dark Portal'     issue (bsc#978164)

  - CVE-2016-3960: Integer overflow in the x86 shadow     pagetable code allowed local guest OS users to cause a     denial of service (host crash) or possibly gain     privileges by shadowing a superpage mapping (bsc#974038)

  - CVE-2016-4037: The ehci_advance_state function in     hw/usb/hcd-ehci.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) via a circular split isochronous transfer     descriptor (siTD) list (bsc#976111)

  - CVE-2016-4020: The patch_instruction function did not     initialize the imm32 variable, which allowed local guest     OS administrators to obtain sensitive information from     host stack memory by accessing the Task Priority     Register (TPR) (bsc#975907)

  - CVE-2016-4001: Buffer overflow in the     stellaris_enet_receive function, when the Stellaris     ethernet controller is configured to accept large     packets, allowed remote attackers to cause a denial of     service (QEMU crash) via a large packet (bsc#975130)

  - CVE-2016-4002: Buffer overflow in the mipsnet_receive     function, when the guest NIC is configured to accept     large packets, allowed remote attackers to cause a     denial of service (memory corruption and QEMU crash) or     possibly execute arbitrary code via a packet larger than     1514 bytes (bsc#975138)

  - CVE-2016-3158: The xrstor function did not properly     handle writes to the hardware FSW.ES bit when running on     AMD64 processors, which allowed local guest OS users to     obtain sensitive register content information from     another guest by leveraging pending exception and mask     bits (bsc#973188)

  - CVE-2016-3159: The fpu_fxrstor function in     arch/x86/i387.c did not properly handle writes to the     hardware FSW.ES bit when running on AMD64 processors,     which allowed local guest OS users to obtain sensitive     register content information from another guest by     leveraging pending exception and mask bits (bsc#973188)

  - CVE-2016-4480: The guest_walk_tables function in     arch/x86/mm/guest_walk.c in Xen did not properly handle     the Page Size (PS) page table entry bit at the L4 and L3     page table levels, which might have allowed local guest     OS users to gain privileges via a crafted mapping of     memory (bsc#978295)

These non-security issues were fixed :

  - boo#991934: xen hypervisor crash in csched_acct 

  - boo#992224: [HPS Bug] During boot of Xen Hypervisor,     Failed to get contiguous memory for DMA from Xen 

  - boo#970135: new virtualization project clock test     randomly fails on Xen 

  - boo#971949 xl: Support (by ignoring) xl migrate --live.
    xl migrations are always live 

  - boo#990970: Add PMU support for Intel E7-8867 v4 (fam=6,     model=79) 

  - boo#985503: vif-route broken 

  - boo#978413: PV guest upgrade from sles11sp4 to sles12sp2     alpha3 failed on sles11sp4 xen host

  - boo#986586: out of memory (oom) during boot on 'modprobe     xenblk' (non xen kernel) 

  - boo#953339, boo#953362, boo#953518, boo#984981)     boo#953339, boo#953362, boo#953518, boo#984981:
    Implement SUSE specific unplug protocol for emulated PCI     devices in PVonHVM guests to qemu-xen-upstream 

  - boo#958848: HVM guest crash at /usr/src/packages/BUILD/     xen-4.4.2-testing/obj/default/balloon/balloon.c:407 

  - boo#982695: xen-4.5.2 qemu fails to boot HVM guest from     xvda 

  - boo#954872: script block-dmmd not working as expected 

  - boo#961600: L3: poor performance when Xen HVM domU     configured with max memory greater than current memory 

  - boo#979035: restore xm migrate fixes for boo#955399/     boo#955399 

  - boo#963161: Windows VM getting stuck during load while a     VF is assigned to it after upgrading to latest     maintenance updates boo#963161

  - boo#976058: Xen error running simple HVM guest (Post     Alpha 2 xen+qemu) 

  - boo#973631: AWS EC2 kdump issue 

  - boo#961100: Migrate a fv guest from sles12 to sles12sp1     on xen fails for 'Domain is not running on destination     host'. 

  - boo#964427: Discarding device blocks: failed -     Input/output error

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2016-7092: The get_page_from_l3e function in     arch/x86/mm.c in Xen allowed local 32-bit PV guest OS     administrators to gain host OS privileges via vectors     related to L3 recursive pagetables (bsc#995785).

  - CVE-2016-7093: Xen allowed local HVM guest OS     administrators to overwrite hypervisor memory and     consequently gain host OS privileges by leveraging     mishandling of instruction pointer truncation during     emulation (bsc#995789).

  - CVE-2016-7094: Buffer overflow in Xen allowed local x86     HVM guest OS administrators on guests running with     shadow paging to cause a denial of service via a     pagetable update (bsc#995792).

  - CVE-2016-6836: Information leakage in     vmxnet3_complete_packet (bsc#994761).

  - CVE-2016-6888: Integer overflow in packet initialisation     in VMXNET3 device driver. Aprivileged user inside guest     c... (bsc#994772).

  - CVE-2016-6833: Use after free while writing     (bsc#994775).

  - CVE-2016-6835: Buffer overflow in     vmxnet_tx_pkt_parse_headers() in vmxnet3     deviceemulation. (bsc#994625).

  - CVE-2016-6834: An infinite loop during packet     fragmentation (bsc#994421).

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675).

  - CVE-2016-6259: Xen did not implement Supervisor Mode     Access Prevention (SMAP) whitelisting in 32-bit     exception and event delivery, which allowed local 32-bit     PV guest OS kernels to cause a denial of service     (hypervisor and VM crash) by triggering a safety check     (bsc#988676).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the several issues. These security issues were fixed :

  - CVE-2014-3672: The qemu implementation in libvirt Xen     allowed local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or     stderr (bsc#981264).

  - CVE-2016-3158: The xrstor function did not properly     handle writes to the hardware FSW.ES bit when running on     AMD64 processors, which allowed local guest OS users to     obtain sensitive register content information from     another guest by leveraging pending exception and mask     bits (bsc#973188).

  - CVE-2016-3159: The fpu_fxrstor function in     arch/x86/i387.c did not properly handle writes to the     hardware FSW.ES bit when running on AMD64 processors,     which allowed local guest OS users to obtain sensitive     register content information from another guest by     leveraging pending exception and mask bits (bsc#973188).

  - CVE-2016-3710: The VGA module improperly performed     bounds checking on banked access to video memory, which     allowed local guest OS administrators to execute     arbitrary code on the host by changing access modes     after setting the bank register, aka the 'Dark Portal'     issue (bsc#978164).

  - CVE-2016-3960: Integer overflow in the x86 shadow     pagetable code allowed local guest OS users to cause a     denial of service (host crash) or possibly gain     privileges by shadowing a superpage mapping     (bsc#974038).

  - CVE-2016-4001: Buffer overflow in the     stellaris_enet_receive function, when the Stellaris     ethernet controller is configured to accept large     packets, allowed remote attackers to cause a denial of     service (QEMU crash) via a large packet (bsc#975130).

  - CVE-2016-4002: Buffer overflow in the mipsnet_receive     function, when the guest NIC is configured to accept     large packets, allowed remote attackers to cause a     denial of service (memory corruption and QEMU crash) or     possibly execute arbitrary code via a packet larger than     1514 bytes (bsc#975138).

  - CVE-2016-4020: The patch_instruction function did not     initialize the imm32 variable, which allowed local guest     OS administrators to obtain sensitive information from     host stack memory by accessing the Task Priority     Register (TPR) (bsc#975907).

  - CVE-2016-4037: The ehci_advance_state function in     hw/usb/hcd-ehci.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) via a circular split isochronous transfer     descriptor (siTD) list (bsc#976111).

  - CVE-2016-4439: The esp_reg_write function in the 53C9X     Fast SCSI Controller (FSC) support did not properly     check command buffer length, which allowed local guest     OS administrators to cause a denial of service     (out-of-bounds write and QEMU process crash) or     potentially execute arbitrary code on the host via     unspecified vectors (bsc#980716).

  - CVE-2016-4441: The get_cmd function in the 53C9X Fast     SCSI Controller (FSC) support did not properly check DMA     length, which allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via unspecified vectors, involving an     SCSI command (bsc#980724).

  - CVE-2016-4453: The vmsvga_fifo_run function allowed     local guest OS administrators to cause a denial of     service (infinite loop and QEMU process crash) via a VGA     command (bsc#982225).

  - CVE-2016-4454: The vmsvga_fifo_read_raw function allowed     local guest OS administrators to obtain sensitive host     memory information or cause a denial of service (QEMU     process crash) by changing FIFO registers and issuing a     VGA command, which triggered an out-of-bounds read     (bsc#982224).

  - CVE-2016-4952: Out-of-bounds access issue in     pvsci_ring_init_msg/data routines (bsc#981276).

  - CVE-2016-4962: The libxl device-handling allowed local     OS guest administrators to cause a denial of service     (resource consumption or management facility confusion)     or gain host OS privileges by manipulating information     in guest controlled areas of xenstore (bsc#979620).

  - CVE-2016-4963: The libxl device-handling allowed local     guest OS users with access to the driver domain to cause     a denial of service (management tool confusion) by     manipulating information in the backend directories in     xenstore (bsc#979670).

  - CVE-2016-5105: Stack information leakage while reading     configuration (bsc#982024).

  - CVE-2016-5106: Out-of-bounds write while setting     controller properties (bsc#982025).

  - CVE-2016-5107: Out-of-bounds read in     megasas_lookup_frame() function (bsc#982026).

  - CVE-2016-5126: Heap-based buffer overflow in the     iscsi_aio_ioctl function allowed local guest OS users to     cause a denial of service (QEMU process crash) or     possibly execute arbitrary code via a crafted iSCSI     asynchronous I/O ioctl call (bsc#982286).

  - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c     might have allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via vectors related to reading from the     information transfer buffer in non-DMA mode     (bsc#982960).

  - CVE-2016-5337: The megasas_ctrl_get_info function     allowed local guest OS administrators to obtain     sensitive host memory information via vectors related to     reading device control information (bsc#983973).

  - CVE-2016-5338: The (1) esp_reg_read and (2)     esp_reg_write functions allowed local guest OS     administrators to cause a denial of service (QEMU     process crash) or execute arbitrary code on the host via     vectors related to the information transfer buffer     (bsc#983984).

  - CVE-2016-6258: Potential privilege escalation in PV     guests (XSA-182) (bsc#988675).

  - bsc#978295: x86 software guest page walk PS bit handling     flaw (XSA-176)

  - CVE-2016-5403: virtio: unbounded memory allocation on     host via guest leading to DoS (XSA-184) (bsc#990923)

  - CVE-2016-6351: scsi: esp: OOB write access in esp_do_dma     (bsc#990843)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.5.3 fixes the several issues. These security issues were fixed :

  - CVE-2016-6258: Potential privilege escalation in PV     guests (XSA-182) (bsc#988675).

  - CVE-2016-6259: Missing SMAP whitelisting in 32-bit     exception / event delivery (XSA-183) (bsc#988676).

  - CVE-2016-5337: The megasas_ctrl_get_info function     allowed local guest OS administrators to obtain     sensitive host memory information via vectors related to     reading device control information (bsc#983973).

  - CVE-2016-5338: The (1) esp_reg_read and (2)     esp_reg_write functions allowed local guest OS     administrators to cause a denial of service (QEMU     process crash) or execute arbitrary code on the host via     vectors related to the information transfer buffer     (bsc#983984).

  - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c     might have allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via vectors related to reading from the     information transfer buffer in non-DMA mode     (bsc#982960).

  - CVE-2016-4453: The vmsvga_fifo_run function allowed     local guest OS administrators to cause a denial of     service (infinite loop and QEMU process crash) via a VGA     command (bsc#982225).

  - CVE-2016-4454: The vmsvga_fifo_read_raw function allowed     local guest OS administrators to obtain sensitive host     memory information or cause a denial of service (QEMU     process crash) by changing FIFO registers and issuing a     VGA command, which triggered an out-of-bounds read     (bsc#982224).

  - CVE-2016-5126: Heap-based buffer overflow in the     iscsi_aio_ioctl function allowed local guest OS users to     cause a denial of service (QEMU process crash) or     possibly execute arbitrary code via a crafted iSCSI     asynchronous I/O ioctl call (bsc#982286).

  - CVE-2016-5105: Stack information leakage while reading     configuration (bsc#982024).

  - CVE-2016-5106: Out-of-bounds write while setting     controller properties (bsc#982025).

  - CVE-2016-5107: Out-of-bounds read in     megasas_lookup_frame() function (bsc#982026).

  - CVE-2016-4963: The libxl device-handling allowed local     guest OS users with access to the driver domain to cause     a denial of service (management tool confusion) by     manipulating information in the backend directories in     xenstore (bsc#979670).

  - CVE-2016-4962: The libxl device-handling allowed local     OS guest administrators to cause a denial of service     (resource consumption or management facility confusion)     or gain host OS privileges by manipulating information     in guest controlled areas of xenstore (bsc#979620).

  - CVE-2016-4952: Out-of-bounds access issue in     pvsci_ring_init_msg/data routines (bsc#981276).

  - CVE-2014-3672: The qemu implementation in libvirt Xen     allowed local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or     stderr (bsc#981264).

  - CVE-2016-4441: The get_cmd function in the 53C9X Fast     SCSI Controller (FSC) support did not properly check DMA     length, which allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via unspecified vectors, involving an     SCSI command (bsc#980724).

  - CVE-2016-4439: The esp_reg_write function in the 53C9X     Fast SCSI Controller (FSC) support did not properly     check command buffer length, which allowed local guest     OS administrators to cause a denial of service     (out-of-bounds write and QEMU process crash) or     potentially execute arbitrary code on the host via     unspecified vectors (bsc#980716).

  - CVE-2016-3710: The VGA module improperly performed     bounds checking on banked access to video memory, which     allowed local guest OS administrators to execute     arbitrary code on the host by changing access modes     after setting the bank register, aka the 'Dark Portal'     issue (bsc#978164).

  - CVE-2016-3960: Integer overflow in the x86 shadow     pagetable code allowed local guest OS users to cause a     denial of service (host crash) or possibly gain     privileges by shadowing a superpage mapping     (bsc#974038).

  - CVE-2016-3159: The fpu_fxrstor function in     arch/x86/i387.c did not properly handle writes to the     hardware FSW.ES bit when running on AMD64 processors,     which allowed local guest OS users to obtain sensitive     register content information from another guest by     leveraging pending exception and mask bits (bsc#973188).

  - CVE-2016-3158: The xrstor function did not properly     handle writes to the hardware FSW.ES bit when running on     AMD64 processors, which allowed local guest OS users to     obtain sensitive register content information from     another guest by leveraging pending exception and mask     bits (bsc#973188).

  - CVE-2016-4037: The ehci_advance_state function in     hw/usb/hcd-ehci.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) via a circular split isochronous transfer     descriptor (siTD) list (bsc#976111).

  - CVE-2016-4020: The patch_instruction function did not     initialize the imm32 variable, which allowed local guest     OS administrators to obtain sensitive information from     host stack memory by accessing the Task Priority     Register (TPR) (bsc#975907).

  - CVE-2016-4001: Buffer overflow in the     stellaris_enet_receive function, when the Stellaris     ethernet controller is configured to accept large     packets, allowed remote attackers to cause a denial of     service (QEMU crash) via a large packet (bsc#975130).

  - CVE-2016-4002: Buffer overflow in the mipsnet_receive     function, when the guest NIC is configured to accept     large packets, allowed remote attackers to cause a     denial of service (memory corruption and QEMU crash) or     possibly execute arbitrary code via a packet larger than     1514 bytes (bsc#975138).

  - bsc#978295: x86 software guest page walk PS bit handling     flaw (XSA-176)

  - CVE-2016-5403: virtio: unbounded memory allocation on     host via guest leading to DoS (XSA-184) (bsc#990923)

  - CVE-2016-6351: scsi: esp: OOB write access in esp_do_dma     (bsc#990843)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

x86: Privilege escalation in PV guests [XSA-182, CVE-2016-6258] x86:
Missing SMAP whitelisting in 32-bit exception / event delivery [XSA-183, CVE-2016-6259] virtio: unbounded memory allocation issue [XSA-184, CVE-2016-5403] Qemu: scsi: esp: OOB write access in esp_do_dma [CVE-2016-6351]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Citrix XenServer running on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities :

  - A privilege escalation vulnerability known as 'Bunker     Buster' exists in the paravirtualization (PV) pagetable     implementation due to incorrect usage of fast-paths for     making updates to pre-existing pagetable entries. An     attacker with administrative privileges on a PV guest     can exploit this vulnerability to gain administrative     privileges on the host operating system. This     vulnerability only affects PV guests on x86 hardware;
    HVM and ARM guests are not affected. (CVE-2016-6258)

  - A denial of service vulnerability exists when handling     32-bit exceptions and event delivery due to missing SMAP     whitelisting. A local guest attacker can exploit this to     trigger a safety check that will crash other virtual     machines on the host system. This vulnerability only     exists on 32-bit PV guests running on x86 hardware that     supports SMAP. (CVE-2016-6259)

According to its self-reported version number, the remote Xen hypervisor is affected by a privilege escalation vulnerability in the paravirtualization (PV) pagetable implementation due to incorrect usage of fast-paths for making updates to pre-existing pagetable entries. An attacker with administrative privileges on a PV guest can exploit this vulnerability to gain administrative privileges on the host operating system. This vulnerability only affects PV guests on x86 hardware; HVM and ARM guests are not affected.

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

The Xen Project reports :

The PV pagetable code has fast-paths for making updates to pre-existing pagetable entries, to skip expensive re-validation in safe cases (e.g. clearing only Access/Dirty bits). The bits considered safe were too broad, and not actually safe.

A malicious PV guest administrator can escalate their privilege to that of the host.

Multiple vulnerabilities have been discovered in the Xen hypervisor.
The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2014-3672 (XSA-180)

Andrew Sorensen discovered that a HVM domain can exhaust the hosts disk space by filling up the log file.

CVE-2016-3158, CVE-2016-3159 (XSA-172)

Jan Beulich from SUSE discovered that Xen does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors. A malicious domain can take advantage of this flaw to obtain address space usage and timing information, about another domain, at a fairly low rate.

CVE-2016-3710 (XSA-179)

Wei Xiao and Qinghao Tang of 360.cn Inc discovered an out-of-bounds read and write flaw in the QEMU VGA module. A privileged guest user could use this flaw to execute arbitrary code on the host with the privileges of the hosting QEMU process.

CVE-2016-3712 (XSA-179)

Zuozhi Fzz of Alibaba Inc discovered potential integer overflow or out-of-bounds read access issues in the QEMU VGA module. A privileged guest user could use this flaw to mount a denial of service (QEMU process crash).

CVE-2016-3960 (XSA-173)

Ling Liu and Yihan Lian of the Cloud Security Team, Qihoo 360 discovered an integer overflow in the x86 shadow pagetable code. A HVM guest using shadow pagetables can cause the host to crash. A PV guest using shadow pagetables (i.e. being migrated) with PV superpages enabled (which is not the default) can crash the host, or corrupt hypervisor memory, potentially leading to privilege escalation.

CVE-2016-4480 (XSA-176)

Jan Beulich discovered that incorrect page table handling could result in privilege escalation inside a Xen guest instance.

CVE-2016-6258 (XSA-182)

J&eacute;r&eacute;mie Boutoille discovered that incorrect pagetable handling in PV instances could result in guest to host privilege escalation.

Additionally this Xen Security Advisory without a CVE was fixed :

XSA-166

Konrad Rzeszutek Wilk and Jan Beulich discovered that ioreq handling is possibly susceptible to a multiple read issue.

For Debian 7 'Wheezy', these problems have been fixed in version 4.1.6.lts1-1.

We recommend that you upgrade your xen packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the Xen hypervisor.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-8338     Julien Grall discovered that Xen on ARM was susceptible     to denial of service via long running memory operations.

  - CVE-2016-4480     Jan Beulich discovered that incorrect page table     handling could result in privilege escalation inside a     Xen guest instance.

  - CVE-2016-4962     Wei Liu discovered multiple cases of missing input     sanitising in libxl which could result in denial of     service.

  - CVE-2016-5242     Aaron Cornelius discovered that incorrect resource     handling on ARM systems could result in denial of     service.

  - CVE-2016-6258     Jeremie Boutoille discovered that incorrect pagetable     handling in PV instances could result in guest to host     privilege escalation.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - BUILDINFO:
    commit=aff08b43b1a504aa14a0fce65302ccf515b69fdf

  - Remove unsafe bits from the mod_l?_entry fastpath     (Andrew Cooper) (CVE-2016-6258)

  - x86/mm: fully honor PS bits in guest page table walks     (Jan Beulich) (CVE-2016-4480) (CVE-2016-4480)

  - libxl: Document ~/serial/ correctly (Ian Jackson)     (CVE-2016-4962)

  - libxl: Cleanup: Have libxl__alloc_vdev use /libxl (Ian     Jackson) (CVE-2016-4962)

  - libxl: Do not trust frontend for nic in getinfo (Ian     Jackson) (CVE-2016-4962)

  - libxl: Do not trust frontend for nic in     libxl_devid_to_device_nic (Ian Jackson) (CVE-2016-4962)

  - libxl: Do not trust frontend for vtpm in getinfo (Ian     Jackson) (CVE-2016-4962)

  - libxl: Do not trust frontend for vtpm list (Ian Jackson)     (CVE-2016-4962)

  - libxl: Do not trust frontend for disk in getinfo (Ian     Jackson) (CVE-2016-4962)

  - libxl: Do not trust frontend for disk eject event (Ian     Jackson) (CVE-2016-4962)

  - libxl: Do not trust frontend in libxl__device_nextid     (Ian Jackson) (CVE-2016-4962)

  - libxl: Do not trust frontend in libxl__devices_destroy     (Ian Jackson) (CVE-2016-4962)

  - libxl: Provide libxl__backendpath_parse_domid (Ian     Jackson) (CVE-2016-4962)

  - libxl: Record backend/frontend paths in /libxl/$DOMID     (Ian Jackson) (CVE-2016-4962)

  - x86: limit GFNs to 32 bits for shadowed superpages. (Tim     Deegan) (CVE-2016-3960)

  - x86: fix information leak on AMD CPUs (Jan Beulich)     (CVE-2016-3158) (CVE-2016-3159) (CVE-2016-3158)     (CVE-2016-3159) (CVE-2016-3158) (CVE-2016-3159)

  - x86: enforce consistent cachability of MMIO mappings     (Jan Beulich) (CVE-2016-2270) (CVE-2016-2270)

ID	Name	Product	Family	Severity
199537	RHEL 5 : xen (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
140019	OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
111992	OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
94893	GLSA-201611-09 : Xen: Multiple vulnerabilities (Bunker Buster)	Nessus	Gentoo Local Security Checks	high
94608	SUSE SLES11 Security Update : xen (SUSE-SU-2016:2725-1) (Bunker Buster)	Nessus	SuSE Local Security Checks	critical
94269	SUSE SLES12 Security Update : xen (SUSE-SU-2016:2533-1) (Bunker Buster)	Nessus	SuSE Local Security Checks	critical
94267	SUSE SLES11 Security Update : xen (SUSE-SU-2016:2528-1) (Bunker Buster)	Nessus	SuSE Local Security Checks	critical
94038	SUSE SLES11 Security Update : xen (SUSE-SU-2016:2507-1) (Bunker Buster)	Nessus	SuSE Local Security Checks	high
94000	openSUSE Security Update : xen (openSUSE-2016-1170) (Bunker Buster)	Nessus	SuSE Local Security Checks	critical
93999	openSUSE Security Update : xen (openSUSE-2016-1169) (Bunker Buster)	Nessus	SuSE Local Security Checks	critical
93935	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:2473-1) (Bunker Buster)	Nessus	SuSE Local Security Checks	high
93298	SUSE SLES11 Security Update : xen (SUSE-SU-2016:2100-1) (Bunker Buster)	Nessus	SuSE Local Security Checks	critical
93296	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:2093-1) (Bunker Buster)	Nessus	SuSE Local Security Checks	critical
92796	Fedora 23 : xen (2016-0049aa6e5d) (Bunker Buster)	Nessus	Fedora Local Security Checks	high
92766	Fedora 24 : xen (2016-01cc766201) (Bunker Buster)	Nessus	Fedora Local Security Checks	high
92723	Citrix XenServer Multiple Vulnerabilities (CTX214954) (Bunker Buster)	Nessus	Misc.	high
92701	Xen Privilege Escalation (XSA-182) (Bunker Buster)	Nessus	Misc.	high
92674	FreeBSD : xen-kernel -- x86: Privilege escalation in PV guests (032aa524-5854-11e6-b334-002590263bf5) (Bunker Buster)	Nessus	FreeBSD Local Security Checks	high
92635	Debian DLA-571-1 : xen security update (Bunker Buster)	Nessus	Debian Local Security Checks	high
92614	Debian DSA-3633-1 : xen - security update (Bunker Buster)	Nessus	Debian Local Security Checks	high
92600	OracleVM 3.4 : xen (OVMSA-2016-0088) (Bunker Buster)	Nessus	OracleVM Local Security Checks	high

Detections

Analytics

CVE-2016-6258

high

Tenable Plugins

critical

critical

critical

high

critical

critical

critical

high

critical

critical

high

critical

critical

high

high

high

high

high

high

high

high