Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xsa224 xen: grant table operations mishandle reference counts (XSA-224) (CVE-2017-10921)

  - The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or stderr. (CVE-2014-3672)

  - Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary     code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS     set. (CVE-2015-3209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for xen fixes the following issues :

These security issues were fixed :

  - CVE-2016-7092: The get_page_from_l3e function in     arch/x86/mm.c in Xen allowed local 32-bit PV guest OS     administrators to gain host OS privileges via vectors     related to L3 recursive pagetables (bsc#995785)

  - CVE-2016-7093: Xen allowed local HVM guest OS     administrators to overwrite hypervisor memory and     consequently gain host OS privileges by leveraging     mishandling of instruction pointer truncation during     emulation (bsc#995789)

  - CVE-2016-7094: Buffer overflow in Xen allowed local x86     HVM guest OS administrators on guests running with     shadow paging to cause a denial of service via a     pagetable update (bsc#995792)

  - CVE-2016-6836: VMWARE VMXNET3 NIC device support was     leaging information leakage. A privileged user inside     guest could have used this to leak host memory bytes to     a guest (boo#994761)

  - CVE-2016-6888: Integer overflow in packet initialisation     in VMXNET3 device driver. A privileged user inside guest     could have used this flaw to crash the Qemu instance     resulting in DoS (bsc#994772)

  - CVE-2016-6833: Use-after-free issue in the VMWARE     VMXNET3 NIC device support. A privileged user inside     guest could have used this issue to crash the Qemu     instance resulting in DoS (boo#994775)

  - CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC     device support, causing an OOB read access (bsc#994625)

  - CVE-2016-6834: A infinite loop during packet     fragmentation in the VMWARE VMXNET3 NIC device support     allowed privileged user inside guest to crash the Qemu     instance resulting in DoS (bsc#994421)

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675)

  - CVE-2016-6259: Xen did not implement Supervisor Mode     Access Prevention (SMAP) whitelisting in 32-bit     exception and event delivery, which allowed local 32-bit     PV guest OS kernels to cause a denial of service     (hypervisor and VM crash) by triggering a safety check     (bsc#988676)

  - CVE-2016-5403: The virtqueue_pop function in     hw/virtio/virtio.c in QEMU allowed local guest OS     administrators to cause a denial of service (memory     consumption and QEMU process crash) by submitting     requests without waiting for completion (boo#990923)

  - CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c,     when built with ESP/NCR53C9x controller emulation     support, allowed local guest OS administrators to cause     a denial of service (out-of-bounds write and QEMU     process crash) or execute arbitrary code on the host via     vectors involving DMA read into ESP command buffer     (bsc#990843)

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675)

  - CVE-2016-6259: Xen did not implement Supervisor Mode     Access Prevention (SMAP) whitelisting in 32-bit     exception and event delivery, which allowed local 32-bit     PV guest OS kernels to cause a denial of service     (hypervisor and VM crash) by triggering a safety check     (bsc#988676)

  - CVE-2016-5337: The megasas_ctrl_get_info function in     hw/scsi/megasas.c in QEMU allowed local guest OS     administrators to obtain sensitive host memory     information via vectors related to reading device     control information (bsc#983973)

  - CVE-2016-5338: The (1) esp_reg_read and (2)     esp_reg_write functions in hw/scsi/esp.c in QEMU allowed     local guest OS administrators to cause a denial of     service (QEMU process crash) or execute arbitrary code     on the QEMU host via vectors related to the information     transfer buffer (bsc#983984)

  - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c in     QEMU allowed local guest OS administrators to cause a     denial of service (out-of-bounds write and QEMU process     crash) via vectors related to reading from the     information transfer buffer in non-DMA mode (bsc#982960)

  - CVE-2016-4453: The vmsvga_fifo_run function in     hw/display/vmware_vga.c in QEMU allowed local guest OS     administrators to cause a denial of service (infinite     loop and QEMU process crash) via a VGA command     (bsc#982225)

  - CVE-2016-4454: The vmsvga_fifo_read_raw function in     hw/display/vmware_vga.c in QEMU allowed local guest OS     administrators to obtain sensitive host memory     information or cause a denial of service (QEMU process     crash) by changing FIFO registers and issuing a VGA     command, which triggers an out-of-bounds read     (bsc#982224)

  - CVE-2016-5126: Heap-based buffer overflow in the     iscsi_aio_ioctl function in block/iscsi.c in QEMU     allowed local guest OS users to cause a denial of     service (QEMU process crash) or possibly execute     arbitrary code via a crafted iSCSI asynchronous I/O     ioctl call (bsc#982286)

  - CVE-2016-5105: The megasas_dcmd_cfg_read function in     hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS     8708EM2 Host Bus Adapter emulation support, used an     uninitialized variable, which allowed local guest     administrators to read host memory via vectors involving     a MegaRAID Firmware Interface (MFI) command (bsc#982024)

  - CVE-2016-5106: The megasas_dcmd_set_properties function     in hw/scsi/megasas.c in QEMU, when built with MegaRAID     SAS 8708EM2 Host Bus Adapter emulation support, allowed     local guest administrators to cause a denial of service     (out-of-bounds write access) via vectors involving a     MegaRAID Firmware Interface (MFI) command (bsc#982025)

  - CVE-2016-5107: The megasas_lookup_frame function in     QEMU, when built with MegaRAID SAS 8708EM2 Host Bus     Adapter emulation support, allowed local guest OS     administrators to cause a denial of service     (out-of-bounds read and crash) via unspecified vectors     (bsc#982026)

  - CVE-2016-4963: The libxl device-handling allowed local     guest OS users with access to the driver domain to cause     a denial of service (management tool confusion) by     manipulating information in the backend directories in     xenstore (bsc#979670)

  - CVE-2016-4962: The libxl device-handling allowed local     OS guest administrators to cause a denial of service     (resource consumption or management facility confusion)     or gain host OS privileges by manipulating information     in guest controlled areas of xenstore (bsc#979620)

  - CVE-2016-4952: Out-of-bounds access issue in     pvsci_ring_init_msg/data routines (bsc#981276)

  - CVE-2016-3710: The VGA module improperly performed     bounds checking on banked access to video memory, which     allowed local guest OS administrators to execute     arbitrary code on the host by changing access modes     after setting the bank register, aka the 'Dark Portal'     issue (bsc#978164)

  - CVE-2014-3672: The qemu implementation in libvirt Xen     allowed local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or     stderr (bsc#981264)

  - CVE-2016-4441: The get_cmd function in the 53C9X Fast     SCSI Controller (FSC) support did not properly check DMA     length, which allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via unspecified vectors, involving an     SCSI command (bsc#980724)

  - CVE-2016-4439: The esp_reg_write function in the 53C9X     Fast SCSI Controller (FSC) support did not properly     check command buffer length, which allowed local guest     OS administrators to cause a denial of service     (out-of-bounds write and QEMU process crash) or     potentially execute arbitrary code on the host via     unspecified vectors (bsc#980716)

  - CVE-2016-3960: Integer overflow in the x86 shadow     pagetable code allowed local guest OS users to cause a     denial of service (host crash) or possibly gain     privileges by shadowing a superpage mapping (bsc#974038)

  - CVE-2016-3158: The xrstor function did not properly     handle writes to the hardware FSW.ES bit when running on     AMD64 processors, which allowed local guest OS users to     obtain sensitive register content information from     another guest by leveraging pending exception and mask     bits (bsc#973188)

  - CVE-2016-3159: The fpu_fxrstor function in     arch/x86/i387.c did not properly handle writes to the     hardware FSW.ES bit when running on AMD64 processors,     which allowed local guest OS users to obtain sensitive     register content information from another guest by     leveraging pending exception and mask bits (bsc#973188)

  - CVE-2016-4037: The ehci_advance_state function in     hw/usb/hcd-ehci.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) via a circular split isochronous transfer     descriptor (siTD) list (bsc#976111)

  - CVE-2016-4020: The patch_instruction function did not     initialize the imm32 variable, which allowed local guest     OS administrators to obtain sensitive information from     host stack memory by accessing the Task Priority     Register (TPR) (bsc#975907)

  - CVE-2016-4001: Buffer overflow in the     stellaris_enet_receive function, when the Stellaris     ethernet controller is configured to accept large     packets, allowed remote attackers to cause a denial of     service (QEMU crash) via a large packet (bsc#975130)

  - CVE-2016-4002: Buffer overflow in the mipsnet_receive     function, when the guest NIC is configured to accept     large packets, allowed remote attackers to cause a     denial of service (memory corruption and QEMU crash) or     possibly execute arbitrary code via a packet larger than     1514 bytes (bsc#975138)

  - CVE-2016-4480: The guest_walk_tables function in     arch/x86/mm/guest_walk.c in Xen did not properly handle     the Page Size (PS) page table entry bit at the L4 and L3     page table levels, which might have allowed local guest     OS users to gain privileges via a crafted mapping of     memory (bsc#978295)

These non-security issues were fixed :

  - boo#991934: xen hypervisor crash in csched_acct

  - boo#992224: During boot of Xen Hypervisor, Failed to get     contiguous memory for DMA from Xen

  - boo#955104: Virsh reports error 'one or more references     were leaked after disconnect from hypervisor' when     'virsh save' failed due to 'no response from client     after 6 keepalive messages'

  - boo#959552: Migration of HVM guest leads into libvirt     segmentation fault

  - boo#993665: Migration of xen guests finishes in: One or     more references were leaked after disconnect from the     hypervisor

  - boo#959330: Guest migrations using virsh results in     error 'Internal error: received hangup / error event on     socket'

  - boo#990500: VM virsh migration fails with keepalive     error: ':virKeepAliveTimerInternal:143 : No response     from client'

  - boo#953518: Unplug also SCSI disks in     qemu-xen-traditional for upstream unplug protocol

  - boo#953518: xen_platform: unplug also SCSI disks in     qemu-xen

  - boo#971949: Support (by ignoring) xl migrate --live. xl     migrations are always live 

  - boo#970135: New virtualization project clock test     randomly fails on Xen

  - boo#990970: Add PMU support for Intel E7-8867 v4 (fam=6,     model=79)

  - boo#985503: vif-route broken

  - boo#961100: Migrate a fv guest from sles12 to sles12sp1     fails remove patch because it can not fix the bug

  - boo#978413: PV guest upgrade from sles11sp4 to sles12sp2     alpha3 failed on sles11sp4 xen host.

  - boo#986586: Out of memory (oom) during boot on 'modprobe     xenblk' (non xen kernel) init.50-hvm-xen_conf

  - boo#900418: Dump cannot be performed on SLES12 XEN

  - boo#953339, boo#953362, boo#953518, boo#984981:
    Implement SUSE specific unplug protocol for emulated PCI     devices in PVonHVM guests to qemu-xen-upstream 

  - boo#954872: script block-dmmd not working as expected -     libxl: error: libxl_dm.c (Additional fixes) block-dmmd

  - boo#982695: xen-4.5.2 qemu fails to boot HVM guest from     xvda 

  - boo#958848: HVM guest crash at /usr/src/packages/BUILD/     xen-4.4.2-testing/obj/default/balloon/balloon.c:407

  - boo#949889: Fail to install 32-bit paravirt VM under     SLES12SP1Beta3 XEN

  - boo#954872: script block-dmmd not working as expected -     libxl: error: libxl_dm.c (another modification)     block-dmmd

  - boo#961600: Poor performance when Xen HVM domU     configured with max memory greater than current memory

  - boo#963161: Windows VM getting stuck during load while a     VF is assigned to it after upgrading to latest     maintenance updates

  - boo#976058: Xen error running simple HVM guest (Post     Alpha 2 xen+qemu)

  - boo#961100: Migrate a fv guest from sles12 to sles12sp1     on xen fails for 'Domain is not running on destination     host'. qemu-ignore-kvm-tpr-opt-on-migration.patch 

  - boo#973631: AWS EC2 kdump issue

  - boo#964427: Discarding device blocks: failed -     Input/output error

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2016-7092: The get_page_from_l3e function in     arch/x86/mm.c in Xen allowed local 32-bit PV guest OS     administrators to gain host OS privileges via vectors     related to L3 recursive pagetables (bsc#995785).

  - CVE-2016-7093: Xen allowed local HVM guest OS     administrators to overwrite hypervisor memory and     consequently gain host OS privileges by leveraging     mishandling of instruction pointer truncation during     emulation (bsc#995789).

  - CVE-2016-7094: Buffer overflow in Xen allowed local x86     HVM guest OS administrators on guests running with     shadow paging to cause a denial of service via a     pagetable update (bsc#995792).

  - CVE-2016-6836: Information leakage in     vmxnet3_complete_packet (bsc#994761).

  - CVE-2016-6888: Integer overflow in packet initialisation     in VMXNET3 device driver. Aprivileged user inside guest     c... (bsc#994772).

  - CVE-2016-6833: Use after free while writing     (bsc#994775).

  - CVE-2016-6835: Buffer overflow in     vmxnet_tx_pkt_parse_headers() in vmxnet3     deviceemulation. (bsc#994625).

  - CVE-2016-6834: An infinite loop during packet     fragmentation (bsc#994421).

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675).

  - CVE-2016-6259: Xen did not implement Supervisor Mode     Access Prevention (SMAP) whitelisting in 32-bit     exception and event delivery, which allowed local 32-bit     PV guest OS kernels to cause a denial of service     (hypervisor and VM crash) by triggering a safety check     (bsc#988676).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.5.3 fixes the several issues. These security issues were fixed :

  - CVE-2016-6258: Potential privilege escalation in PV     guests (XSA-182) (bsc#988675).

  - CVE-2016-6259: Missing SMAP whitelisting in 32-bit     exception / event delivery (XSA-183) (bsc#988676).

  - CVE-2016-5337: The megasas_ctrl_get_info function     allowed local guest OS administrators to obtain     sensitive host memory information via vectors related to     reading device control information (bsc#983973).

  - CVE-2016-5338: The (1) esp_reg_read and (2)     esp_reg_write functions allowed local guest OS     administrators to cause a denial of service (QEMU     process crash) or execute arbitrary code on the host via     vectors related to the information transfer buffer     (bsc#983984).

  - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c     might have allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via vectors related to reading from the     information transfer buffer in non-DMA mode     (bsc#982960).

  - CVE-2016-4453: The vmsvga_fifo_run function allowed     local guest OS administrators to cause a denial of     service (infinite loop and QEMU process crash) via a VGA     command (bsc#982225).

  - CVE-2016-4454: The vmsvga_fifo_read_raw function allowed     local guest OS administrators to obtain sensitive host     memory information or cause a denial of service (QEMU     process crash) by changing FIFO registers and issuing a     VGA command, which triggered an out-of-bounds read     (bsc#982224).

  - CVE-2016-5126: Heap-based buffer overflow in the     iscsi_aio_ioctl function allowed local guest OS users to     cause a denial of service (QEMU process crash) or     possibly execute arbitrary code via a crafted iSCSI     asynchronous I/O ioctl call (bsc#982286).

  - CVE-2016-5105: Stack information leakage while reading     configuration (bsc#982024).

  - CVE-2016-5106: Out-of-bounds write while setting     controller properties (bsc#982025).

  - CVE-2016-5107: Out-of-bounds read in     megasas_lookup_frame() function (bsc#982026).

  - CVE-2016-4963: The libxl device-handling allowed local     guest OS users with access to the driver domain to cause     a denial of service (management tool confusion) by     manipulating information in the backend directories in     xenstore (bsc#979670).

  - CVE-2016-4962: The libxl device-handling allowed local     OS guest administrators to cause a denial of service     (resource consumption or management facility confusion)     or gain host OS privileges by manipulating information     in guest controlled areas of xenstore (bsc#979620).

  - CVE-2016-4952: Out-of-bounds access issue in     pvsci_ring_init_msg/data routines (bsc#981276).

  - CVE-2014-3672: The qemu implementation in libvirt Xen     allowed local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or     stderr (bsc#981264).

  - CVE-2016-4441: The get_cmd function in the 53C9X Fast     SCSI Controller (FSC) support did not properly check DMA     length, which allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via unspecified vectors, involving an     SCSI command (bsc#980724).

  - CVE-2016-4439: The esp_reg_write function in the 53C9X     Fast SCSI Controller (FSC) support did not properly     check command buffer length, which allowed local guest     OS administrators to cause a denial of service     (out-of-bounds write and QEMU process crash) or     potentially execute arbitrary code on the host via     unspecified vectors (bsc#980716).

  - CVE-2016-3710: The VGA module improperly performed     bounds checking on banked access to video memory, which     allowed local guest OS administrators to execute     arbitrary code on the host by changing access modes     after setting the bank register, aka the 'Dark Portal'     issue (bsc#978164).

  - CVE-2016-3960: Integer overflow in the x86 shadow     pagetable code allowed local guest OS users to cause a     denial of service (host crash) or possibly gain     privileges by shadowing a superpage mapping     (bsc#974038).

  - CVE-2016-3159: The fpu_fxrstor function in     arch/x86/i387.c did not properly handle writes to the     hardware FSW.ES bit when running on AMD64 processors,     which allowed local guest OS users to obtain sensitive     register content information from another guest by     leveraging pending exception and mask bits (bsc#973188).

  - CVE-2016-3158: The xrstor function did not properly     handle writes to the hardware FSW.ES bit when running on     AMD64 processors, which allowed local guest OS users to     obtain sensitive register content information from     another guest by leveraging pending exception and mask     bits (bsc#973188).

  - CVE-2016-4037: The ehci_advance_state function in     hw/usb/hcd-ehci.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) via a circular split isochronous transfer     descriptor (siTD) list (bsc#976111).

  - CVE-2016-4020: The patch_instruction function did not     initialize the imm32 variable, which allowed local guest     OS administrators to obtain sensitive information from     host stack memory by accessing the Task Priority     Register (TPR) (bsc#975907).

  - CVE-2016-4001: Buffer overflow in the     stellaris_enet_receive function, when the Stellaris     ethernet controller is configured to accept large     packets, allowed remote attackers to cause a denial of     service (QEMU crash) via a large packet (bsc#975130).

  - CVE-2016-4002: Buffer overflow in the mipsnet_receive     function, when the guest NIC is configured to accept     large packets, allowed remote attackers to cause a     denial of service (memory corruption and QEMU crash) or     possibly execute arbitrary code via a packet larger than     1514 bytes (bsc#975138).

  - bsc#978295: x86 software guest page walk PS bit handling     flaw (XSA-176)

  - CVE-2016-5403: virtio: unbounded memory allocation on     host via guest leading to DoS (XSA-184) (bsc#990923)

  - CVE-2016-6351: scsi: esp: OOB write access in esp_do_dma     (bsc#990843)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

x86: Privilege escalation in PV guests [XSA-182, CVE-2016-6258] x86:
Missing SMAP whitelisting in 32-bit exception / event delivery [XSA-183, CVE-2016-6259] virtio: unbounded memory allocation issue [XSA-184, CVE-2016-5403] Qemu: scsi: esp: OOB write access in esp_do_dma [CVE-2016-6351]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Citrix XenServer running on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities :

  - A privilege escalation vulnerability known as 'Bunker     Buster' exists in the paravirtualization (PV) pagetable     implementation due to incorrect usage of fast-paths for     making updates to pre-existing pagetable entries. An     attacker with administrative privileges on a PV guest     can exploit this vulnerability to gain administrative     privileges on the host operating system. This     vulnerability only affects PV guests on x86 hardware;
    HVM and ARM guests are not affected. (CVE-2016-6258)

  - A denial of service vulnerability exists when handling     32-bit exceptions and event delivery due to missing SMAP     whitelisting. A local guest attacker can exploit this to     trigger a safety check that will crash other virtual     machines on the host system. This vulnerability only     exists on 32-bit PV guests running on x86 hardware that     supports SMAP. (CVE-2016-6259)

The Xen Project reports :

Supervisor Mode Access Prevention is a hardware feature designed to make an Operating System more robust, by raising a pagefault rather than accidentally following a pointer into userspace. However, legitimate accesses into userspace require whitelisting, and the exception delivery mechanism for 32bit PV guests wasn't whitelisted.

A malicious 32-bit PV guest kernel can trigger a safety check, crashing the hypervisor and causing a denial of service to other VMs on the host.

ID	Name	Product	Family	Severity
199537	RHEL 5 : xen (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
94000	openSUSE Security Update : xen (openSUSE-2016-1170) (Bunker Buster)	Nessus	SuSE Local Security Checks	critical
93935	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:2473-1) (Bunker Buster)	Nessus	SuSE Local Security Checks	high
93296	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:2093-1) (Bunker Buster)	Nessus	SuSE Local Security Checks	critical
92796	Fedora 23 : xen (2016-0049aa6e5d) (Bunker Buster)	Nessus	Fedora Local Security Checks	high
92766	Fedora 24 : xen (2016-01cc766201) (Bunker Buster)	Nessus	Fedora Local Security Checks	high
92723	Citrix XenServer Multiple Vulnerabilities (CTX214954) (Bunker Buster)	Nessus	Misc.	high
92675	FreeBSD : xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery (04cf89e3-5854-11e6-b334-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-6259

medium

Tenable Plugins

critical

critical

high

critical

high

high

high

medium