The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation.

For Debian 7 'Wheezy', these problems have been fixed in version 4.1.6.lts1-12.

We recommend that you upgrade your xen packages.

Please note that CVE-2017-15590 (XSA-237) will *not* be fixed in wheezy as the patches are too intrusive to backport. The vulnerability can be mitigated by not passing through physical devices to untrusted guests. More information can be found on https://xenbits.xen.org/xsa/advisory-237.html

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This updates xen to version 4.4.4_06 to fix the following issues :

  - An unprivileged user in a guest could gain guest could     escalate privilege to that of the guest kernel, if it     had could invoke the instruction emulator. Only 64-bit     x86 HVM guest were affected. Linux guest have not been     vulnerable. (boo#1016340, CVE-2016-10013)

  - An unprivileged user in a 64 bit x86 guest could gain     information from the host, crash the host or gain     privilege of the host (boo#1009107, CVE-2016-9383)

  - An unprivileged guest process could (unintentionally or     maliciously) obtain or ocorrupt sensitive information of     other programs in the same guest. Only x86 HVM guests     have been affected. The attacker needs to be able to     trigger the Xen instruction emulator. (boo#1000106,     CVE-2016-7777)

  - A guest on x86 systems could read small parts of     hypervisor stack data (boo#1012651, CVE-2016-9932)

  - A malicious guest kernel could hang or crash the host     system (boo#1014298, CVE-2016-10024)

  - A malicious guest administrator could escalate their     privilege to that of the host. Only affects x86 HVM     guests using qemu older version 1.6.0 or using the     qemu-xen-traditional. (boo#1011652, CVE-2016-9637)

  - An unprivileged guest user could escalate privilege to     that of the guest administrator on x86 HVM guests,     especially on Intel CPUs (boo#1009100, CVE-2016-9386)

  - An unprivileged guest user could escalate privilege to     that of the guest administrator (on AMD CPUs) or crash     the system (on Intel CPUs) on 32-bit x86 HVM guests.
    Only guest operating systems that allowed a new task to     start in VM86 mode were affected. (boo#1009103,     CVE-2016-9382)

  - A malicious guest administrator could crash the host on     x86 PV guests only (boo#1009104, CVE-2016-9385)

  - A malicious guest administrator could get privilege of     the host emulator process on x86 HVM guests.
    (boo#1009109, CVE-2016-9381)

  - A vulnerability in pygrub allowed a malicious guest     administrator to obtain the contents of sensitive host     files, or even delete those files (boo#1009111,     CVE-2016-9379, CVE-2016-9380)

  - A privileged guest user could cause an infinite loop in     the RTL8139 ethernet emulation to consume CPU cycles on     the host, causing a DoS situation (boo#1007157,     CVE-2016-8910)

  - A privileged guest user could cause an infinite loop in     the intel-hda sound emulation to consume CPU cycles on     the host, causing a DoS situation (boo#1007160,     CVE-2016-8909)

  - A privileged guest user could cause a crash of the     emulator process on the host by exploiting a divide by     zero vulnerability of the JAZZ RC4030 chipset emulation     (boo#1005004 CVE-2016-8667)

  - A privileged guest user could cause a crash of the     emulator process on the host by exploiting a divide by     zero issue of the 16550A UART emulation (boo#1005005,     CVE-2016-8669)

  - A privileged guest user could cause an infinite loop in     the USB xHCI emulation, causing a DoS situation on the     host (boo#1004016, CVE-2016-8576)

  - A privileged guest user could cause an infinite loop in     the ColdFire Fash Ethernet Controller emulation, causing     a DoS situation on the host (boo#1003030, CVE-2016-7908)

  - A privileged guest user could cause an infinite loop in     the AMD PC-Net II emulation, causing a DoS situation on     the host (boo#1003032, CVE-2016-7909)

  - Cause a reload of clvm in the block-dmmd script to avoid     a blocking lvchange call (boo#1002496)

  - Also unplug SCSI disks in qemu-xen-traditional for     upstream unplug protocol. Before a single SCSI storage     devices added to HVM guests could appear multiple times     in the guest. (boo#953518)

  - Fix a kernel panic / black screen when trying to boot a     XEN kernel on some UEFI firmwares (boo#1000195)

This updates xen to version 4.5.5 to fix the following issues :

  - An unprivileged user in a guest could gain guest could     escalate privilege to that of the guest kernel, if it     had could invoke the instruction emulator. Only 64-bit     x86 HVM guest were affected. Linux guest have not been     vulnerable. (boo#1016340, CVE-2016-10013)

  - An unprivileged user in a 64 bit x86 guest could gain     information from the host, crash the host or gain     privilege of the host (boo#1009107, CVE-2016-9383)

  - An unprivileged guest process could (unintentionally or     maliciously) obtain or ocorrupt sensitive information of     other programs in the same guest. Only x86 HVM guests     have been affected. The attacker needs to be able to     trigger the Xen instruction emulator. (boo#1000106,     CVE-2016-7777)

  - A guest on x86 systems could read small parts of     hypervisor stack data (boo#1012651, CVE-2016-9932)

  - A malicious guest kernel could hang or crash the host     system (boo#1014298, CVE-2016-10024)

  - The epro100 emulated network device caused a memory leak     in the host when unplugged in the guest. A privileged     user in the guest could use this to cause a DoS on the     host or potentially crash the guest process on the host     (boo#1013668, CVE-2016-9101)

  - The ColdFire Fast Ethernet Controller was vulnerable to     an infinite loop that could be trigged by a privileged     user in the guest, leading to DoS (boo#1013657,     CVE-2016-9776)

  - A malicious guest administrator could escalate their     privilege to that of the host. Only affects x86 HVM     guests using qemu older version 1.6.0 or using the     qemu-xen-traditional. (boo#1011652, CVE-2016-9637)

  - An unprivileged guest user could escalate privilege to     that of the guest administrator on x86 HVM guests,     especially on Intel CPUs (boo#1009100, CVE-2016-9386)

  - An unprivileged guest user could escalate privilege to     that of the guest administrator (on AMD CPUs) or crash     the system (on Intel CPUs) on 32-bit x86 HVM guests.
    Only guest operating systems that allowed a new task to     start in VM86 mode were affected. (boo#1009103,     CVE-2016-9382)

  - A malicious guest administrator could crash the host on     x86 PV guests only (boo#1009104, CVE-2016-9385)

  - An unprivileged guest user was able to crash the guest.
    (boo#1009108, CVE-2016-9377, CVE-2016-9378)

  - A malicious guest administrator could get privilege of     the host emulator process on x86 HVM guests.
    (boo#1009109, CVE-2016-9381)

  - A vulnerability in pygrub allowed a malicious guest     administrator to obtain the contents of sensitive host     files, or even delete those files (boo#1009111,     CVE-2016-9379, CVE-2016-9380)

  - A privileged guest user could cause an infinite loop in     the RTL8139 ethernet emulation to consume CPU cycles on     the host, causing a DoS situation (boo#1007157,     CVE-2016-8910)

  - A privileged guest user could cause an infinite loop in     the intel-hda sound emulation to consume CPU cycles on     the host, causing a DoS situation (boo#1007160,     CVE-2016-8909)

  - A privileged guest user could cause a crash of the     emulator process on the host by exploiting a divide by     zero vulnerability of the JAZZ RC4030 chipset emulation     (boo#1005004 CVE-2016-8667)

  - A privileged guest user could cause a crash of the     emulator process on the host by exploiting a divide by     zero issue of the 16550A UART emulation (boo#1005005,     CVE-2016-8669)

  - A privileged guest user could cause a memory leak in the     USB EHCI emulation, causing a DoS situation on the host     (boo#1003870, CVE-2016-7995)

  - A privileged guest user could cause an infinite loop in     the USB xHCI emulation, causing a DoS situation on the     host (boo#1004016, CVE-2016-8576)

  - A privileged guest user could cause an infinite loop in     the ColdFire Fash Ethernet Controller emulation, causing     a DoS situation on the host (boo#1003030, CVE-2016-7908)

  - A privileged guest user could cause an infinite loop in     the AMD PC-Net II emulation, causing a DoS situation on     the host (boo#1003032, CVE-2016-7909)

  - Cause a reload of clvm in the block-dmmd script to avoid     a blocking lvchange call (boo#1002496)

The remote host is affected by the vulnerability described in GLSA-201612-56 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly execute arbitrary code with the       privileges of the process, could gain privileges on the host system,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2016-9637: ioport array overflow allowing a     malicious guest administrator can escalate their     privilege to that of the host (bsc#1011652)

  - CVE-2016-9386: x86 null segments were not always treated     as unusable allowing an unprivileged guest user program     to elevate its privilege to that of the guest operating     system. Exploit of this vulnerability is easy on Intel     and more complicated on AMD (bsc#1009100)

  - CVE-2016-9382: x86 task switch to VM86 mode was     mis-handled, allowing a unprivileged guest process to     escalate its privilege to that of the guest operating     system on AMD hardware. On Intel hardware a malicious     unprivileged guest process can crash the guest     (bsc#1009103)

  - CVE-2016-9383: The x86 64-bit bit test instruction     emulation was broken, allowing a guest to modify     arbitrary memory leading to arbitray code execution     (bsc#1009107)

  - CVE-2016-9381: Improper processing of shared rings     allowing guest administrators take over the qemu     process, elevating their privilege to that of the qemu     process (bsc#1009109)

  - CVE-2016-9380: Delimiter injection vulnerabilities in     pygrub allowed guest administrators to obtain the     contents of sensitive host files or delete the files     (bsc#1009111)

  - CVE-2016-9379: Delimiter injection vulnerabilities in     pygrub allowed guest administrators to obtain the     contents of sensitive host files or delete the files     (bsc#1009111)

  - CVE-2016-7777: Xen did not properly honor CR0.TS and     CR0.EM, which allowed local x86 HVM guest OS users to     read or modify FPU, MMX, or XMM register state     information belonging to arbitrary tasks on the guest by     modifying an instruction while the hypervisor is     preparing to emulate it (bsc#1000106)

  - CVE-2016-8910: The rtl8139_cplus_transmit function in     hw/net/rtl8139.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) by leveraging failure to limit the ring     descriptor count (bsc#1007157)

  - CVE-2016-8909: The intel_hda_xfer function in     hw/audio/intel-hda.c allowed local guest OS     administrators to cause a denial of service (infinite     loop and CPU consumption) via an entry with the same     value for buffer length and pointer position     (bsc#1007160)

  - CVE-2016-8667: The rc4030_write function in     hw/dma/rc4030.c in allowed local guest OS administrators     to cause a denial of service (divide-by-zero error and     QEMU process crash) via a large interval timer reload     value (bsc#1005004)

  - CVE-2016-8669: The serial_update_parameters function in     hw/char/serial.c allowed local guest OS administrators     to cause a denial of service (divide-by-zero error and     QEMU process crash) via vectors involving a value of     divider greater than baud base (bsc#1005005)

  - CVE-2016-7908: The mcf_fec_do_tx function in     hw/net/mcf_fec.c did not properly limit the buffer     descriptor count when transmitting packets, which     allowed local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of 0     and crafted values in bd.flags (bsc#1003030)

  - CVE-2016-7909: The pcnet_rdra_addr function in     hw/net/pcnet.c allowed local guest OS administrators to     cause a denial of service (infinite loop and QEMU     process crash) by setting the (1) receive or (2)     transmit descriptor ring length to 0 (bsc#1003032)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

x86 CMPXCHG8B emulation fails to ignore operand size override [XSA-200, CVE-2016-9932] (#1404262)

----

ARM guests may induce host asynchronous abort [XSA-201, CVE-2016-9815, CVE-2016-9816, CVE-2016-9817, CVE-2016-9818] (#1399747) qemu: Divide by zero vulnerability in cirrus_do_copy (#1399055) [CVE-2016-9921, CVE-2016-9922] Qemu: 9pfs: memory leakage via proxy/handle callbacks (#1402278) qemu ioport array overflow [XSA-199, CVE-2016-9637]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - An out of bounds array access issue was found in the Xen     virtual machine monitor, built with the QEMU ioport     support. It could occur while doing ioport read/write     operations, if guest was to supply a 32bit address     parameter. A privileged guest user/process could use     this flaw to potentially escalate their privileges on a     host. (CVE-2016-9637)

An update for xen is now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Xen is a virtual machine monitor

Security Fix(es) :

* An out of bounds array access issue was found in the Xen virtual machine monitor, built with the QEMU ioport support. It could occur while doing ioport read/write operations, if guest was to supply a 32bit address parameter. A privileged guest user/process could use this flaw to potentially escalate their privileges on a host.
(CVE-2016-9637)

Red Hat would like to thank the Xen project for reporting this issue.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2963 advisory.

    [3.0.3-148.el5_11]
    - xen-qemu-ioport-array-overflow.patch [bz#1401521]
    - Resolves: bz#1401521       (CVE-2016-9637 xsa199 xen: qemu ioport array overflow (XSA-199) [rhel-5.11.z])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2016-9637: ioport array overflow allowing a     malicious guest administrator can escalate their     privilege to that of the host (bsc#1011652)

  - CVE-2016-9386: x86 null segments were not always treated     as unusable allowing an unprivileged guest user program     to elevate its privilege to that of the guest operating     system. Exploit of this vulnerability is easy on Intel     and more complicated on AMD (bsc#1009100)

  - CVE-2016-9382: x86 task switch to VM86 mode was     mis-handled, allowing a unprivileged guest process to     escalate its privilege to that of the guest operating     system on AMD hardware. On Intel hardware a malicious     unprivileged guest process can crash the guest     (bsc#1009103)

  - CVE-2016-9385: x86 segment base write emulation lacked     canonical address checks, allowing a malicious guest     administrator to crash the host (bsc#1009104)

  - CVE-2016-9383: The x86 64-bit bit test instruction     emulation was broken, allowing a guest to modify     arbitrary memory leading to arbitray code execution     (bsc#1009107)

  - CVE-2016-9381: Improper processing of shared rings     allowing guest administrators take over the qemu     process, elevating their privilege to that of the qemu     process (bsc#1009109)

  - CVE-2016-9380: Delimiter injection vulnerabilities in     pygrub allowed guest administrators to obtain the     contents of sensitive host files or delete the files     (bsc#1009111)

  - CVE-2016-9379: Delimiter injection vulnerabilities in     pygrub allowed guest administrators to obtain the     contents of sensitive host files or delete the files     (bsc#1009111)

  - CVE-2016-7777: Xen did not properly honor CR0.TS and     CR0.EM, which allowed local x86 HVM guest OS users to     read or modify FPU, MMX, or XMM register state     information belonging to arbitrary tasks on the guest by     modifying an instruction while the hypervisor is     preparing to emulate it (bsc#1000106)

  - CVE-2016-8910: The rtl8139_cplus_transmit function in     hw/net/rtl8139.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) by leveraging failure to limit the ring     descriptor count (bsc#1007157)

  - CVE-2016-8909: The intel_hda_xfer function in     hw/audio/intel-hda.c allowed local guest OS     administrators to cause a denial of service (infinite     loop and CPU consumption) via an entry with the same     value for buffer length and pointer position     (bsc#1007160)

  - CVE-2016-8667: The rc4030_write function in     hw/dma/rc4030.c in allowed local guest OS administrators     to cause a denial of service (divide-by-zero error and     QEMU process crash) via a large interval timer reload     value (bsc#1005004)

  - CVE-2016-8669: The serial_update_parameters function in     hw/char/serial.c allowed local guest OS administrators     to cause a denial of service (divide-by-zero error and     QEMU process crash) via vectors involving a value of     divider greater than baud base (bsc#1005005)

  - CVE-2016-8576: The xhci_ring_fetch function in     hw/usb/hcd-xhci.c allowed local guest OS administrators     to cause a denial of service (infinite loop and QEMU     process crash) by leveraging failure to limit the number     of link Transfer Request Blocks (TRB) to process     (bsc#1004016)

  - CVE-2016-7908: The mcf_fec_do_tx function in     hw/net/mcf_fec.c did not properly limit the buffer     descriptor count when transmitting packets, which     allowed local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of 0     and crafted values in bd.flags (bsc#1003030)

  - CVE-2016-7909: The pcnet_rdra_addr function in     hw/net/pcnet.c allowed local guest OS administrators to     cause a denial of service (infinite loop and QEMU     process crash) by setting the (1) receive or (2)     transmit descriptor ring length to 0 (bsc#1003032)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ARM guests may induce host asynchronous abort [XSA-201, CVE-2016-9815, CVE-2016-9816, CVE-2016-9817, CVE-2016-9818] (#1399747) qemu: Divide by zero vulnerability in cirrus_do_copy (#1399055) [CVE-2016-9921, CVE-2016-9922] Qemu: 9pfs: memory leakage via proxy/handle callbacks (#1402278) qemu ioport array overflow [XSA-199, CVE-2016-9637]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xen was updated to version 4.7.1 to fix 17 security issues.

These security issues were fixed :

  - CVE-2016-9637: ioport array overflow allowing a     malicious guest administrator can escalate their     privilege to that of the host (bsc#1011652).

  - CVE-2016-9386: x86 null segments were not always treated     as unusable allowing an unprivileged guest user program     to elevate its privilege to that of the guest operating     system. Exploit of this vulnerability is easy on Intel     and more complicated on AMD (bsc#1009100).

  - CVE-2016-9382: x86 task switch to VM86 mode was     mis-handled, allowing a unprivileged guest process to     escalate its privilege to that of the guest operating     system on AMD hardware. On Intel hardware a malicious     unprivileged guest process can crash the guest     (bsc#1009103).

  - CVE-2016-9385: x86 segment base write emulation lacked     canonical address checks, allowing a malicious guest     administrator to crash the host (bsc#1009104).

  - CVE-2016-9384: Guest 32-bit ELF symbol table load     leaking host data to unprivileged guest users     (bsc#1009105).

  - CVE-2016-9383: The x86 64-bit bit test instruction     emulation was broken, allowing a guest to modify     arbitrary memory leading to arbitray code execution     (bsc#1009107).

  - CVE-2016-9377: x86 software interrupt injection was     mis-handled, allowing an unprivileged guest user to     crash the guest (bsc#1009108).

  - CVE-2016-9378: x86 software interrupt injection was     mis-handled, allowing an unprivileged guest user to     crash the guest (bsc#1009108)

  - CVE-2016-9381: Improper processing of shared rings     allowing guest administrators take over the qemu     process, elevating their privilege to that of the qemu     process (bsc#1009109).

  - CVE-2016-9379: Delimiter injection vulnerabilities in     pygrub allowed guest administrators to obtain the     contents of sensitive host files or delete the files     (bsc#1009111).

  - CVE-2016-9380: Delimiter injection vulnerabilities in     pygrub allowed guest administrators to obtain the     contents of sensitive host files or delete the files     (bsc#1009111).

  - CVE-2016-7777: Xen did not properly honor CR0.TS and     CR0.EM, which allowed local x86 HVM guest OS users to     read or modify FPU, MMX, or XMM register state     information belonging to arbitrary tasks on the guest by     modifying an instruction while the hypervisor is     preparing to emulate it (bsc#1000106).

  - CVE-2016-8910: The rtl8139_cplus_transmit function in     hw/net/rtl8139.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) by leveraging failure to limit the ring     descriptor count (bsc#1007157).

  - CVE-2016-8667: The rc4030_write function in     hw/dma/rc4030.c in allowed local guest OS administrators     to cause a denial of service (divide-by-zero error and     QEMU process crash) via a large interval timer reload     value (bsc#1005004).

  - CVE-2016-8669: The serial_update_parameters function in     hw/char/serial.c allowed local guest OS administrators     to cause a denial of service (divide-by-zero error and     QEMU process crash) via vectors involving a value of     divider greater than baud base (bsc#1005005).

  - CVE-2016-7908: The mcf_fec_do_tx function in     hw/net/mcf_fec.c did not properly limit the buffer     descriptor count when transmitting packets, which     allowed local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of 0     and crafted values in bd.flags (bsc#1003030).

  - CVE-2016-7909: The pcnet_rdra_addr function in     hw/net/pcnet.c allowed local guest OS administrators to     cause a denial of service (infinite loop and QEMU     process crash) by setting the (1) receive or (2)     transmit descriptor ring length to 0 (bsc#1003032).

These non-security issues were fixed :

  - bsc#1004981: Xen RPM didn't contain debug hypervisor for     EFI systems

  - bsc#1007941: Xen tools limited the number of vcpus to     256 

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for xen to version 4.5.5 fixes several issues. These security issues were fixed :

  - CVE-2016-9637: ioport array overflow allowing a     malicious guest administrator can escalate their     privilege to that of the host (bsc#1011652)

  - CVE-2016-9386: x86 null segments were not always treated     as unusable allowing an unprivileged guest user program     to elevate its privilege to that of the guest operating     system. Exploit of this vulnerability is easy on Intel     and more complicated on AMD (bsc#1009100)

  - CVE-2016-9382: x86 task switch to VM86 mode was     mis-handled, allowing a unprivileged guest process to     escalate its privilege to that of the guest operating     system on AMD hardware. On Intel hardware a malicious     unprivileged guest process can crash the guest     (bsc#1009103)

  - CVE-2016-9385: x86 segment base write emulation lacked     canonical address checks, allowing a malicious guest     administrator to crash the host (bsc#1009104)

  - CVE-2016-9383: The x86 64-bit bit test instruction     emulation was broken, allowing a guest to modify     arbitrary memory leading to arbitray code execution     (bsc#1009107)

  - CVE-2016-9378: x86 software interrupt injection was     mis-handled, allowing an unprivileged guest user to     crash the guest (bsc#1009108)

  - CVE-2016-9377: x86 software interrupt injection was     mis-handled, allowing an unprivileged guest user to     crash the guest (bsc#1009108)

  - CVE-2016-9381: Improper processing of shared rings     allowing guest administrators take over the qemu     process, elevating their privilege to that of the qemu     process (bsc#1009109)

  - CVE-2016-9380: Delimiter injection vulnerabilities in     pygrub allowed guest administrators to obtain the     contents of sensitive host files or delete the files     (bsc#1009111)

  - CVE-2016-9379: Delimiter injection vulnerabilities in     pygrub allowed guest administrators to obtain the     contents of sensitive host files or delete the files     (bsc#1009111)

  - CVE-2016-7777: Xen did not properly honor CR0.TS and     CR0.EM, which allowed local x86 HVM guest OS users to     read or modify FPU, MMX, or XMM register state     information belonging to arbitrary tasks on the guest by     modifying an instruction while the hypervisor is     preparing to emulate it (bsc#1000106)

  - CVE-2016-8910: The rtl8139_cplus_transmit function in     hw/net/rtl8139.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) by leveraging failure to limit the ring     descriptor count (bsc#1007157)

  - CVE-2016-8909: The intel_hda_xfer function in     hw/audio/intel-hda.c allowed local guest OS     administrators to cause a denial of service (infinite     loop and CPU consumption) via an entry with the same     value for buffer length and pointer position     (bsc#1007160).

  - CVE-2016-8667: The rc4030_write function in     hw/dma/rc4030.c in allowed local guest OS administrators     to cause a denial of service (divide-by-zero error and     QEMU process crash) via a large interval timer reload     value (bsc#1005004)

  - CVE-2016-8669: The serial_update_parameters function in     hw/char/serial.c allowed local guest OS administrators     to cause a denial of service (divide-by-zero error and     QEMU process crash) via vectors involving a value of     divider greater than baud base (bsc#1005005)

  - CVE-2016-7995: A memory leak in ehci_process_itd allowed     a privileged user inside guest to DoS the host     (bsc#1003870).

  - CVE-2016-8576: The xhci_ring_fetch function in     hw/usb/hcd-xhci.c allowed local guest OS administrators     to cause a denial of service (infinite loop and QEMU     process crash) by leveraging failure to limit the number     of link Transfer Request Blocks (TRB) to process     (bsc#1004016).

  - CVE-2016-7908: The mcf_fec_do_tx function in     hw/net/mcf_fec.c did not properly limit the buffer     descriptor count when transmitting packets, which     allowed local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of 0     and crafted values in bd.flags (bsc#1003030)

  - CVE-2016-7909: The pcnet_rdra_addr function in     hw/net/pcnet.c allowed local guest OS administrators to     cause a denial of service (infinite loop and QEMU     process crash) by setting the (1) receive or (2)     transmit descriptor ring length to 0 (bsc#1003032)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xen was updated to version 4.7.1 to fix 17 security issues. These security issues were fixed :

  - CVE-2016-9637: ioport array overflow allowing a     malicious guest administrator can escalate their     privilege to that of the host (bsc#1011652).

  - CVE-2016-9386: x86 null segments were not always treated     as unusable allowing an unprivileged guest user program     to elevate its privilege to that of the guest operating     system. Exploit of this vulnerability is easy on Intel     and more complicated on AMD (bsc#1009100).

  - CVE-2016-9382: x86 task switch to VM86 mode was     mis-handled, allowing a unprivileged guest process to     escalate its privilege to that of the guest operating     system on AMD hardware. On Intel hardware a malicious     unprivileged guest process can crash the guest     (bsc#1009103).

  - CVE-2016-9385: x86 segment base write emulation lacked     canonical address checks, allowing a malicious guest     administrator to crash the host (bsc#1009104).

  - CVE-2016-9384: Guest 32-bit ELF symbol table load     leaking host data to unprivileged guest users     (bsc#1009105).

  - CVE-2016-9383: The x86 64-bit bit test instruction     emulation was broken, allowing a guest to modify     arbitrary memory leading to arbitray code execution     (bsc#1009107).

  - CVE-2016-9377: x86 software interrupt injection was     mis-handled, allowing an unprivileged guest user to     crash the guest (bsc#1009108).

  - CVE-2016-9378: x86 software interrupt injection was     mis-handled, allowing an unprivileged guest user to     crash the guest (bsc#1009108)

  - CVE-2016-9381: Improper processing of shared rings     allowing guest administrators take over the qemu     process, elevating their privilege to that of the qemu     process (bsc#1009109).

  - CVE-2016-9379: Delimiter injection vulnerabilities in     pygrub allowed guest administrators to obtain the     contents of sensitive host files or delete the files     (bsc#1009111).

  - CVE-2016-9380: Delimiter injection vulnerabilities in     pygrub allowed guest administrators to obtain the     contents of sensitive host files or delete the files     (bsc#1009111).

  - CVE-2016-7777: Xen did not properly honor CR0.TS and     CR0.EM, which allowed local x86 HVM guest OS users to     read or modify FPU, MMX, or XMM register state     information belonging to arbitrary tasks on the guest by     modifying an instruction while the hypervisor is     preparing to emulate it (bsc#1000106).

  - CVE-2016-8910: The rtl8139_cplus_transmit function in     hw/net/rtl8139.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) by leveraging failure to limit the ring     descriptor count (bsc#1007157).

  - CVE-2016-8667: The rc4030_write function in     hw/dma/rc4030.c in allowed local guest OS administrators     to cause a denial of service (divide-by-zero error and     QEMU process crash) via a large interval timer reload     value (bsc#1005004).

  - CVE-2016-8669: The serial_update_parameters function in     hw/char/serial.c allowed local guest OS administrators     to cause a denial of service (divide-by-zero error and     QEMU process crash) via vectors involving a value of     divider greater than baud base (bsc#1005005).

  - CVE-2016-7908: The mcf_fec_do_tx function in     hw/net/mcf_fec.c did not properly limit the buffer     descriptor count when transmitting packets, which     allowed local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of 0     and crafted values in bd.flags (bsc#1003030).

  - CVE-2016-7909: The pcnet_rdra_addr function in     hw/net/pcnet.c allowed local guest OS administrators to     cause a denial of service (infinite loop and QEMU     process crash) by setting the (1) receive or (2)     transmit descriptor ring length to 0 (bsc#1003032).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Citrix XenServer running on the remote host is missing a security hotfix. It is, therefore, affected by a privilege escalation vulnerability in the QEMU ioport component due to an array overflow that is triggered during the handling of addresses in ioport read and write look-ups. A local administrative user on the guest system can exploit this issue to gain elevated privileges on the host system.

xen was updated to fix several security issues. These security issues were fixed :

  - CVE-2016-9637: ioport array overflow allowing a     malicious guest administrator can escalate their     privilege to that of the host (bsc#1011652).

  - CVE-2016-9386: x86 null segments were not always treated     as unusable allowing an unprivileged guest user program     to elevate its privilege to that of the guest operating     system. Exploit of this vulnerability is easy on Intel     and more complicated on AMD (bsc#1009100)

  - CVE-2016-9382: x86 task switch to VM86 mode was     mis-handled, allowing a unprivileged guest process to     escalate its privilege to that of the guest operating     system on AMD hardware. On Intel hardware a malicious     unprivileged guest process can crash the guest     (bsc#1009103)

  - CVE-2016-9383: The x86 64-bit bit test instruction     emulation was broken, allowing a guest to modify     arbitrary memory leading to arbitray code execution     (bsc#1009107)

  - CVE-2016-9381: Improper processing of shared rings     allowing guest administrators take over the qemu     process, elevating their privilege to that of the qemu     process (bsc#1009109)

  - CVE-2016-9380: Delimiter injection vulnerabilities in     pygrub allowed guest administrators to obtain the     contents of sensitive host files or delete the files     (bsc#1009111)

  - CVE-2016-9379: Delimiter injection vulnerabilities in     pygrub allowed guest administrators to obtain the     contents of sensitive host files or delete the files     (bsc#1009111)

  - CVE-2016-7777: Xen did not properly honor CR0.TS and     CR0.EM, which allowed local x86 HVM guest OS users to     read or modify FPU, MMX, or XMM register state     information belonging to arbitrary tasks on the guest by     modifying an instruction while the hypervisor is     preparing to emulate it (bsc#1000106)

  - CVE-2016-8910: The rtl8139_cplus_transmit function in     hw/net/rtl8139.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) by leveraging failure to limit the ring     descriptor count (bsc#1007157)

  - CVE-2016-8667: The rc4030_write function in     hw/dma/rc4030.c in allowed local guest OS administrators     to cause a denial of service (divide-by-zero error and     QEMU process crash) via a large interval timer reload     value (bsc#1005004)

  - CVE-2016-8669: The serial_update_parameters function in     hw/char/serial.c allowed local guest OS administrators     to cause a denial of service (divide-by-zero error and     QEMU process crash) via vectors involving a value of     divider greater than baud base (bsc#1005005)

  - CVE-2016-7908: The mcf_fec_do_tx function in     hw/net/mcf_fec.c did not properly limit the buffer     descriptor count when transmitting packets, which     allowed local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of 0     and crafted values in bd.flags (bsc#1003030)

  - CVE-2016-7909: The pcnet_rdra_addr function in     hw/net/pcnet.c allowed local guest OS administrators to     cause a denial of service (infinite loop and QEMU     process crash) by setting the (1) receive or (2)     transmit descriptor ring length to 0 (bsc#1003032)

  - CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c,     when built with ESP/NCR53C9x controller emulation     support, allowed local guest OS administrators to cause     a denial of service (out-of-bounds write and QEMU     process crash) or execute arbitrary code on the host via     vectors involving DMA read into ESP command buffer     (bsc#990843)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - qemu: ioport_read, ioport_write: be defensive about     32-bit addresses On x86, ioport addresses are 16-bit.
    That these functions take 32-bit arguments is a mistake.
    Changing the argument type to 16-bit will discard the     top bits of any erroneous values from elsewhere in qemu.
    Also, check just before use that the value is in range.
    (This turns an ill-advised change to MAX_IOPORTS into a     possible guest crash rather than a privilege escalation     vulnerability.) And, in the Xen ioreq processor, clamp     incoming ioport addresses to 16-bit values. Xen will     never write >16-bit values but the guest may have access     to the ioreq ring. We want to defend the rest of the     qemu code from wrong values. This is XSA-199.
    (CVE-2016-9637)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - qemu_up: ioport_read, ioport_write: be defensive about     32-bit addresses On x86, ioport addresses are 16-bit.
    That these functions take 32-bit arguments is a mistake.
    Changing the argument type to 16-bit will discard the     top bits of any erroneous values from elsewhere in qemu.
    Also, check just before use that the value is in range.
    (This turns an ill-advised change to MAX_IOPORTS into a     possible guest crash rather than a privilege escalation     vulnerability.) And, in the Xen ioreq processor, clamp     incoming ioport addresses to 16-bit values. Xen will     never write >16-bit values but the guest may have access     to the ioreq ring. We want to defend the rest of the     qemu code from wrong values. This is XSA-199.
    (CVE-2016-9637)

  - qemu: ioport_read, ioport_write: be defensive about     32-bit addresses On x86, ioport addresses are 16-bit.
    That these functions take 32-bit arguments is a mistake.
    Changing the argument type to 16-bit will discard the     top bits of any erroneous values from elsewhere in qemu.
    Also, check just before use that the value is in range.
    (This turns an ill-advised change to MAX_IOPORTS into a     possible guest crash rather than a privilege escalation     vulnerability.) And, in the Xen ioreq processor, clamp     incoming ioport addresses to 16-bit values. Xen will     never write >16-bit values but the guest may have access     to the ioreq ring. We want to defend the rest of the     qemu code from wrong values. This is XSA-199.
    (CVE-2016-9637)

ID	Name	Product	Family	Severity
106633	Debian DLA-1270-1 : xen security update	Nessus	Debian Local Security Checks	critical
96253	openSUSE Security Update : xen (openSUSE-2017-5)	Nessus	SuSE Local Security Checks	high
96252	openSUSE Security Update : xen (openSUSE-2017-4)	Nessus	SuSE Local Security Checks	high
96231	GLSA-201612-56 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
96150	SUSE SLES11 Security Update : xen (SUSE-SU-2016:3273-1)	Nessus	SuSE Local Security Checks	high
96113	Fedora 24 : xen (2016-bcbae0781f)	Nessus	Fedora Local Security Checks	high
95985	Scientific Linux Security Update : xen on SL5.x i386/x86_64 (20161220)	Nessus	Scientific Linux Local Security Checks	high
95982	RHEL 5 : xen (RHSA-2016:2963)	Nessus	Red Hat Local Security Checks	high
95979	Oracle Linux 5 : xen (ELSA-2016-2963)	Nessus	Oracle Linux Local Security Checks	high
95953	CentOS 5 : xen (CESA-2016:2963)	Nessus	CentOS Local Security Checks	high
96032	SUSE SLES11 Security Update : xen (SUSE-SU-2016:3174-1)	Nessus	SuSE Local Security Checks	high
96025	Fedora 23 : xen (2016-cc2916dcf4)	Nessus	Fedora Local Security Checks	high
95910	openSUSE Security Update : xen (openSUSE-2016-1477)	Nessus	SuSE Local Security Checks	high
95822	SUSE SLES12 Security Update : xen (SUSE-SU-2016:3156-1)	Nessus	SuSE Local Security Checks	high
95761	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:3083-1)	Nessus	SuSE Local Security Checks	high
95709	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:3067-1)	Nessus	SuSE Local Security Checks	high
95659	Citrix XenServer QEMU ioport Array Overflow Guest-to-Host Privilege Escalation (CTX219136)	Nessus	Misc.	high
95624	SUSE SLES11 Security Update : xen (SUSE-SU-2016:3044-1)	Nessus	SuSE Local Security Checks	high
95619	OracleVM 3.2 : xen (OVMSA-2016-0172)	Nessus	OracleVM Local Security Checks	high
95618	OracleVM 3.3 : xen (OVMSA-2016-0171)	Nessus	OracleVM Local Security Checks	high

Detections

Analytics

CVE-2016-9637

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high