arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to map_grant_ref.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xsa224 xen: grant table operations mishandle reference counts (XSA-224) (CVE-2017-10921)

  - The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or stderr. (CVE-2014-3672)

  - Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary     code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS     set. (CVE-2015-3209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0039 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details.

The remote host is affected by the vulnerability described in GLSA-201801-14 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       referenced CVE identifiers for details.
  Impact :

    A local attacker could potentially execute arbitrary code with the       privileges of the Xen (QEMU) process on the host, gain privileges on the       host system, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-12136: Race conditions with maptrack free list     handling allows a malicious guest administrator to crash     the host or escalate their privilege to that of the host     (XSA-228, bsc#1051789).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230 bsc#1052686.

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0153 for details.

Multiple vulnerabilities have been discovered in the Xen hypervisor :

CVE-2017-10912

Jann Horn discovered that incorrectly handling of page transfers might result in privilege escalation.

CVE-2017-10913 / CVE-2017-10914

Jann Horn discovered that race conditions in grant handling might result in information leaks or privilege escalation.

CVE-2017-10915

Andrew Cooper discovered that incorrect reference counting with shadow paging might result in privilege escalation.

CVE-2017-10918

Julien Grall discovered that incorrect error handling in physical-to-machine memory mappings may result in privilege escalation, denial of service or an information leak.

CVE-2017-10920 / CVE-2017-10921 / CVE-2017-10922

Jan Beulich discovered multiple places where reference counting on grant table operations was incorrect, resulting in potential privilege escalation

CVE-2017-12135

Jan Beulich found multiple problems in the handling of transitive grants which could result in denial of service and potentially privilege escalation.

CVE-2017-12137

Andrew Cooper discovered that incorrect validation of grants may result in privilege escalation.

CVE-2017-12855

Jan Beulich discovered that incorrect grant status handling, thus incorrectly informing the guest that the grant is no longer in use.

CVE-2017-14316

Matthew Daley discovered that the NUMA node parameter wasn't verified which which may result in privilege escalation.

CVE-2017-14317

Eric Chanudet discovered that a race conditions in cxenstored might result in information leaks or privilege escalation.

CVE-2017-14318

Matthew Daley discovered that incorrect validation of grants may result in a denial of service.

CVE-2017-14319

Andrew Cooper discovered that insufficient grant unmapping checks may result in denial of service and privilege escalation.

For Debian 7 'Wheezy', these problems have been fixed in version 4.1.6.lts1-9.

We recommend that you upgrade your xen packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-11334: The address_space_write_continue     function in exec.c allowed local guest OS privileged     users to cause a denial of service (out-of-bounds access     and guest instance crash) by leveraging use of     qemu_map_ram_ptr to access guest ram block area     (bsc#1048920).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10806: Stack-based buffer overflow in     hw/usb/redirect.c allowed local guest OS users to cause     a denial of service via vectors related to logging debug     messages (bsc#1047675).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230, bsc#1052686).

  - CVE-2017-14316: Missing bound check in function     `alloc_heap_pages` for an internal array allowed     attackers using crafted hypercalls to execute arbitrary     code within Xen (XSA-231, bsc#1056278)

  - CVE-2017-14317: A race in cxenstored may have cause a     double-free allowind for DoS of the xenstored daemon     (XSA-233, bsc#1056281).

  - CVE-2017-14319: An error while handling grant mappings     allowed malicious or buggy x86 PV guest to escalate its     privileges or crash the hypervisor (XSA-234,     bsc#1056282).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Qemu: usb: ohci: infinite loop due to incorrect return value [CVE-2017-9330] (#1457698) Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [CVE-2017-10664] (#1466466) revised full fix for XSA-226 (regressed 32-bit Dom0 or backend domains)

----

full fix for XSA-226, replacing workaround drop conflict of xendomain and libvirtd as can cause problems (#1398590) add-to-physmap error paths fail to release lock on ARM [XSA-235] (#1484476) Qemu: audio:
host memory leakage via capture buffer [CVE-2017-8309] (#1446521) Qemu: input: host memory leakage via keyboard events [CVE-2017-8379] (#1446561)

----

Qemu: serial: host memory leakage 16550A UART emulation [CVE-2017-5579] (#1416162) Qemu: display: cirrus: OOB read access issue [CVE-2017-7718] (#1443444) xen: various flaws (#1481765) multiple problems with transitive grants [XSA-226, CVE-2017-12135] x86: PV privilege escalation via map_grant_ref [XSA-227, CVE-2017-12137] grant_table: Race conditions with maptrack free list handling [XSA-228, CVE-2017-12136] grant_table: possibly premature clearing of GTF_writing / GTF_reading [XSA-230, CVE-2017-12855]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues.

These security issues were fixed :

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-12136: Race conditions with maptrack free list     handling allows a malicious guest administrator to crash     the host or escalate their privilege to that of the host     (XSA-228, bsc#1051789).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230 bsc#1052686.

These non-security issues were fixed :

  - bsc#1055695: XEN: 11SP4 and 12SP3 HVM guests can not be     restored after the save using xl stack

  - bsc#1035231: Migration of HVM domU did not use     superpages on destination dom0

  - bsc#1002573: Optimized LVM functions in block-dmmd     block-dmmd

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for xen to version 4.7.3 fixes several issues.

These security issues were fixed :

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-12136: Race conditions with maptrack free list     handling allows a malicious guest administrator to crash     the host or escalate their privilege to that of the host     (XSA-228, bsc#1051789).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230 CVE-2017-12855).

These non-security issues were fixed :

  - bsc#1055695: XEN: 11SP4 and 12SP3 HVM guests can not be     restored after the save using xl stack 

  - bsc#1035231: Migration of HVM domU did not use     superpages on destination dom0

  - bsc#1002573: Optimized LVM functions in block-dmmd     block-dmmd

  - bsc#1037840: Xen-detect always showed HVM for PV guests

This update was imported from the SUSE:SLE-12-SP2:Update update project.

Multiple vulnerabilities have been discovered in the Xen hypervisor :

  - CVE-2017-10912     Jann Horn discovered that incorrectly handling of page     transfers might result in privilege escalation.

  - CVE-2017-10913 / CVE-2017-10914     Jann Horn discovered that race conditions in grant     handling might result in information leaks or privilege     escalation.

  - CVE-2017-10915     Andrew Cooper discovered that incorrect reference     counting with shadow paging might result in privilege     escalation.

  - CVE-2017-10916     Andrew Cooper discovered an information leak in the     handling of the Memory Protection Extensions (MPX) and     Protection Key (PKU) CPU features. This only affects     Debian stretch.

  - CVE-2017-10917     Ankur Arora discovered a NULL pointer dereference in     event polling, resulting in denial of service.

  - CVE-2017-10918     Julien Grall discovered that incorrect error handling in     physical-to-machine memory mappings may result in     privilege escalation, denial of service or an     information leak.

  - CVE-2017-10919     Julien Grall discovered that incorrect handling of     virtual interrupt injection on ARM systems may result in     denial of service.

  - CVE-2017-10920 / CVE-2017-10921 / CVE-2017-10922     Jan Beulich discovered multiple places where reference     counting on grant table operations was incorrect,     resulting in potential privilege escalation.

  - CVE-2017-12135     Jan Beulich found multiple problems in the handling of     transitive grants which could result in denial of     service and potentially privilege escalation.

  - CVE-2017-12136     Ian Jackson discovered that race conditions in the     allocator for grant mappings may result in denial of     service or privilege escalation. This only affects     Debian stretch.

  - CVE-2017-12137     Andrew Cooper discovered that incorrect validation of     grants may result in privilege escalation.

  - CVE-2017-12855     Jan Beulich discovered that incorrect grant status     handling, thus incorrectly informing the guest that the     grant is no longer in use.

  - XSA-235 (no CVE yet)

    Wei Liu discovered that incorrect locking of     add-to-physmap operations on ARM may result in denial of     service.

This update for xen fixes the following issues :

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230, bsc#1052686).

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-11334: The address_space_write_continue     function in exec.c allowed local guest OS privileged     users to cause a denial of service (out-of-bounds access     and guest instance crash) by leveraging use of     qemu_map_ram_ptr to access guest ram block area     (bsc#1048920).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.7.3 fixes several issues. These security issues were fixed :

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-12136: Race conditions with maptrack free list     handling allows a malicious guest administrator to crash     the host or escalate their privilege to that of the host     (XSA-228, bsc#1051789).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230 CVE-2017-12855).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

  - CVE-2017-11334: The address_space_write_continue     function in exec.c allowed local guest OS privileged     users to cause a denial of service (out-of-bounds access     and guest instance crash) by leveraging use of     qemu_map_ram_ptr to access guest ram block area     (bsc#1048920).

  - CVE-2017-10806: Stack-based buffer overflow in     hw/usb/redirect.c allowed local guest OS users to cause     a denial of service via vectors related to logging debug     messages (bsc#1047675).

  - bsc#1052686: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - From e26560a4b056dad6d85ffd9ebfad9565f210a9cc Mon Sep 17     00:00:00 2001 From: Jan Beulich Date: Wed, 30 May 2012     09:22:17 +0100 Subject: [PATCH] gnttab: don't use domain     lock for serialization Instead use the affected domain's     grant table lock, at once reducing the scopes during     which locks are being held and hence allowing     significantly better parallelism.

    Committed-by: Keir Fraser Conflict:
    xen/common/grant_table.c xen/arch/x86/mm.c

  - From: Jan Beulich Subject: gnttab: correct pin status     fixup for copy Regardless of copy operations only     setting GNTPIN_hst*, GNTPIN_dev* also need to be taken     into account when deciding whether to clear
    _GTF_[read,writ]ing. At least for consistency with code     elsewhere the read part better doesn't use any mask at     all. This is XSA-230. (CVE-2017-12855)

  - From 3aab881c7331cf93ffd8d2f2dd9adfd18ed4fc99 Mon Sep 17     00:00:00 2001 From: Andrew Cooper Date: Tue, 20 Jun 2017     19:18:54 +0100 Subject: [PATCH] x86/grant: Disallow     misaligned PTEs Pagetable entries must be aligned to     function correctly. Disallow attempts from the guest to     have a grant PTE created at a misaligned address, which     would result in corruption of the L1 table with     largely-guest-controlled values. This is XSA-227     (CVE-2017-12137)

  - Prerequisite patch for xsa227-4.5.patch There is no     macro ASSERT_UNREACHABLE before OVM3.4 which is needed     by xsa227-4.5.patch This chunk is picked from upstream     commit cacdb0faaa121ac8f792d5bd34cc6bc7c72d21da     (CVE-2017-12137)

  - From: Andrew Cooper Subject: grant_table: Default to v1,     and disallow transitive grants The reference counting     and locking discipline for transitive grants is broken.
    Their use is therefore declared out of security support.
    This is XSA-226. Transitive grants are expected to be     unconditionally available with grant table v2. Hiding     transitive grants alone is an ABI breakage for the     guest. Modern versions of Linux and the Windows PV     drivers use grant table v1, but older versions did use     v2. In principle, disabling gnttab v2 entirely is the     safer way to cause guests to avoid using transitive     grants. However, some older guests which defaulted to     using gnttab v2 don't tolerate falling back from v2 to     v1 over migrate. This patch introduces a new command     line option to control grant table behaviour. One     suboption allows a choice of the maximum grant table     version Xen will allow the guest to use, and defaults to     v2. A different suboption independently controls whether     transitive grants can be used. The default case is:
    gnttab=max_ver:2 To disable gnttab v2 entirely, use:
    gnttab=max_ver:1 To allow gnttab v2 and transitive     grants, use: gnttab=max_ver:2,transitive

    Ignore the chunk for docs/misc/xen-command-line.markdown     as no such file for OVM3.2 (CVE-2017-12135)

  - From 8aed1f12c4c087c5b31cbee8636b3d2d25efb363 Mon Sep 17     00:00:00 2001 From: Andres Lagar-Cavilla Date: Wed, 22     Aug 2012 22:27:50 +0100 Subject: [PATCH] Fix shared     entry status for grant copy operation on paged-out g fn     The unwind path was not clearing the shared entry status     bits. This was BSOD-ing guests on network activity under     certain configurations. Also: * sed the fixup method     name to signal it's related to grant copy. * use atomic     clear flag ops during fixup.

    Committed-by: Keir Fraser Conflict:
    xen/common/grant_table.c Prerequisite patch for XSA-226     fix (CVE-2017-12135)

  - From 69549b08eb9bd3a525c07a97d952673a3d02c76a Mon Sep 17     00:00:00 2001 From: Annie Li Date: Fri, 7 Jul 2017     14:36:08 -0400 Subject: [PATCH] xen: increase default     max grant frames and max maptrack frames Commit     9dfba034e increase default max grant frames to 128 which     is still not enough when the guest has more cpus and     vbd/vif devices, so set it to 256. Also the default max     maptrack frames needs to be increased accordingly.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - From: Jan Beulich Subject: gnttab: correct pin status     fixup for copy Regardless of copy operations only     setting GNTPIN_hst*, GNTPIN_dev* also need to be taken     into account when deciding whether to clear
    _GTF_[read,writ]ing. At least for consistency with code     elsewhere the read part better doesn't use any mask at     all. This is XSA-230. (CVE-2017-12855)

  - From: Andrew Cooper Subject: grant_table: Default to v1,     and disallow transitive grants The reference counting     and locking discipline for transitive grants is broken.
    Their use is therefore declared out of security support.
    This is XSA-226. Transitive grants are expected to be     unconditionally available with grant table v2. Hiding     transitive grants alone is an ABI breakage for the     guest. Modern versions of Linux and the Windows PV     drivers use grant table v1, but older versions did use     v2. In principle, disabling gnttab v2 entirely is the     safer way to cause guests to avoid using transitive     grants. However, some older guests which defaulted to     using gnttab v2 don't tolerate falling back from v2 to     v1 over migrate. This patch introduces a new command     line option to control grant table behaviour. One     suboption allows a choice of the maximum grant table     version Xen will allow the guest to use, and defaults to     v2. A different suboption independently controls whether     transitive grants can be used. The default case is:
    gnttab=max_ver:2 To disable gnttab v2 entirely, use:
    gnttab=max_ver:1 To allow gnttab v2 and transitive     grants, use: gnttab=max_ver:2,transitive

    Conflict: docs/misc/xen-command-line.markdown     (CVE-2017-12135)

  - Revert wrong fix for xsa226 [bug 26567225]

  - From 3aab881c7331cf93ffd8d2f2dd9adfd18ed4fc99 Mon Sep 17     00:00:00 2001 From: Andrew Cooper Date: Tue, 20 Jun 2017     19:18:54 +0100 Subject: [PATCH] x86/grant: Disallow     misaligned PTEs Pagetable entries must be aligned to     function correctly. Disallow attempts from the guest to     have a grant PTE created at a misaligned address, which     would result in corruption of the L1 table with     largely-guest-controlled values. This is XSA-227     (CVE-2017-12137)

  - Prerequisite patch for xsa227-4.5.patch There is no     macro ASSERT_UNREACHABLE before OVM3.4 which is needed     by xsa227-4.5.patch This chunk is picked from upstream     commit cacdb0faaa121ac8f792d5bd34cc6bc7c72d21da     (CVE-2017-12137)

  - From: Jan Beulich Subject: gnttab: don't use possibly     unbounded tail calls There is no guarantee that the     compiler would actually translate them to branches     instead of calls, so only ones with a known recursion     limit are okay :

  - __release_grant_for_copy can call itself only once, as
    __acquire_grant_for_copy won't permit use of multi-level     transitive grants,

  - __acquire_grant_for_copy is fine to call itself with the     last argument false, as that prevents further recursion,

  - __acquire_grant_for_copy must not call itself to recover     from an observed change to the active entry's pin count     This is XSA-226. (CVE-2017-12135)

  - From 69549b08eb9bd3a525c07a97d952673a3d02c76a Mon Sep 17     00:00:00 2001 From: Annie Li Date: Fri, 7 Jul 2017     14:36:08 -0400 Subject: [PATCH] xen: increase default     max grant frames and max maptrack frames Commit     9dfba034e increase default max grant frames to 128 which     is still not enough when the guest has more cpus and     vbd/vif devices, so set it to 256. Also the default max     maptrack frames needs to be increased accordingly.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0142 for details.

Qemu: serial: host memory leakage 16550A UART emulation [CVE-2017-5579] (#1416162) Qemu: display: cirrus: OOB read access issue [CVE-2017-7718] (#1443444) xen: various flaws (#1481765) multiple problems with transitive grants [XSA-226, CVE-2017-12135] x86: PV privilege escalation via map_grant_ref [XSA-227, CVE-2017-12137] grant_table: Race conditions with maptrack free list handling [XSA-228, CVE-2017-12136] grant_table: possibly premature clearing of GTF_writing / GTF_reading [XSA-230, CVE-2017-12855]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by multiple vulnerabilities.

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

The version of Citrix XenServer installed on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities as noted in the CTX225941 advisory.

ID	Name	Product	Family	Severity
199537	RHEL 5 : xen (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195765	RHEL 5 : xsa227_xen (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
140019	OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
111992	OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
106038	GLSA-201801-14 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
104649	SUSE SLES12 Security Update : xen (SUSE-SU-2017:2327-2)	Nessus	SuSE Local Security Checks	high
103830	OracleVM 3.4 : xen (OVMSA-2017-0153)	Nessus	OracleVM Local Security Checks	critical
103791	Debian DLA-1132-1 : xen security update	Nessus	Debian Local Security Checks	critical
103412	SUSE SLES12 Security Update : xen (SUSE-SU-2017:2541-1)	Nessus	SuSE Local Security Checks	high
103342	Fedora 25 : xen (2017-ed735463e3)	Nessus	Fedora Local Security Checks	high
103216	SUSE SLES11 Security Update : xen (SUSE-SU-2017:2450-1)	Nessus	SuSE Local Security Checks	high
103159	openSUSE Security Update : xen (openSUSE-2017-1023)	Nessus	SuSE Local Security Checks	high
103158	openSUSE Security Update : xen (openSUSE-2017-1022)	Nessus	SuSE Local Security Checks	critical
103146	Debian DSA-3969-1 : xen - security update	Nessus	Debian Local Security Checks	critical
102954	SUSE SLES11 Security Update : xen (SUSE-SU-2017:2339-1)	Nessus	SuSE Local Security Checks	high
102953	SUSE SLED12 Security Update : xen (SUSE-SU-2017:2327-1)	Nessus	SuSE Local Security Checks	high
102952	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:2326-1)	Nessus	SuSE Local Security Checks	critical
102913	SUSE SLES12 Security Update : xen (SUSE-SU-2017:2319-1)	Nessus	SuSE Local Security Checks	high
102907	OracleVM 3.2 : xen (OVMSA-2017-0149)	Nessus	OracleVM Local Security Checks	high
102906	OracleVM 3.3 : xen (OVMSA-2017-0148)	Nessus	OracleVM Local Security Checks	high
102835	OracleVM 3.4 : xen (OVMSA-2017-0142)	Nessus	OracleVM Local Security Checks	critical
102686	Fedora 26 : xen (2017-f336ba205d)	Nessus	Fedora Local Security Checks	high
102585	Xen Hypervisor Multiple Vulnerabilities (XSA-226 - XSA-230)	Nessus	Misc.	high
102526	Citrix XenServer Multiple Vulnerabilities (CTX225941)	Nessus	Misc.	high

Detections

Analytics

CVE-2017-12137

high

Tenable Plugins

critical

high

critical

critical

high

high

critical

critical

high

high

high

high

critical

critical

high

high

critical

high

high

high

critical

high

high

high