An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin would be accompanied by a suitable page reference. Other portions of code, however, did not match up with that assumption. When such a grant copy operation is being done on a grant of a dying domain, the assumption turns out wrong. A malicious guest administrator can cause hypervisor memory corruption, most likely resulting in host crash and a Denial of Service. Privilege escalation and information leaks cannot be ruled out.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xsa224 xen: grant table operations mishandle reference counts (XSA-224) (CVE-2017-10921)

  - The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or stderr. (CVE-2014-3672)

  - Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary     code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS     set. (CVE-2015-3209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0039 for details.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, informations leaks or privilege escalation.

For Debian 8 'Jessie', these problems have been fixed in version 4.4.4lts2-0+deb8u1.

We recommend that you upgrade your xen packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details.

pin count / page reference race in grant table code [XSA-236, CVE-2017-15597] (#1506693)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.7.4 (bsc#1027519) fixes several issues.

This new feature was added :

  - Support migration of HVM domains larger than 1 TB

These security issues were fixed :

  - bsc#1068187: Failure to recognize errors in the Populate     on Demand (PoD) code allowed for DoS (XSA-246)

  - bsc#1068191: Missing p2m error checking in PoD code     allowed unprivileged guests to retain a writable mapping     of freed memory leading to information leaks, privilege     escalation or DoS (XSA-247).

  - CVE-2017-15289: The mode4and5 write functions allowed     local OS guest privileged users to cause a denial of     service (out-of-bounds write access and Qemu process     crash) via vectors related to dst calculation     (bsc#1063123)

  - CVE-2017-15597: A grant copy operation being done on a     grant of a dying domain allowed a malicious guest     administrator to corrupt hypervisor memory, allowing for     DoS or potentially privilege escalation and information     leaks (bsc#1061075).

This non-security issue was fixed :

  - bsc#1055047: Fixed --initrd-inject option in     virt-install

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for xen to version 4.9.1 (bsc#1027519) fixes several issues.

This new feature was added :

  - Support migration of HVM domains larger than 1 TB

These security issues were fixed :

  - bsc#1068187: Failure to recognize errors in the Populate     on Demand (PoD) code allowed for DoS (XSA-246)

  - bsc#1068191: Missing p2m error checking in PoD code     allowed unprivileged guests to retain a writable mapping     of freed memory leading to information leaks, privilege     escalation or DoS (XSA-247).

  - CVE-2017-15289: The mode4and5 write functions allowed     local OS guest privileged users to cause a denial of     service (out-of-bounds write access and Qemu process     crash) via vectors related to dst calculation     (bsc#1063123)

  - CVE-2017-15597: A grant copy operation being done on a     grant of a dying domain allowed a malicious guest     administrator to corrupt hypervisor memory, allowing for     DoS or potentially privilege escalation and information     leaks (bsc#1061075).

This non-security issue was fixed :

  - bsc#1055047: Fixed --initrd-inject option in     virt-install 

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for xen fixes several issues. These security issues were fixed :

  - bsc#1068187: Failure to recognize errors in the Populate     on Demand (PoD) code allowed for DoS (XSA-246)

  - bsc#1068191: Missing p2m error checking in PoD code     allowed unprivileged guests to retain a writable mapping     of freed memory leading to information leaks, privilege     escalation or DoS (XSA-247).

  - CVE-2017-15289: The mode4and5 write functions allowed     local OS guest privileged users to cause a denial of     service (out-of-bounds write access and Qemu process     crash) via vectors related to dst calculation     (bsc#1063123)

  - CVE-2017-15597: A grant copy operation being done on a     grant of a dying domain allowed a malicious guest     administrator to corrupt hypervisor memory, allowing for     DoS or potentially privilege escalation and information     leaks (bsc#1061075).

  - CVE-2017-15595: x86 PV guest OS users were able to cause     a DoS (unbounded recursion, stack consumption, and     hypervisor crash) or possibly gain privileges via     crafted page-table stacking (bsc#1061081).

  - CVE-2017-15592: x86 HVM guest OS users were able to     cause a DoS (hypervisor crash) or possibly gain     privileges because self-linear shadow mappings were     mishandled for translated guests (bsc#1061086).

  - CVE-2017-13672: The VGA display emulator support allowed     local guest OS privileged users to cause a denial of     service (out-of-bounds read and QEMU process crash) via     vectors involving display update (bsc#1056336)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues. These security issues were fixed :

  - bsc#1068187: Failure to recognize errors in the Populate     on Demand (PoD) code allowed for DoS (XSA-246)

  - bsc#1068191: Missing p2m error checking in PoD code     allowed unprivileged guests to retain a writable mapping     of freed memory leading to information leaks, privilege     escalation or DoS (XSA-247).

  - CVE-2017-15289: The mode4and5 write functions allowed     local OS guest privileged users to cause a denial of     service (out-of-bounds write access and Qemu process     crash) via vectors related to dst calculation     (bsc#1063123)

  - CVE-2017-15597: A grant copy operation being done on a     grant of a dying domain allowed a malicious guest     administrator to corrupt hypervisor memory, allowing for     DoS or potentially privilege escalation and information     leaks (bsc#1061075).

  - CVE-2017-15595: x86 PV guest OS users were able to cause     a DoS (unbounded recursion, stack consumption, and     hypervisor crash) or possibly gain privileges via     crafted page-table stacking (bsc#1061081).

  - CVE-2017-15592: x86 HVM guest OS users were able to     cause a DoS (hypervisor crash) or possibly gain     privileges because self-linear shadow mappings were     mishandled for translated guests (bsc#1061086).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.7.4 (bsc#1027519) fixes several issues. This new feature was added :

  - Support migration of HVM domains larger than 1 TB These     security issues were fixed :

  - bsc#1068187: Failure to recognize errors in the Populate     on Demand (PoD) code allowed for DoS (XSA-246)

  - bsc#1068191: Missing p2m error checking in PoD code     allowed unprivileged guests to retain a writable mapping     of freed memory leading to information leaks, privilege     escalation or DoS (XSA-247).

  - CVE-2017-15289: The mode4and5 write functions allowed     local OS guest privileged users to cause a denial of     service (out-of-bounds write access and Qemu process     crash) via vectors related to dst calculation     (bsc#1063123)

  - CVE-2017-15597: A grant copy operation being done on a     grant of a dying domain allowed a malicious guest     administrator to corrupt hypervisor memory, allowing for     DoS or potentially privilege escalation and information     leaks (bsc#1061075).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.9.1 (bsc#1027519) fixes several issues. This new feature was added :

  - Support migration of HVM domains larger than 1 TB These     security issues were fixed :

  - bsc#1068187: Failure to recognize errors in the Populate     on Demand (PoD) code allowed for DoS (XSA-246)

  - bsc#1068191: Missing p2m error checking in PoD code     allowed unprivileged guests to retain a writable mapping     of freed memory leading to information leaks, privilege     escalation or DoS (XSA-247).

  - CVE-2017-15289: The mode4and5 write functions allowed     local OS guest privileged users to cause a denial of     service (out-of-bounds write access and Qemu process     crash) via vectors related to dst calculation     (bsc#1063123)

  - CVE-2017-15597: A grant copy operation being done on a     grant of a dying domain allowed a malicious guest     administrator to corrupt hypervisor memory, allowing for     DoS or potentially privilege escalation and information     leaks (bsc#1061075).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, information leaks, privilege escalation or the execution of arbitrary code.

pin count / page reference race in grant table code [XSA-236, CVE-2017-15597]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - BUILDINFO: xen     commit=6c164f71ed0dc46201f1d69de65d05d138556fcc

  - BUILDINFO: QEMU upstream     commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - x86/cpu: fix IST handling during PCPU bringup (Andrew     Cooper) [Orabug: 26901427] (CVE-2017-15594)

  - x86/shadow: Don't create self-linear shadow mappings for     4-level translated guests (Andrew Cooper) [Orabug:
    26901416] (CVE-2017-15592)

  - x86: Disable the use of auto-translated PV guests     (Andrew Cooper) [Orabug: 26901416] (CVE-2017-15592)

  - x86: don't allow page_unlock to drop the last type     reference (Jan Beulich) [Orabug: 26901404]     (CVE-2017-15593)

  - x86: don't store possibly stale TLB flush time stamp     (Jan Beulich) [Orabug: 26901395] (CVE-2017-15588)

  - x86/mm: Disable PV linear pagetables by default (George     Dunlap) [Orabug: 26901366] (CVE-2017-15595)

  - x86: limit linear page table use to a single level (Jan     Beulich) [Orabug: 26901366] (CVE-2017-15595)

  - x86/HVM: prefill partially used variable on emulation     paths (Jan Beulich) [Orabug: 26901350] (CVE-2017-15589)

  - x86/FLASK: fix unmap-domain-IRQ XSM hook (Jan Beulich)     [Orabug: 26901322] (CVE-2017-15590)

  - x86/IRQ: conditionally preserve irq <-> pirq mapping on     map error paths (Jan Beulich) [Orabug: 26901322]     (CVE-2017-15590)

  - x86/MSI: disallow redundant enabling (Jan Beulich)     [Orabug: 26901322] (CVE-2017-15590)

  - x86: enforce proper privilege when (un)mapping pIRQ-s     (Jan Beulich) [Orabug: 26901322] (CVE-2017-15590)

  - x86: don't allow MSI pIRQ mapping on unowned device (Jan     Beulich) [Orabug: 26901322] (CVE-2017-15590)

  - gnttab: fix pin count / page reference race (Jan     Beulich) [Orabug: 26901282] (CVE-2017-15597)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a memory corruption vulnerability. This may allow an attacker on the guest to cause a denial of service or gain elevated privileges on the host.

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - BUILDINFO: OVMF     commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8

  - BUILDINFO: xen     commit=41067cbb7a1ecab6aa2ca0d8d40a4c9f36c5e76e

  - BUILDINFO: QEMU upstream     commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - x86/cpu: fix IST handling during PCPU bringup (Andrew     Cooper) [Orabug: 26901421] (CVE-2017-15594)

  - x86/shadow: Don't create self-linear shadow mappings for     4-level translated guests (Andrew Cooper) [Orabug:
    26901413] (CVE-2017-15592)

  - x86: Disable the use of auto-translated PV guests     (Andrew Cooper) [Orabug: 26901413] (CVE-2017-15592)

  - x86: don't allow page_unlock to drop the last type     reference (Jan Beulich) [Orabug: 26901401]     (CVE-2017-15593)

  - x86: don't store possibly stale TLB flush time stamp     (Jan Beulich) [Orabug: 26901391] (CVE-2017-15588)

  - x86/mm: Disable PV linear pagetables by default (George     Dunlap) [Orabug: 26901363] (CVE-2017-15595)

  - x86: limit linear page table use to a single level (Jan     Beulich) [Orabug: 26901363] (CVE-2017-15595)

  - x86/HVM: prefill partially used variable on emulation     paths (Jan Beulich) [Orabug: 26901338] (CVE-2017-15589)

  - x86/FLASK: fix unmap-domain-IRQ XSM hook (Jan Beulich)     [Orabug: 26901311] (CVE-2017-15590)

  - x86/IRQ: conditionally preserve irq <-> pirq mapping on     map error paths (Jan Beulich) [Orabug: 26901311]     (CVE-2017-15590)

  - x86/MSI: disallow redundant enabling (Jan Beulich)     [Orabug: 26901311] (CVE-2017-15590)

  - x86: enforce proper privilege when (un)mapping pIRQ-s     (Jan Beulich) [Orabug: 26901311] (CVE-2017-15590)

  - x86: don't allow MSI pIRQ mapping on unowned device (Jan     Beulich) [Orabug: 26901311] (CVE-2017-15590)

  - gnttab: fix pin count / page reference race (Jan     Beulich) [Orabug: 26901277] (CVE-2017-15597)

The version of Citrix XenServer installed on the remote host is missing a security hotfix. It is, therefore, affected by a memory corruption vulnerability as noted in the CTX229057 advisory.

ID	Name	Product	Family	Severity
199537	RHEL 5 : xen (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196596	RHEL 5 : xsa236_xen (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
140019	OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
118215	Debian DLA-1549-1 : xen security update	Nessus	Debian Local Security Checks	critical
111992	OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
105998	Fedora 27 : xen (2017-f05808ee5b)	Nessus	Fedora Local Security Checks	critical
105222	openSUSE Security Update : xen (openSUSE-2017-1322)	Nessus	SuSE Local Security Checks	critical
105221	openSUSE Security Update : xen (openSUSE-2017-1321)	Nessus	SuSE Local Security Checks	critical
105149	SUSE SLES11 Security Update : xen (SUSE-SU-2017:3242-1)	Nessus	SuSE Local Security Checks	critical
105148	SUSE SLES12 Security Update : xen (SUSE-SU-2017:3239-1)	Nessus	SuSE Local Security Checks	critical
105098	SUSE SLES12 Security Update : xen (SUSE-SU-2017:3236-1)	Nessus	SuSE Local Security Checks	critical
105033	SUSE SLES11 Security Update : xen (SUSE-SU-2017:3212-1)	Nessus	SuSE Local Security Checks	critical
104992	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:3178-1)	Nessus	SuSE Local Security Checks	critical
104870	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:3115-1)	Nessus	SuSE Local Security Checks	critical
104819	Debian DSA-4050-1 : xen - security update	Nessus	Debian Local Security Checks	critical
104607	Fedora 25 : xen (2017-c4aa57d753)	Nessus	Fedora Local Security Checks	critical
104249	OracleVM 3.4 : xen (OVMSA-2017-0166)	Nessus	OracleVM Local Security Checks	critical
104214	Xen Hypervisor Pin Count / Page Reference Grant Table Code Guest-to-Host Memory Corruption (XSA-236)	Nessus	Misc.	critical
104201	OracleVM 3.2 / 3.3 / 3.4 : xen (OVMSA-2017-0162)	Nessus	OracleVM Local Security Checks	critical
104174	Citrix XenServer Pin Count / Page Reference Grant Table Code Guest-to-Host Memory Corruption Vulnerability (CTX229057)	Nessus	Misc.	critical

Detections

Analytics

CVE-2017-15597

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical