Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the get_user function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xsa224 xen: grant table operations mishandle reference counts (XSA-224) (CVE-2017-10921)

  - The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or stderr. (CVE-2014-3672)

  - Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary     code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS     set. (CVE-2015-3209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

Multiple vulnerabilities have been discovered in the Xen hypervisor.
The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2016-9932 (XSA-200)

CMPXCHG8B emulation allows local HVM guest OS users to obtain sensitive information from host stack memory.

CVE-2017-7995

Description Xen checks access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads.

CVE-2017-8903 (XSA-213)

Xen mishandles page tables after an IRET hypercall which can lead to arbitrary code execution on the host OS. The vulnerability is only exposed to 64-bit PV guests.

CVE-2017-8904 (XSA-214)

Xen mishandles the 'contains segment descriptors' property during GNTTABOP_transfer. This might allow PV guest OS users to execute arbitrary code on the host OS.

CVE-2017-8905 (XSA-215)

Xen mishandles a failsafe callback which might allow PV guest OS users to execute arbitrary code on the host OS.

For Debian 7 'Wheezy', these problems have been fixed in version 4.1.6.lts1-8.

We recommend that you upgrade your xen packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several security issues :

  - A malicious 64-bit PV guest may be able to access all of     system memory, allowing for all of privilege escalation,     host crashes, and information leaks by placing a IRET     hypercall in the middle of a multicall batch (XSA-213,     bsc#1034843)

  - A malicious pair of guests may be able to access all of     system memory, allowing for all of privilege escalation,     host crashes, and information leaks because of a missing     check when transfering pages via GNTTABOP_transfer     (XSA-214, bsc#1034844).

  - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local     guest OS privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) via vectors     related to copying VGA data via the     cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_     functions (bsc#1034994).

  - CVE-2016-9603: A privileged user within the guest VM     could have caused a heap overflow in the device model     process, potentially escalating their privileges to that     of the device model process (bsc#1028655)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199537	RHEL 5 : xen (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196575	RHEL 5 : xen (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
100575	Debian DLA-964-1 : xen security update	Nessus	Debian Local Security Checks	high
99961	SUSE SLES11 Security Update : xen (SUSE-SU-2017:1146-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-7995

low

Tenable Plugins

critical

critical

high

critical