Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xsa224 xen: grant table operations mishandle reference counts (XSA-224) (CVE-2017-10921)

  - The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or stderr. (CVE-2014-3672)

  - Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary     code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS     set. (CVE-2015-3209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0039 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0153 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0142 for details.

xen: various flaws (#1447345) x86: 64bit PV guest breakout via pagetable use-after-mode-change [XSA-213] grant transfer allows PV guest to elevate privileges [XSA-214]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - BUILDINFO: xen     commit=74b662e79bc874fe8ad8a93d2891e6569c380004

  - BUILDINFO: QEMU upstream     commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - gnttab: __gnttab_unmap_common_complete is all-or-nothing     (Jan Beulich) [Orabug: 26288614]

  - gnttab: correct logic to get page references during map     requests (George Dunlap) [Orabug: 26288614]

  - gnttab: never create host mapping unless asked to (Jan     Beulich) 

  - gnttab: Fix handling of dev_bus_addr during unmap     (George Dunlap) 

  - x86/shadow: Hold references for the duration of emulated     writes (Andrew Cooper) [Orabug: 26288568]

  - x86/mm: disallow page stealing from HVM domains (Jan     Beulich) 

  - guest_physmap_remove_page needs its return value checked     (Jan Beulich) [Orabug: 26288602]

  - xen/memory: Fix return value handing of     guest_remove_page (Andrew Cooper) [Orabug: 26288602]

  - evtchn: avoid NULL derefs (Jan Beulich) [Orabug:
    26288583]

  - gnttab: correct maptrack table accesses (Jan Beulich)     [Orabug: 26288557]

  - gnttab: Avoid potential double-put of maptrack entry     (George Dunlap) 

  - gnttab: fix unmap pin accounting race (Jan Beulich)     [Orabug: 26288557]

  - IOMMU: handle IOMMU mapping and unmapping failures (Quan     Xu) [Orabug: 26288557]

  - xen/disk: don't leak stack data via response ring (Jan     Beulich) 

  - BUILDINFO: xen     commit=7b45c3eb48a884f56f072a97a9a8da4d0b1077ed

  - BUILDINFO: QEMU upstream     commit=44c5f0a55d9a73e592426c33ce5705c969681955

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - livepatch: Wrong usage of spinlock on debug console.
    (Konrad Rzeszutek Wilk) [Orabug: 26248311]

  - BUILDINFO: xen     commit=40e21e7aea2b8bbc991346c3f516dfac4f94affe

  - BUILDINFO: QEMU upstream     commit=44c5f0a55d9a73e592426c33ce5705c969681955

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - x86/do_invalid_op should use is_active_kernel_text     rather than having its (Konrad Rzeszutek Wilk) [Orabug:
    26129273]

  - BUILDINFO: xen     commit=0eadc919cf32139e5565e0d869ed09f35c0a3212

  - BUILDINFO: QEMU upstream     commit=44c5f0a55d9a73e592426c33ce5705c969681955

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - kexec: Add spinlock for the whole hypercall. (Konrad     Rzeszutek Wilk) 

  - kexec: clear kexec_image slot when unloading kexec image     (Bhavesh Davda) [Orabug: 25861742]

  - BUILDINFO: xen     commit=8b90d66cd941599d50ee80e14fd144e337814bf6

  - BUILDINFO: QEMU upstream     commit=44c5f0a55d9a73e592426c33ce5705c969681955

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - x86: correct create_bounce_frame (tagged with CVE     number) (Boris Ostrovsky) [Orabug: 25927739]     (CVE-2017-8905)

  - x86: discard type information when stealing pages     (tagged with CVE number) (Boris Ostrovsky) [Orabug:
    25927669] (CVE-2017-8904)

  - multicall: deal with early exit conditions (tagged with     CVE number) (Boris Ostrovsky) [Orabug: 25927592]     (CVE-2017-8903)

  - BUILDINFO: xen     commit=583dedab5ceddbae4d0384de0ade8feeee75f78c

  - BUILDINFO: QEMU upstream     commit=fcd17fdf18b95a9e408acc84f6d2b37cf3fc0335

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - tools/libxc: Set max_elem to zero in     xc_lockprof_query_number (Boris Ostrovsky) [Orabug:
    26020611]

Multiple vulnerabilities have been discovered in the Xen hypervisor.
The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2016-9932 (XSA-200)

CMPXCHG8B emulation allows local HVM guest OS users to obtain sensitive information from host stack memory.

CVE-2017-7995

Description Xen checks access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads.

CVE-2017-8903 (XSA-213)

Xen mishandles page tables after an IRET hypercall which can lead to arbitrary code execution on the host OS. The vulnerability is only exposed to 64-bit PV guests.

CVE-2017-8904 (XSA-214)

Xen mishandles the 'contains segment descriptors' property during GNTTABOP_transfer. This might allow PV guest OS users to execute arbitrary code on the host OS.

CVE-2017-8905 (XSA-215)

Xen mishandles a failsafe callback which might allow PV guest OS users to execute arbitrary code on the host OS.

For Debian 7 'Wheezy', these problems have been fixed in version 4.1.6.lts1-8.

We recommend that you upgrade your xen packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201705-11 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers and Xen Security Advisory referenced below for details.
  Impact :

    A local attacker could potentially execute arbitrary code with       privileges of Xen (QEMU) process on the host, gain privileges on the host       system, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

xen: various flaws (#1447345) x86: 64bit PV guest breakout via pagetable use-after-mode-change [XSA-213] grant transfer allows PV guest to elevate privileges [XSA-214] possible memory corruption via failsafe callback [XSA-215]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199537	RHEL 5 : xen (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195439	RHEL 5 : xsa213_xen (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
140019	OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
111992	OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
103830	OracleVM 3.4 : xen (OVMSA-2017-0153)	Nessus	OracleVM Local Security Checks	critical
102835	OracleVM 3.4 : xen (OVMSA-2017-0142)	Nessus	OracleVM Local Security Checks	critical
101659	Fedora 26 : xen (2017-77ca39d254)	Nessus	Fedora Local Security Checks	high
101195	OracleVM 3.4 : xen (OVMSA-2017-0116)	Nessus	OracleVM Local Security Checks	high
100575	Debian DLA-964-1 : xen security update	Nessus	Debian Local Security Checks	high
100443	GLSA-201705-11 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
100198	Fedora 24 : xen (2017-c9d71f0860)	Nessus	Fedora Local Security Checks	high
100189	Fedora 25 : xen (2017-5ae70ac6a5)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-8903

high

Tenable Plugins

critical

high

critical

critical

critical

critical

high

high

high

high

high

high