Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data leakage.

The remote host is affected by the vulnerability described in GLSA-202107-30 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote OracleVM system is missing necessary patches to address security updates:

  - Observable response discrepancy in some Intel(R) Processors may allow an authorized user to potentially     enable information disclosure via local access. (CVE-2021-0089)

  - Potential speculative code store bypass in all supported CPU products, in conjunction with software     vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect     speculation and could result in data leakage. (CVE-2021-26313)

  - x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort     speculative security vulnerability. Please see https://xenbits.xen.org/xsa/advisory-305.html for details.
    Mitigating TAA by disabling TSX (the default and preferred option) requires selecting a non-default     setting in MSR_TSX_CTRL. This setting isn't restored after S3 suspend. (CVE-2021-28690)

  - inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel     with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous     notification of the completion of such commands is not used. Instead, the issuing CPU spin-waits for the     completion of the most recently issued command(s). Some of these waiting loops try to apply a timeout to     fail overly-slow commands. The course of action upon a perceived timeout actually being detected is     inappropriate: - on Intel hardware guests which did not originally cause the timeout may be marked as     crashed, - on AMD hardware higher layer callers would not be notified of the issue, making them continue     as if the IOMMU operation succeeded. (CVE-2021-28692)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service or information leaks.

ID	Name	Product	Family	Severity
157004	GLSA-202107-30 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
151049	OracleVM 3.4 : xen (OVMSA-2021-0020)	Nessus	OracleVM Local Security Checks	high
150803	Debian DSA-4931-1 : xen - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-26313

medium

Tenable Plugins

high

high

high