An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no guarantee when all the writes will reach the memory.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, privilege escalation or memory disclosure.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-47f53a940a advisory.

  - An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory     accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones     during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the     operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no     guarantee when all the writes will reach the memory. (CVE-2021-26933)

  - An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation     (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this     wasn't stated accordingly in its support status entry. (CVE-2021-26934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-4c819bf1ad advisory.

  - An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory     accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones     during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the     operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no     guarantee when all the writes will reach the memory. (CVE-2021-26933)

  - An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation     (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this     wasn't stated accordingly in its support status entry. (CVE-2021-26934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an information disclosure vulnerability. On Arm, a guest is allowed to control whether memory access bypass the cache. This means that Xen needs to ensure that all writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Unfortunately the operation to clean the cache happens before checking if the page was scrubbed. Therefore there is no guarantee when all the writes will reach the memory. A malicious guest may be able to read sensitive data from memory that previously belonged to another guest.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

ID	Name	Product	Family	Severity
148444	Debian DSA-4888-1 : xen - security update	Nessus	Debian Local Security Checks	high
146913	Fedora 33 : xen (2021-47f53a940a)	Nessus	Fedora Local Security Checks	high
146901	Fedora 32 : xen (2021-4c819bf1ad)	Nessus	Fedora Local Security Checks	high
146596	Xen Scrubbed Pages Cache Information Disclosure (XSA-364)	Nessus	Misc.	medium

Detections

Analytics

CVE-2021-26933

medium

Tenable Plugins

high

high

high

medium