Xen Hypervisor Multiple Vulnerabilities (XSA-213 - XSA-215)

high Nessus Plugin ID 100124

Language:

Synopsis

The remote Xen hypervisor installation is missing a security update.

Description

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by multiple vulnerabilities :

- An information disclosure vulnerability exists in the get_user() function due to permissions for accessing MMIO ranges being checked only after accessing them. An attacker on the guest can exploit this to disclose potentially sensitive information in the host memory.

- A privilege escalation vulnerability exists when an IRET hypercall is placed within a multicall batch due to improper handling of kernel-mode access to pagetables.
An attacker on the guest can exploit this to access arbitrary system memory and gain elevated privileges on the host.

- A privilege escalation vulnerability exists in the steal_page() function within file xen/arch/x86/mm.c when transferring pages from one guest to another PV guest with a different bitness or an HVM guest. An attacker with access to multiple guests can exploit this to access arbitrary system memory and gain elevated privileges on the host.

- A flaw exists within arch/x86/x86_64/entry.S when handling failsafe callbacks due to improper validation of certain input. An attacker on the guest can exploit this to corrupt memory, potentially resulting in gaining elevated privileges.

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

Solution

Apply the appropriate patch according to the vendor advisory.

Plugin Details

Severity: High

ID: 100124

File Name: xen_server_XSA-215.nasl

Version: 1.6

Type: local

Family: Misc.

Published: 5/11/2017

Updated: 6/3/2021

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/o:xen:xen

Required KB Items: Settings/ParanoidReport, installed_sw/Xen Hypervisor

Patch Publication Date: 5/2/2017

Vulnerability Publication Date: 5/2/2017

Reference Information

IAVB: 2017-B-0050-S

Detections

Analytics