The remote OracleVM system is missing necessary patches to address critical security updates :

  - From: Jan Beulich Subject: x86/paging: don't     unconditionally BUG on finding SHARED_M2P_ENTRY PV     guests can fully control the values written into the     P2M. This is XSA-251. (CVE-2017-17565)

  - From: Jan Beulich Subject: x86/shadow: fix ref-counting     error handling The old-Linux handling in shadow_set_l4e     mistakenly ORed together the results of sh_get_ref and     sh_pin. As the latter failing is not a correctness     problem, simply ignore its return value. In     sh_set_toplevel_shadow a failing sh_get_ref must not be     accompanied by installing the entry, despite the domain     being crashed. This is XSA-250. (CVE-2017-17564)

  - From: Jan Beulich Subject: x86/shadow: fix refcount     overflow check Commit c385d27079 ('x86 shadow: for     multi-page shadows, explicitly track the first page')     reduced the refcount width to 25, without adjusting the     overflow check. Eliminate the disconnect by using a     manifest constant. Interestingly, up to commit     047782fa01 ('Out-of-sync L1 shadows: OOS snapshot') the     refcount was 27 bits wide, yet the check was already     using 26. This is XSA-249. v2: Simplify expression back     to the style it was. (CVE-2017-17563)

  - From: Jan Beulich Subject: x86/mm: don't wrongly set     page ownership PV domains can obtain mappings of any     pages owned by the correct domain, including ones that     aren't actually assigned as 'normal' RAM, but used by     Xen internally. At the moment such 'internal' pages     marked as owned by a guest include pages used to track     logdirty bits, as well as p2m pages and the 'unpaged     pagetable' for HVM guests. Since the PV memory     management and shadow code conflict in their use of     struct page_info fields, and since shadow code is being     used for log-dirty handling for PV domains, pages coming     from the shadow pool must, for PV domains, not have the     domain set as their owner. While the change could be     done conditionally for just the PV case in shadow code,     do it unconditionally (and for consistency also for     HAP), just to be on the safe side. There's one special     case though for shadow code: The page table used for     running a HVM guest in unpaged mode is subject to     get_page (in set_shadow_status) and hence must have its     owner set. This is XSA-248.

    Conflict: xen/arch/x86/mm/hap/hap.c     xen/arch/x86/mm/shadow/common.c (CVE-2017-17566)

Detections

Analytics

OracleVM 3.2 : xen (OVMSA-2018-0225)

high Nessus Plugin ID 110305

Version 1.6

Version 1.5

Version 1.4

Version 1.6 Apr 1, 2025, 8:58 AM CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H") CVSSv3 score source (changed from "manual" to none) Plugin Feed: 202504010858
Version 1.5 Feb 18, 2025, 11:54 PM Plugin metadata (CVSS 3 Change AC:H --> AC:L where needed) Plugin Feed: 202502182354
Version 1.4 Sep 26, 2024, 8:11 AM CVSSv2 score source (set to "CVE-2017-17566") Plugin Feed: 202409260811