Xen Grant Table Transfer Issues on Large Hosts Denial of Service Vulnerability (XSA-284)

high Nessus Plugin ID 134165

Language:

Synopsis

The remote Xen hypervisor installation is missing a security update.

Description

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a denial of service vulnerability. When the code processing grant table transfer requests finds a page with an address too large to be represented in the interface with the guest, it allocates a replacement page and copies page contents. However, the code doing so fails to set the newly allocated page's accounting properties correctly, resulting in the page becoming not only unusable by the target domain, but also unfreeable upon domain cleanup. The page as well as certain other remnants of an affected guest will be leaked. Furthermore, the internal state of the processing code was also not updated correctly, resulting in the insertion of an IOMMU mapping to the page being replaced (and subsequently freed), allowing the domain access to memory it does not own. The primary impact is a memory leak. Malicious or buggy guests with passed through PCI devices may also be able to escalate their privileges, crash the host, or access data belonging to other guests.

Solution

Apply the appropriate patch or workaround according to the vendor advisory.

Plugin Details

Severity: High

ID: 134165

File Name: xen_server_XSA-284.nasl

Version: 1.3

Type: local

Family: Misc.

Published: 2/28/2020

Updated: 6/3/2021

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.5

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.5

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C

CVSS Score Source: CVE-2019-17340

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:xen:xen

Required KB Items: Settings/ParanoidReport, installed_sw/Xen Hypervisor

Exploit Ease: No known exploits are available

Patch Publication Date: 3/5/2019

Vulnerability Publication Date: 3/5/2019

Reference Information

CVE: CVE-2019-17340

IAVB: 2019-B-0079-S

Detections

Analytics