The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2599-1 advisory.

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially     leading to information disclosure. (CVE-2022-23825)

  - x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition     to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g.
    PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately,     the logic for acquiring a type reference has a race condition, whereby a safely TLB flush is issued too     early and creates a window where the guest can re-establish the read/write mapping before writeability is     prohibited. (CVE-2022-26362)

  - x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple     CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type     reference count for pages, in addition to a regular reference count. This scheme is used to maintain     invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables;
    updates need auditing by Xen. Unfortunately, Xen's safety logic doesn't account for CPU-induced cache non-     coherency; cases where the CPU can cause the content of the cache to be different to the content in main     memory. In such cases, Xen's safety logic can incorrectly conclude that the contents of a page is safe.
    (CVE-2022-26363, CVE-2022-26364)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels     unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. To address XSA-401, code was     moved inside a function in Xen. This code movement missed a variable changing meaning / value between old     and new code positions. The now wrong use of the variable did lead to a wrong TLB flush condition,     omitting flushes where such are necessary. (CVE-2022-33745)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2022:2599-1)

high Nessus Plugin ID 163645

Version 1.8