The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3665-1 advisory.

  - x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in     ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is     why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In     AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit     guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for     virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect     Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative     execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For     more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not     architecturally protect ring 0 from predictions learnt in ring 1. For more details, see:
    https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-     speculation Similar situations may exist with other mitigations for other kinds of speculative execution     attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to     be discovered, disclosed, or mitigated. (CVE-2021-28689)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels     unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. To address XSA-401, code was     moved inside a function in Xen. This code movement missed a variable changing meaning / value between old     and new code positions. The now wrong use of the variable did lead to a wrong TLB flush condition,     omitting flushes where such are necessary. (CVE-2022-33745)

  - P2M pool freeing may take excessively long The P2M pool backing second level address translation for     guests may be of significant size. Therefore its freeing may take more time than is reasonable without     intermediate preemption checks. Such checking for the need to preempt was so far missing. (CVE-2022-33746)

  - lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was     inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a     result two cooperating guests granting each other transitive grants can cause locks to be acquired nested     within one another, but in respectively opposite order. With suitable timing between the involved grant     copy operations this may result in the locking up of a CPU. (CVE-2022-33748)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2022:3665-1)

high Nessus Plugin ID 166301

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.6 Jul 14, 2023, 4:28 PM Detection Plugin metadata Plugin Feed: 202307141628
Version 1.5 Jul 12, 2023, 5:37 PM Detection Plugin Feed: 202307121737
Version 1.4 Feb 8, 2023, 11:19 PM Logic Changes (Updated openSUSE package checks in SUSE plugins) Plugin Feed: 202302082319
Version 1.3 Jan 21, 2023, 5:26 AM Logic Changes (Added package checks for openSuSE) Plugin Feed: 202301210526
Version 1.2 Oct 20, 2022, 11:46 AM New Plugin Feed: 202210201146