OracleVM 3.1 : xen (OVMSA-2014-0002)

medium Nessus Plugin ID 79530

Language:

Synopsis

The remote OracleVM host is missing one or more security updates.

Description

The remote OracleVM system is missing necessary patches to address critical security updates :

- flask: restrict allocations done by hypercall interface Other than in 4.2 and newer, we're not having an overflow issue here, but uncontrolled exposure of the operations opens the host to be driven out of memory by an arbitrary guest. Since all operations other than FLASK_LOAD simply deal with ASCII strings, limiting the allocations (and incoming buffer sizes) to a page worth of memory seems like the best thing we can do.
Consequently, in order to not expose the larger allocation to arbitrary guests, the permission check for FLASK_LOAD needs to be pulled ahead of the allocation (and it's perhaps worth noting that - afaict - it was pointlessly done with the sel_sem spin lock held). Note that this breaks FLASK_AVC_CACHESTATS on systems with sufficiently many CPUs (as requiring a buffer bigger than PAGE_SIZE there). No attempt is made to address this here, as it would needlessly complicate this fix with rather little gain. This is XSA-84.

The index of boolean variables in FLASK_[GET,SET]BOOL was not always checked against the bounds of the array.

18205387] (CVE-2014-1892, CVE-2014-1893)

- libxc: Fix out-of-memory error handling in xc_cpupool_getinfo Avoid freeing info then returning it to the caller. This is XSA-88. Coverity-ID: 1056192

18206144] [CVE-2014-XXXX]

Solution

Update the affected xen / xen-devel / xen-tools packages.

Plugin Details

Severity: Medium

ID: 79530

File Name: oraclevm_OVMSA-2014-0002.nasl

Version: 1.5

Type: local

Family: OracleVM Local Security Checks

Published: 11/26/2014

Updated: 1/4/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5.2

Temporal Score: 4.5

Vector: CVSS2#AV:A/AC:M/Au:S/C:N/I:N/A:C

Vulnerability Information

CPE: p-cpe:/a:oracle:vm:xen, p-cpe:/a:oracle:vm:xen-devel, p-cpe:/a:oracle:vm:xen-tools, cpe:/o:oracle:vm_server:3.1

Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 2/13/2014

Vulnerability Publication Date: 4/1/2014

Reference Information

CVE: CVE-2014-1892, CVE-2014-1893

BID: 65419

Detections

Analytics