OracleVM 3.2 : xen (OVMSA-2016-0090)

high Nessus Plugin ID 92602

Language:

Synopsis

The remote OracleVM host is missing one or more security updates.

Description

The remote OracleVM system is missing necessary patches to address critical security updates :

- x86/HVM: correct CPUID leaf 80000008 handling - 6c733e54 xsa173_01_0001-x86-HVM-correct-CPUID-leaf-80000008-handl ing.patch was based on upstream commit:
ef437690af8b75e6758dce77af75a22b63982883 x86/HVM:
correct CPUID leaf 80000008 handling It should have been based on upstream commit:
6c733e549889a9b8c4e03140348b8e00241d4ce9 x86/HVM:
correct CPUID leaf 80000008 handling The changes in this patch are the differences between those two patches.

- x86/pv: Remove unsafe bits from the mod_l?_entry fastpath All changes in writeability and cacheability must go through full re-validation. Rework the logic as a whitelist, to make it clearer to follow. This is XSA-182

Upstream commit 798c1498f764bfaa7b0b955bab40b01b0610d372 Conflicts: xen/include/asm-x86/page.h

- x86/mm: fully honor PS bits in guest page table walks In L4 entries it is currently unconditionally reserved (and hence should, when set, always result in a reserved bit page fault), and is reserved on hardware not supporting 1Gb pages (and hence should, when set, similarly cause a reserved bit page fault on such hardware). This is CVE-2016-4480 / XSA-176. (CVE-2016-4480)

- x86/mm: Handle 1GiB superpages in the pagetable walker.
This allows HAP guests to use 1GiB superpages. Shadow and PV guests still can't use them without more support in shadow/* and mm.c.

Conflicts: xen/arch/x86/hvm/hvm.c xen/arch/x86/mm/guest_walk.c Backported from upstream commit 96b740e209d0bea4c16d93211ceb139fc98d10c2 (CVE-2016-4480)

- main loop: Big hammer to fix logfile disk DoS in Xen setups Each time round the main loop, we now fstat stderr. If it is too big, we dup2 /dev/null onto it.
This is not a very pretty patch but it is very simple, easy to see that it's correct, and has a low risk of collateral damage. The limit is 1Mby by default but can be adjusted by setting a new environment variable. This fixes CVE-2014-3672. (CVE-2014-3672)

- x86: make hvm_cpuid tolerate NULL pointers Now that other HVM code started making more extensive use of hvm_cpuid, let's not force every caller to declare dummy variables for output not cared about.

xen/arch/x86/hvm/svm/svm.c and xen/arch/x86/hvm/vmx/vvmx.c part are removed as no source matched. Upstream commit 11b85dbd0ab068bad3beadda3aee2298205a3c01

- x86: limit GFNs to 32 bits for shadowed superpages.
Superpage shadows store the shadowed GFN in the backpointer field, which for non-BIGMEM builds is 32 bits wide. Shadowing a superpage mapping of a guest-physical address above 2^44 would lead to the GFN being truncated there, and a crash when we come to remove the shadow from the hash table. Track the valid width of a GFN for each guest, including reporting it through CPUID, and enforce it in the shadow pagetables.
Set the maximum witth to 32 for guests where this truncation could occur. This is XSA-173.

Conflicts: xen/arch/x86/cpu/common.c arch/x86/mm/guest_walk.c Upstream commit 95dd1b6e87b61222fc856724a5d828c9bdc30c80 (CVE-2016-3960)

- x86/HVM: correct CPUID leaf 80000008 handling CPUID[80000008].EAX[23:16] have been given the meaning of the guest physical address restriction (in case it needs to be smaller than the host's), hence we need to mirror that into vCPUID[80000008].EAX[7:0]. Enforce a lower limit at the same time, as well as a fixed value for the virtual address bits, and zero for the guest physical address ones. In order for the vMTRR code to see these overrides we need to make it call hvm_cpuid instead of domain_cpuid, which in turn requires special casing (and relaxing) the controlling domain. This additionally should hide an ordering problem in the tools: Both xend and xl appear to be restoring a guest from its image before setting up the CPUID policy in the hypervisor, resulting in domain_cpuid returning all zeros and hence the check in mtrr_var_range_msr_set failing if the guest previously had more than the minimum 36 physical address bits.

Conflicts: xen/arch/x86/hvm/mtrr.c Upstream commit ef437690af8b75e6758dce77af75a22b63982883 (CVE-2016-3960)

Solution

Update the affected xen / xen-devel / xen-tools packages.

Plugin Details

Severity: High

ID: 92602

File Name: oraclevm_OVMSA-2016-0090.nasl

Version: 2.7

Type: local

Family: OracleVM Local Security Checks

Published: 7/28/2016

Updated: 1/4/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.5

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:oracle:vm:xen, p-cpe:/a:oracle:vm:xen-devel, p-cpe:/a:oracle:vm:xen-tools, cpe:/o:oracle:vm_server:3.2

Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 7/27/2016

Vulnerability Publication Date: 4/19/2016

Reference Information

CVE: CVE-2014-3672, CVE-2016-3960, CVE-2016-4480

Detections

Analytics