The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0830-1 advisory.

  - The vulnerability allows a malicious guest to gain access to sensitive information. The vulnerability     exists due to an error in phantom functions implementation for PCI devices. Under certain circumstances a     malicious guest assigned a PCI device with phantom functions may be able to access memory from a previous     owner of the device. (CVE-2023-46839)

  - The vulnerability allows a malicious guest to bypass implemented security restrictions. The vulnerability     exists due to incorrect placement of a preprocessor directive in source code, which results in a logic     error when support for HVM guests is compiled out of Xen and CONFIG_HVM is disabled at Xen's build time.
    When a device is removed from a domain, it is not properly quarantined and retains its access to the     domain to which it was previously assigned. An attacker with control over a malicious guest can retain     access to the domain after it has been removed from it (CVE-2023-46840)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-0da80aa623 advisory.

  - Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET). A sub-feature of this     are Shadow Stacks (CET-SS). CET-SS is a hardware feature designed to protect against Return Oriented     Programming attacks. When enabled, traditional stacks holding both data and return addresses are     accompanied by so called shadow stacks, holding little more than return addresses. Shadow stacks aren't     writable by normal instructions, and upon function returns their contents are used to check for possible     manipulation of a return address coming from the traditional stack. In particular certain memory accesses     need intercepting by Xen. In various cases the necessary emulation involves kind of replaying of the     instruction. Such replaying typically involves filling and then invoking of a stub. Such a replayed     instruction may raise an exceptions, which is expected and dealt with accordingly. Unfortunately the     interaction of both of the above wasn't right: Recovery involves removal of a call frame from the     (traditional) stack. The counterpart of this operation for the shadow stack was missing. (CVE-2023-46841)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-aca9ed1eb1 advisory.

  - Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET). A sub-feature of this     are Shadow Stacks (CET-SS). CET-SS is a hardware feature designed to protect against Return Oriented     Programming attacks. When enabled, traditional stacks holding both data and return addresses are     accompanied by so called shadow stacks, holding little more than return addresses. Shadow stacks aren't     writable by normal instructions, and upon function returns their contents are used to check for possible     manipulation of a return address coming from the traditional stack. In particular certain memory accesses     need intercepting by Xen. In various cases the necessary emulation involves kind of replaying of the     instruction. Such replaying typically involves filling and then invoking of a stub. Such a replayed     instruction may raise an exceptions, which is expected and dealt with accordingly. Unfortunately the     interaction of both of the above wasn't right: Recovery involves removal of a call frame from the     (traditional) stack. The counterpart of this operation for the shadow stack was missing. (CVE-2023-46841)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3a36322c4b advisory.

  - Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET). A sub-feature of this     are Shadow Stacks (CET-SS). CET-SS is a hardware feature designed to protect against Return Oriented     Programming attacks. When enabled, traditional stacks holding both data and return addresses are     accompanied by so called shadow stacks, holding little more than return addresses. Shadow stacks aren't     writable by normal instructions, and upon function returns their contents are used to check for possible     manipulation of a return address coming from the traditional stack. In particular certain memory accesses     need intercepting by Xen. In various cases the necessary emulation involves kind of replaying of the     instruction. Such replaying typically involves filling and then invoking of a stub. Such a replayed     instruction may raise an exceptions, which is expected and dealt with accordingly. Unfortunately the     interaction of both of the above wasn't right: Recovery involves removal of a call frame from the     (traditional) stack. The counterpart of this operation for the shadow stack was missing. (CVE-2023-46841)

  - Information exposure through microarchitectural state after transient execution from some register files     for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable information     disclosure via local access. (CVE-2023-28746)

  - A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting     speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit     this vulnerability to disclose arbitrary data from the CPU using race conditions to access the speculative     executable code paths. (CVE-2024-2193)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1102-1 advisory.

  - Information exposure through microarchitectural state after transient execution from some register files     for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable information     disclosure via local access. (CVE-2023-28746)

  - Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET). A sub-feature of this     are Shadow Stacks (CET-SS). CET-SS is a hardware feature designed to protect against Return Oriented     Programming attacks. When enabled, traditional stacks holding both data and return addresses are     accompanied by so called shadow stacks, holding little more than return addresses. Shadow stacks aren't     writable by normal instructions, and upon function returns their contents are used to check for possible     manipulation of a return address coming from the traditional stack. In particular certain memory accesses     need intercepting by Xen. In various cases the necessary emulation involves kind of replaying of the     instruction. Such replaying typically involves filling and then invoking of a stub. Such a replayed     instruction may raise an exceptions, which is expected and dealt with accordingly. Unfortunately the     interaction of both of the above wasn't right: Recovery involves removal of a call frame from the     (traditional) stack. The counterpart of this operation for the shadow stack was missing. (CVE-2023-46841)

  - A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting     speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit     this vulnerability to disclose arbitrary data from the CPU using race conditions to access the speculative     executable code paths. (CVE-2024-2193)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
191896	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xen (SUSE-SU-2024:0830-1)	Nessus	SuSE Local Security Checks	3/12/2024	3/13/2024	medium
192050	Fedora 38 : xen (2024-0da80aa623)	Nessus	Fedora Local Security Checks	3/13/2024	4/29/2024	medium
192051	Fedora 39 : xen (2024-aca9ed1eb1)	Nessus	Fedora Local Security Checks	3/13/2024	4/29/2024	medium
194569	Fedora 40 : xen (2024-3a36322c4b)	Nessus	Fedora Local Security Checks	4/29/2024	4/29/2024	medium
193062	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xen (SUSE-SU-2024:1102-1)	Nessus	SuSE Local Security Checks	4/9/2024	4/9/2024	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium