A guest can cause xen to crash [XSA-26, CVE-2012-5510] (#883082) An HVM guest can cause xen to run slowly or crash [XSA-27, CVE-2012-5511] (#883084) An HVM guest can cause xen to crash or leak information [XSA-28, CVE-2012-5512] (#883085) A PV guest can cause xen to crash and might be able escalate privileges [XSA-29, CVE-2012-5513] (#883088) An HVM guest can cause xen to hang [XSA-30, CVE-2012-5514] (#883091) A guest can cause xen to hang [XSA-31, CVE-2012-5515] (#883092)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201309-24 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Guest domains could possibly gain privileges, execute arbitrary code, or       cause a Denial of Service on the host domain (Dom0). Additionally, guest       domains could gain information about other virtual machines running on       the same host or read arbitrary files on the host.
  Workaround :

    The CVEs listed below do not currently have fixes, but only apply to Xen       setups which have &ldquo;tmem&rdquo; specified on the hypervisor command line.
      TMEM is not currently supported for use in production systems, and       administrators using tmem should disable it.
      Relevant CVEs:
      * CVE-2012-2497
      * CVE-2012-6030
      * CVE-2012-6031
      * CVE-2012-6032
      * CVE-2012-6033
      * CVE-2012-6034
      * CVE-2012-6035
      * CVE-2012-6036

This update fixes the following security issues in xen :

  - Grant table version switch list corruption vulnerability     (XSA-26). (CVE-2012-5510)

  - Several HVM operations do not validate the range of     their inputs (XSA-27). (CVE-2012-5511)

  - HVMOP_get_mem_access crash / HVMOP_set_mem_access     information leak (XSA-28). (CVE-2012-5512)

  - XENMEM_exchange may overwrite hypervisor memory     (XSA-29). (CVE-2012-5513)

  - Missing unlock in     guest_physmap_mark_populate_on_demand() (XSA-30).
    (CVE-2012-5514)

  - Several memory hypercall operations allow invalid extent     order values (XSA-31) Also the following bugs have been     fixed and upstream patches have been applied:.
    (CVE-2012-5515)

  - FATAL PAGE FAULT in hypervisor (arch_do_domctl)

  - 25931-x86-domctl-iomem-mapping-checks.patch

  - 26132-tmem-save-NULL-check.patch

  - 26134-x86-shadow-invlpg-check.patch

  - 26148-vcpu-timer-overflow.patch (Replaces     CVE-2012-4535-xsa20.patch)

  - 26149-x86-p2m-physmap-error-path.patch (Replaces     CVE-2012-4537-xsa22.patch)

  - 26150-x86-shadow-unhook-toplevel-check.patch (Replaces     CVE-2012-4538-xsa23.patch)

  - 26151-gnttab-compat-get-status-frames.patch (Replaces     CVE-2012-4539-xsa24.patch)

  - efi files missing in latest XEN update. (bnc#792476)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2012-0057 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

This update of XEN fixes various denial of service bugs.

  - bnc#789945 - CVE-2012-5510: xen: Grant table version     switch list corruption vulnerability (XSA-26)

  - bnc#789944 - CVE-2012-5511: xen: Several HVM operations     do not validate the range of their inputs (XSA-27)

  - bnc#789940 - CVE-2012-5512: xen: HVMOP_get_mem_access     crash / HVMOP_set_mem_access information leak (XSA-28)

  - bnc#789951 - CVE-2012-5513: xen: XENMEM_exchange may     overwrite hypervisor memory (XSA-29)

  - bnc#789948 - CVE-2012-5514: xen: Missing unlock in     guest_physmap_mark_populate_on_demand() (XSA-30)

  - bnc#789950 - CVE-2012-5515: xen: Several memory     hypercall operations allow invalid extent order values     (XSA-31)

  - bnc#789988 - FATAL PAGE FAULT in hypervisor     (arch_do_domctl)     25931-x86-domctl-iomem-mapping-checks.patch

  - Upstream patches from Jan     26132-tmem-save-NULL-check.patch     26134-x86-shadow-invlpg-check.patch     26148-vcpu-timer-overflow.patch (Replaces     CVE-2012-4535-xsa20.patch)     26149-x86-p2m-physmap-error-path.patch (Replaces     CVE-2012-4537-xsa22.patch)     26150-x86-shadow-unhook-toplevel-check.patch (Replaces     CVE-2012-4538-xsa23.patch)     26151-gnttab-compat-get-status-frames.patch (Replaces     CVE-2012-4539-xsa24.patch)

  - bnc#777628 - guest 'disappears' after live migration     Updated block-dmmd script

  - Fix exception in balloon.py and osdep.py     xen-max-free-mem.diff

  - bnc#792476 - efi files missing in latest XEN update     Revert c/s 25751 EFI Makefile changes in     23614-x86_64-EFI-boot.patch

XEN was updated to fix various denial of service issues.

  - bnc#789945 - CVE-2012-5510: xen: Grant table version     switch list corruption vulnerability (XSA-26)

  - bnc#789944 - CVE-2012-5511: xen: Several HVM operations     do not validate the range of their inputs (XSA-27)

  - bnc#789940 - CVE-2012-5512: xen: HVMOP_get_mem_access     crash / HVMOP_set_mem_access information leak (XSA-28)

  - bnc#789951 - CVE-2012-5513: xen: XENMEM_exchange may     overwrite hypervisor memory (XSA-29)

  - bnc#789948 - CVE-2012-5514: xen: Missing unlock in     guest_physmap_mark_populate_on_demand() (XSA-30)

  - bnc#789950 - CVE-2012-5515: xen: Several memory     hypercall operations allow invalid extent order values     (XSA-31)

  - bnc#789988 - FATAL PAGE FAULT in hypervisor     (arch_do_domctl)

  - Upstream patches from Jan     26132-tmem-save-NULL-check.patch     26134-x86-shadow-invlpg-check.patch     26148-vcpu-timer-overflow.patch (Replaces     CVE-2012-4535-xsa20.patch)     26149-x86-p2m-physmap-error-path.patch (Replaces     CVE-2012-4537-xsa22.patch)     26150-x86-shadow-unhook-toplevel-check.patch (Replaces     CVE-2012-4538-xsa23.patch)

  - bnc#777628 - guest 'disappears' after live migration     Updated block-dmmd script

  - Fix exception in balloon.py and osdep.py     xen-max-free-mem.diff

  - bnc#792476 - efi files missing in latest XEN update     Revert c/s 25751 EFI Makefile changes in     23614-x86_64-EFI-boot.patch

ID	Name	Product	Family	Published	Updated	Severity
63252	Fedora 17 : xen-4.1.3-7.fc17 (2012-19717)	Nessus	Fedora Local Security Checks	12/13/2012	1/11/2021	medium
70184	GLSA-201309-24 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	9/28/2013	1/6/2021	high
63275	Fedora 16 : xen-4.1.3-6.fc16 (2012-19828)	Nessus	Fedora Local Security Checks	12/17/2012	1/11/2021	medium
64232	SuSE 11.2 Security Update : Xen (SAT Patch Number 7133)	Nessus	SuSE Local Security Checks	1/25/2013	1/19/2021	medium
79491	OracleVM 3.1 : xen (OVMSA-2012-0057)	Nessus	OracleVM Local Security Checks	11/26/2014	1/4/2021	medium
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	6/12/2015	1/4/2021	low
74852	openSUSE Security Update : xen (openSUSE-SU-2012:1685-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	medium
74850	openSUSE Security Update : xen (openSUSE-SU-2012:1687-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	medium

Detections

Analytics

Plugins Search

medium

high

medium

medium

medium

low

medium

medium