This update for xen fixes several issues. These security issues were fixed :

  - CVE-2016-7092: The get_page_from_l3e function in     arch/x86/mm.c in Xen allowed local 32-bit PV guest OS     administrators to gain host OS privileges via vectors     related to L3 recursive pagetables (bsc#995785).

  - CVE-2016-7093: Xen allowed local HVM guest OS     administrators to overwrite hypervisor memory and     consequently gain host OS privileges by leveraging     mishandling of instruction pointer truncation during     emulation (bsc#995789).

  - CVE-2016-7094: Buffer overflow in Xen allowed local x86     HVM guest OS administrators on guests running with     shadow paging to cause a denial of service via a     pagetable update (bsc#995792).

  - CVE-2016-6836: Information leakage in     vmxnet3_complete_packet (bsc#994761).

  - CVE-2016-6888: Integer overflow in packet initialisation     in VMXNET3 device driver. Aprivileged user inside guest     c... (bsc#994772).

  - CVE-2016-6833: Use after free while writing     (bsc#994775).

  - CVE-2016-6835: Buffer overflow in     vmxnet_tx_pkt_parse_headers() in vmxnet3     deviceemulation. (bsc#994625).

  - CVE-2016-6834: An infinite loop during packet     fragmentation (bsc#994421).

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675).

  - CVE-2016-6259: Xen did not implement Supervisor Mode     Access Prevention (SMAP) whitelisting in 32-bit     exception and event delivery, which allowed local 32-bit     PV guest OS kernels to cause a denial of service     (hypervisor and VM crash) by triggering a safety check     (bsc#988676).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201611-09 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A malicious guest administrator could escalate their privileges on the       host system or cause a Denial of Service.  Additionally, a malicious       unprivileged guest user may be able to obtain or corrupt sensitive       information (including cryptographic material) in other programs in the       same guest.
  Workaround :

    There is no known workaround at this time.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2016-7094: Buffer overflow in Xen allowed local x86     HVM guest OS administrators on guests running with     shadow paging to cause a denial of service via a     pagetable update (bsc#995792)

  - CVE-2016-7092: The get_page_from_l3e function in     arch/x86/mm.c in Xen allowed local 32-bit PV guest OS     administrators to gain host OS privileges via vectors     related to L3 recursive pagetables (bsc#995785)

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675)

  - CVE-2016-5338: The (1) esp_reg_read and (2)     esp_reg_write functions allowed local guest OS     administrators to cause a denial of service (QEMU     process crash) or execute arbitrary code on the host via     vectors related to the information transfer buffer     (bsc#983984)

  - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c     might have allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via vectors related to reading from the     information transfer buffer in non-DMA mode (bsc#982960)

  - CVE-2014-3672: The qemu implementation in libvirt Xen     allowed local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or     stderr (bsc#981264)

  - CVE-2016-4441: The get_cmd function in the 53C9X Fast     SCSI Controller (FSC) support did not properly check DMA     length, which allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via unspecified vectors, involving an     SCSI command (bsc#980724)

  - CVE-2016-4439: The esp_reg_write function in the 53C9X     Fast SCSI Controller (FSC) support did not properly     check command buffer length, which allowed local guest     OS administrators to cause a denial of service     (out-of-bounds write and QEMU process crash) or     potentially execute arbitrary code on the host via     unspecified vectors (bsc#980716)

  - CVE-2016-3710: The VGA module improperly performed     bounds checking on banked access to video memory, which     allowed local guest OS administrators to execute     arbitrary code on the host by changing access modes     after setting the bank register, aka the 'Dark Portal'     issue (bsc#978164)

  - CVE-2016-4480: The guest_walk_tables function in     arch/x86/mm/guest_walk.c in Xen did not properly handle     the Page Size (PS) page table entry bit at the L4 and L3     page table levels, which might have allowed local guest     OS users to gain privileges via a crafted mapping of     memory (bsc#978295)

  - CVE-2016-3960: Integer overflow in the x86 shadow     pagetable code allowed local guest OS users to cause a     denial of service (host crash) or possibly gain     privileges by shadowing a superpage mapping (bsc#974038)

  - CVE-2016-3158: The xrstor function did not properly     handle writes to the hardware FSW.ES bit when running on     AMD64 processors, which allowed local guest OS users to     obtain sensitive register content information from     another guest by leveraging pending exception and mask     bits (bsc#973188)

  - CVE-2016-4001: Buffer overflow in the     stellaris_enet_receive function, when the Stellaris     ethernet controller is configured to accept large     packets, allowed remote attackers to cause a denial of     service (QEMU crash) via a large packet (bsc#975130)

  - CVE-2016-4002: Buffer overflow in the mipsnet_receive     function, when the guest NIC is configured to accept     large packets, allowed remote attackers to cause a     denial of service (memory corruption and QEMU crash) or     possibly execute arbitrary code via a packet larger than     1514 bytes (bsc#975138)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xsa224 xen: grant table operations mishandle reference counts (XSA-224) (CVE-2017-10921)

  - The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or stderr. (CVE-2014-3672)

  - Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary     code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS     set. (CVE-2015-3209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for xen fixes the following issues :

These security issues were fixed :

  - CVE-2016-7092: The get_page_from_l3e function in     arch/x86/mm.c in Xen allowed local 32-bit PV guest OS     administrators to gain host OS privileges via vectors     related to L3 recursive pagetables (bsc#995785)

  - CVE-2016-7093: Xen allowed local HVM guest OS     administrators to overwrite hypervisor memory and     consequently gain host OS privileges by leveraging     mishandling of instruction pointer truncation during     emulation (bsc#995789)

  - CVE-2016-7094: Buffer overflow in Xen allowed local x86     HVM guest OS administrators on guests running with     shadow paging to cause a denial of service via a     pagetable update (bsc#995792)

  - CVE-2016-7154: Use-after-free vulnerability in the FIFO     event channel code in Xen allowed local guest OS     administrators to cause a denial of service (host crash)     and possibly execute arbitrary code or obtain sensitive     information via an invalid guest frame number     (bsc#997731)

  - CVE-2016-6836: VMWARE VMXNET3 NIC device support was     leaging information leakage. A privileged user inside     guest could have used this to leak host memory bytes to     a guest (boo#994761)

  - CVE-2016-6888: Integer overflow in packet initialisation     in VMXNET3 device driver. A privileged user inside guest     could have used this flaw to crash the Qemu instance     resulting in DoS (bsc#994772)

  - CVE-2016-6833: Use-after-free issue in the VMWARE     VMXNET3 NIC device support. A privileged user inside     guest could have used this issue to crash the Qemu     instance resulting in DoS (boo#994775)

  - CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC     device support, causing an OOB read access (bsc#994625)

  - CVE-2016-6834: A infinite loop during packet     fragmentation in the VMWARE VMXNET3 NIC device support     allowed privileged user inside guest to crash the Qemu     instance resulting in DoS (bsc#994421)

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675)

  - CVE-2016-5403: The virtqueue_pop function in     hw/virtio/virtio.c in QEMU allowed local guest OS     administrators to cause a denial of service (memory     consumption and QEMU process crash) by submitting     requests without waiting for completion (boo#990923)

  - CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c,     when built with ESP/NCR53C9x controller emulation     support, allowed local guest OS administrators to cause     a denial of service (out-of-bounds write and QEMU     process crash) or execute arbitrary code on the host via     vectors involving DMA read into ESP command buffer     (bsc#990843)

  - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in     Xen allowed local 32-bit PV guest OS administrators to     gain host OS privileges by leveraging fast-paths for     updating pagetable entries (bsc#988675)

  - CVE-2016-5337: The megasas_ctrl_get_info function in     hw/scsi/megasas.c in QEMU allowed local guest OS     administrators to obtain sensitive host memory     information via vectors related to reading device     control information (bsc#983973)

  - CVE-2016-5338: The (1) esp_reg_read and (2)     esp_reg_write functions in hw/scsi/esp.c in QEMU allowed     local guest OS administrators to cause a denial of     service (QEMU process crash) or execute arbitrary code     on the QEMU host via vectors related to the information     transfer buffer (bsc#983984)

  - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c in     QEMU allowed local guest OS administrators to cause a     denial of service (out-of-bounds write and QEMU process     crash) via vectors related to reading from the     information transfer buffer in non-DMA mode (bsc#982960)

  - CVE-2016-4453: The vmsvga_fifo_run function in     hw/display/vmware_vga.c in QEMU allowed local guest OS     administrators to cause a denial of service (infinite     loop and QEMU process crash) via a VGA command     (bsc#982225)

  - CVE-2016-4454: The vmsvga_fifo_read_raw function in     hw/display/vmware_vga.c in QEMU allowed local guest OS     administrators to obtain sensitive host memory     information or cause a denial of service (QEMU process     crash) by changing FIFO registers and issuing a VGA     command, which triggers an out-of-bounds read     (bsc#982224)

  - CVE-2016-5126: Heap-based buffer overflow in the     iscsi_aio_ioctl function in block/iscsi.c in QEMU     allowed local guest OS users to cause a denial of     service (QEMU process crash) or possibly execute     arbitrary code via a crafted iSCSI asynchronous I/O     ioctl call (bsc#982286)

  - CVE-2016-5105: The megasas_dcmd_cfg_read function in     hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS     8708EM2 Host Bus Adapter emulation support, used an     uninitialized variable, which allowed local guest     administrators to read host memory via vectors involving     a MegaRAID Firmware Interface (MFI) command (bsc#982024)

  - CVE-2016-5106: The megasas_dcmd_set_properties function     in hw/scsi/megasas.c in QEMU, when built with MegaRAID     SAS 8708EM2 Host Bus Adapter emulation support, allowed     local guest administrators to cause a denial of service     (out-of-bounds write access) via vectors involving a     MegaRAID Firmware Interface (MFI) command (bsc#982025)

  - CVE-2016-5107: The megasas_lookup_frame function in     QEMU, when built with MegaRAID SAS 8708EM2 Host Bus     Adapter emulation support, allowed local guest OS     administrators to cause a denial of service     (out-of-bounds read and crash) via unspecified vectors     (bsc#982026)

  - CVE-2016-4963: The libxl device-handling allowed local     guest OS users with access to the driver domain to cause     a denial of service (management tool confusion) by     manipulating information in the backend directories in     xenstore (bsc#979670)

  - CVE-2016-4962: The libxl device-handling allowed local     OS guest administrators to cause a denial of service     (resource consumption or management facility confusion)     or gain host OS privileges by manipulating information     in guest controlled areas of xenstore (bsc#979620)

  - CVE-2016-4952: Out-of-bounds access issue in     pvsci_ring_init_msg/data routines (bsc#981276)

  - CVE-2014-3672: The qemu implementation in libvirt Xen     allowed local guest OS users to cause a denial of     service (host disk consumption) by writing to stdout or     stderr (bsc#981264)

  - CVE-2016-4441: The get_cmd function in the 53C9X Fast     SCSI Controller (FSC) support did not properly check DMA     length, which allowed local guest OS administrators to     cause a denial of service (out-of-bounds write and QEMU     process crash) via unspecified vectors, involving an     SCSI command (bsc#980724)

  - CVE-2016-4439: The esp_reg_write function in the 53C9X     Fast SCSI Controller (FSC) support did not properly     check command buffer length, which allowed local guest     OS administrators to cause a denial of service     (out-of-bounds write and QEMU process crash) or     potentially execute arbitrary code on the host via     unspecified vectors (bsc#980716)

  - CVE-2016-3710: The VGA module improperly performed     bounds checking on banked access to video memory, which     allowed local guest OS administrators to execute     arbitrary code on the host by changing access modes     after setting the bank register, aka the 'Dark Portal'     issue (bsc#978164)

  - CVE-2016-3960: Integer overflow in the x86 shadow     pagetable code allowed local guest OS users to cause a     denial of service (host crash) or possibly gain     privileges by shadowing a superpage mapping (bsc#974038)

  - CVE-2016-4037: The ehci_advance_state function in     hw/usb/hcd-ehci.c allowed local guest OS administrators     to cause a denial of service (infinite loop and CPU     consumption) via a circular split isochronous transfer     descriptor (siTD) list (bsc#976111)

  - CVE-2016-4020: The patch_instruction function did not     initialize the imm32 variable, which allowed local guest     OS administrators to obtain sensitive information from     host stack memory by accessing the Task Priority     Register (TPR) (bsc#975907)

  - CVE-2016-4001: Buffer overflow in the     stellaris_enet_receive function, when the Stellaris     ethernet controller is configured to accept large     packets, allowed remote attackers to cause a denial of     service (QEMU crash) via a large packet (bsc#975130)

  - CVE-2016-4002: Buffer overflow in the mipsnet_receive     function, when the guest NIC is configured to accept     large packets, allowed remote attackers to cause a     denial of service (memory corruption and QEMU crash) or     possibly execute arbitrary code via a packet larger than     1514 bytes (bsc#975138)

  - CVE-2016-3158: The xrstor function did not properly     handle writes to the hardware FSW.ES bit when running on     AMD64 processors, which allowed local guest OS users to     obtain sensitive register content information from     another guest by leveraging pending exception and mask     bits (bsc#973188)

  - CVE-2016-3159: The fpu_fxrstor function in     arch/x86/i387.c did not properly handle writes to the     hardware FSW.ES bit when running on AMD64 processors,     which allowed local guest OS users to obtain sensitive     register content information from another guest by     leveraging pending exception and mask bits (bsc#973188)

  - CVE-2016-4480: The guest_walk_tables function in     arch/x86/mm/guest_walk.c in Xen did not properly handle     the Page Size (PS) page table entry bit at the L4 and L3     page table levels, which might have allowed local guest     OS users to gain privileges via a crafted mapping of     memory (bsc#978295)

These non-security issues were fixed :

  - boo#991934: xen hypervisor crash in csched_acct 

  - boo#992224: [HPS Bug] During boot of Xen Hypervisor,     Failed to get contiguous memory for DMA from Xen 

  - boo#970135: new virtualization project clock test     randomly fails on Xen 

  - boo#971949 xl: Support (by ignoring) xl migrate --live.
    xl migrations are always live 

  - boo#990970: Add PMU support for Intel E7-8867 v4 (fam=6,     model=79) 

  - boo#985503: vif-route broken 

  - boo#978413: PV guest upgrade from sles11sp4 to sles12sp2     alpha3 failed on sles11sp4 xen host

  - boo#986586: out of memory (oom) during boot on 'modprobe     xenblk' (non xen kernel) 

  - boo#953339, boo#953362, boo#953518, boo#984981)     boo#953339, boo#953362, boo#953518, boo#984981:
    Implement SUSE specific unplug protocol for emulated PCI     devices in PVonHVM guests to qemu-xen-upstream 

  - boo#958848: HVM guest crash at /usr/src/packages/BUILD/     xen-4.4.2-testing/obj/default/balloon/balloon.c:407 

  - boo#982695: xen-4.5.2 qemu fails to boot HVM guest from     xvda 

  - boo#954872: script block-dmmd not working as expected 

  - boo#961600: L3: poor performance when Xen HVM domU     configured with max memory greater than current memory 

  - boo#979035: restore xm migrate fixes for boo#955399/     boo#955399 

  - boo#963161: Windows VM getting stuck during load while a     VF is assigned to it after upgrading to latest     maintenance updates boo#963161

  - boo#976058: Xen error running simple HVM guest (Post     Alpha 2 xen+qemu) 

  - boo#973631: AWS EC2 kdump issue 

  - boo#961100: Migrate a fv guest from sles12 to sles12sp1     on xen fails for 'Domain is not running on destination     host'. 

  - boo#964427: Discarding device blocks: failed -     Input/output error

ID	名稱	產品	系列	已發布	已更新	嚴重性
93935	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:2473-1) (Bunker Buster)	Nessus	SuSE Local Security Checks	2016/10/10	2021/1/6	high
94893	GLSA-201611-09 : Xen: Multiple vulnerabilities (Bunker Buster)	Nessus	Gentoo Local Security Checks	2016/11/15	2021/1/11	high
94267	SUSE SLES11 Security Update : xen (SUSE-SU-2016:2528-1) (Bunker Buster)	Nessus	SuSE Local Security Checks	2016/10/26	2021/1/19	critical
199537	RHEL 5 : xen (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical
93999	openSUSE Security Update : xen (openSUSE-2016-1169) (Bunker Buster)	Nessus	SuSE Local Security Checks	2016/10/12	2021/1/19	critical

偵測

搜尋 Plugin

high

high

critical

critical

critical