The version of Citrix XenServer installed on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities as noted in the CTX225941 advisory.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - From e26560a4b056dad6d85ffd9ebfad9565f210a9cc Mon Sep 17     00:00:00 2001 From: Jan Beulich Date: Wed, 30 May 2012     09:22:17 +0100 Subject: [PATCH] gnttab: don't use domain     lock for serialization Instead use the affected domain's     grant table lock, at once reducing the scopes during     which locks are being held and hence allowing     significantly better parallelism.

    Committed-by: Keir Fraser Conflict:
    xen/common/grant_table.c xen/arch/x86/mm.c

  - From: Jan Beulich Subject: gnttab: correct pin status     fixup for copy Regardless of copy operations only     setting GNTPIN_hst*, GNTPIN_dev* also need to be taken     into account when deciding whether to clear
    _GTF_[read,writ]ing. At least for consistency with code     elsewhere the read part better doesn't use any mask at     all. This is XSA-230. (CVE-2017-12855)

  - From 3aab881c7331cf93ffd8d2f2dd9adfd18ed4fc99 Mon Sep 17     00:00:00 2001 From: Andrew Cooper Date: Tue, 20 Jun 2017     19:18:54 +0100 Subject: [PATCH] x86/grant: Disallow     misaligned PTEs Pagetable entries must be aligned to     function correctly. Disallow attempts from the guest to     have a grant PTE created at a misaligned address, which     would result in corruption of the L1 table with     largely-guest-controlled values. This is XSA-227     (CVE-2017-12137)

  - Prerequisite patch for xsa227-4.5.patch There is no     macro ASSERT_UNREACHABLE before OVM3.4 which is needed     by xsa227-4.5.patch This chunk is picked from upstream     commit cacdb0faaa121ac8f792d5bd34cc6bc7c72d21da     (CVE-2017-12137)

  - From: Andrew Cooper Subject: grant_table: Default to v1,     and disallow transitive grants The reference counting     and locking discipline for transitive grants is broken.
    Their use is therefore declared out of security support.
    This is XSA-226. Transitive grants are expected to be     unconditionally available with grant table v2. Hiding     transitive grants alone is an ABI breakage for the     guest. Modern versions of Linux and the Windows PV     drivers use grant table v1, but older versions did use     v2. In principle, disabling gnttab v2 entirely is the     safer way to cause guests to avoid using transitive     grants. However, some older guests which defaulted to     using gnttab v2 don't tolerate falling back from v2 to     v1 over migrate. This patch introduces a new command     line option to control grant table behaviour. One     suboption allows a choice of the maximum grant table     version Xen will allow the guest to use, and defaults to     v2. A different suboption independently controls whether     transitive grants can be used. The default case is:
    gnttab=max_ver:2 To disable gnttab v2 entirely, use:
    gnttab=max_ver:1 To allow gnttab v2 and transitive     grants, use: gnttab=max_ver:2,transitive

    Ignore the chunk for docs/misc/xen-command-line.markdown     as no such file for OVM3.2 (CVE-2017-12135)

  - From 8aed1f12c4c087c5b31cbee8636b3d2d25efb363 Mon Sep 17     00:00:00 2001 From: Andres Lagar-Cavilla Date: Wed, 22     Aug 2012 22:27:50 +0100 Subject: [PATCH] Fix shared     entry status for grant copy operation on paged-out g fn     The unwind path was not clearing the shared entry status     bits. This was BSOD-ing guests on network activity under     certain configurations. Also: * sed the fixup method     name to signal it's related to grant copy. * use atomic     clear flag ops during fixup.

    Committed-by: Keir Fraser Conflict:
    xen/common/grant_table.c Prerequisite patch for XSA-226     fix (CVE-2017-12135)

  - From 69549b08eb9bd3a525c07a97d952673a3d02c76a Mon Sep 17     00:00:00 2001 From: Annie Li Date: Fri, 7 Jul 2017     14:36:08 -0400 Subject: [PATCH] xen: increase default     max grant frames and max maptrack frames Commit     9dfba034e increase default max grant frames to 128 which     is still not enough when the guest has more cpus and     vbd/vif devices, so set it to 256. Also the default max     maptrack frames needs to be increased accordingly.

Qemu: serial: host memory leakage 16550A UART emulation [CVE-2017-5579] (#1416162) Qemu: display: cirrus: OOB read access issue [CVE-2017-7718] (#1443444) xen: various flaws (#1481765) multiple problems with transitive grants [XSA-226, CVE-2017-12135] x86: PV privilege escalation via map_grant_ref [XSA-227, CVE-2017-12137] grant_table: Race conditions with maptrack free list handling [XSA-228, CVE-2017-12136] grant_table: possibly premature clearing of GTF_writing / GTF_reading [XSA-230, CVE-2017-12855]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - From: Jan Beulich Subject: gnttab: correct pin status     fixup for copy Regardless of copy operations only     setting GNTPIN_hst*, GNTPIN_dev* also need to be taken     into account when deciding whether to clear
    _GTF_[read,writ]ing. At least for consistency with code     elsewhere the read part better doesn't use any mask at     all. This is XSA-230. (CVE-2017-12855)

  - From: Andrew Cooper Subject: grant_table: Default to v1,     and disallow transitive grants The reference counting     and locking discipline for transitive grants is broken.
    Their use is therefore declared out of security support.
    This is XSA-226. Transitive grants are expected to be     unconditionally available with grant table v2. Hiding     transitive grants alone is an ABI breakage for the     guest. Modern versions of Linux and the Windows PV     drivers use grant table v1, but older versions did use     v2. In principle, disabling gnttab v2 entirely is the     safer way to cause guests to avoid using transitive     grants. However, some older guests which defaulted to     using gnttab v2 don't tolerate falling back from v2 to     v1 over migrate. This patch introduces a new command     line option to control grant table behaviour. One     suboption allows a choice of the maximum grant table     version Xen will allow the guest to use, and defaults to     v2. A different suboption independently controls whether     transitive grants can be used. The default case is:
    gnttab=max_ver:2 To disable gnttab v2 entirely, use:
    gnttab=max_ver:1 To allow gnttab v2 and transitive     grants, use: gnttab=max_ver:2,transitive

    Conflict: docs/misc/xen-command-line.markdown     (CVE-2017-12135)

  - Revert wrong fix for xsa226 [bug 26567225]

  - From 3aab881c7331cf93ffd8d2f2dd9adfd18ed4fc99 Mon Sep 17     00:00:00 2001 From: Andrew Cooper Date: Tue, 20 Jun 2017     19:18:54 +0100 Subject: [PATCH] x86/grant: Disallow     misaligned PTEs Pagetable entries must be aligned to     function correctly. Disallow attempts from the guest to     have a grant PTE created at a misaligned address, which     would result in corruption of the L1 table with     largely-guest-controlled values. This is XSA-227     (CVE-2017-12137)

  - Prerequisite patch for xsa227-4.5.patch There is no     macro ASSERT_UNREACHABLE before OVM3.4 which is needed     by xsa227-4.5.patch This chunk is picked from upstream     commit cacdb0faaa121ac8f792d5bd34cc6bc7c72d21da     (CVE-2017-12137)

  - From: Jan Beulich Subject: gnttab: don't use possibly     unbounded tail calls There is no guarantee that the     compiler would actually translate them to branches     instead of calls, so only ones with a known recursion     limit are okay :

  - __release_grant_for_copy can call itself only once, as
    __acquire_grant_for_copy won't permit use of multi-level     transitive grants,

  - __acquire_grant_for_copy is fine to call itself with the     last argument false, as that prevents further recursion,

  - __acquire_grant_for_copy must not call itself to recover     from an observed change to the active entry's pin count     This is XSA-226. (CVE-2017-12135)

  - From 69549b08eb9bd3a525c07a97d952673a3d02c76a Mon Sep 17     00:00:00 2001 From: Annie Li Date: Fri, 7 Jul 2017     14:36:08 -0400 Subject: [PATCH] xen: increase default     max grant frames and max maptrack frames Commit     9dfba034e increase default max grant frames to 128 which     is still not enough when the guest has more cpus and     vbd/vif devices, so set it to 256. Also the default max     maptrack frames needs to be increased accordingly.

This update for xen fixes the following issues :

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230, bsc#1052686).

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-11334: The address_space_write_continue     function in exec.c allowed local guest OS privileged     users to cause a denial of service (out-of-bounds access     and guest instance crash) by leveraging use of     qemu_map_ram_ptr to access guest ram block area     (bsc#1048920).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the Xen hypervisor :

  - CVE-2017-10912     Jann Horn discovered that incorrectly handling of page     transfers might result in privilege escalation.

  - CVE-2017-10913 / CVE-2017-10914     Jann Horn discovered that race conditions in grant     handling might result in information leaks or privilege     escalation.

  - CVE-2017-10915     Andrew Cooper discovered that incorrect reference     counting with shadow paging might result in privilege     escalation.

  - CVE-2017-10916     Andrew Cooper discovered an information leak in the     handling of the Memory Protection Extensions (MPX) and     Protection Key (PKU) CPU features. This only affects     Debian stretch.

  - CVE-2017-10917     Ankur Arora discovered a NULL pointer dereference in     event polling, resulting in denial of service.

  - CVE-2017-10918     Julien Grall discovered that incorrect error handling in     physical-to-machine memory mappings may result in     privilege escalation, denial of service or an     information leak.

  - CVE-2017-10919     Julien Grall discovered that incorrect handling of     virtual interrupt injection on ARM systems may result in     denial of service.

  - CVE-2017-10920 / CVE-2017-10921 / CVE-2017-10922     Jan Beulich discovered multiple places where reference     counting on grant table operations was incorrect,     resulting in potential privilege escalation.

  - CVE-2017-12135     Jan Beulich found multiple problems in the handling of     transitive grants which could result in denial of     service and potentially privilege escalation.

  - CVE-2017-12136     Ian Jackson discovered that race conditions in the     allocator for grant mappings may result in denial of     service or privilege escalation. This only affects     Debian stretch.

  - CVE-2017-12137     Andrew Cooper discovered that incorrect validation of     grants may result in privilege escalation.

  - CVE-2017-12855     Jan Beulich discovered that incorrect grant status     handling, thus incorrectly informing the guest that the     grant is no longer in use.

  - XSA-235 (no CVE yet)

    Wei Liu discovered that incorrect locking of     add-to-physmap operations on ARM may result in denial of     service.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-11334: The address_space_write_continue     function in exec.c allowed local guest OS privileged     users to cause a denial of service (out-of-bounds access     and guest instance crash) by leveraging use of     qemu_map_ram_ptr to access guest ram block area     (bsc#1048920).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10806: Stack-based buffer overflow in     hw/usb/redirect.c allowed local guest OS users to cause     a denial of service via vectors related to logging debug     messages (bsc#1047675).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230, bsc#1052686).

  - CVE-2017-14316: Missing bound check in function     `alloc_heap_pages` for an internal array allowed     attackers using crafted hypercalls to execute arbitrary     code within Xen (XSA-231, bsc#1056278)

  - CVE-2017-14317: A race in cxenstored may have cause a     double-free allowind for DoS of the xenstored daemon     (XSA-233, bsc#1056281).

  - CVE-2017-14319: An error while handling grant mappings     allowed malicious or buggy x86 PV guest to escalate its     privileges or crash the hypervisor (XSA-234,     bsc#1056282).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by multiple vulnerabilities.

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A     guest is expected not to modify the grant details while it is in use, whereas the guest is free to     modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status     bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may     prematurely believe that a granted frame is safely private again, and reuse it in a way which contains     sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9,     4.8, 4.7, 4.6, and 4.5 are affected. (CVE-2017-12855)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for xen to version 4.7.3 fixes several issues. These security issues were fixed :

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-12136: Race conditions with maptrack free list     handling allows a malicious guest administrator to crash     the host or escalate their privilege to that of the host     (XSA-228, bsc#1051789).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230 CVE-2017-12855).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-12136: Race conditions with maptrack free list     handling allows a malicious guest administrator to crash     the host or escalate their privilege to that of the host     (XSA-228, bsc#1051789).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230 bsc#1052686.

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.7.3 fixes several issues.

These security issues were fixed :

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-12136: Race conditions with maptrack free list     handling allows a malicious guest administrator to crash     the host or escalate their privilege to that of the host     (XSA-228, bsc#1051789).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230 CVE-2017-12855).

These non-security issues were fixed :

  - bsc#1055695: XEN: 11SP4 and 12SP3 HVM guests can not be     restored after the save using xl stack 

  - bsc#1035231: Migration of HVM domU did not use     superpages on destination dom0

  - bsc#1002573: Optimized LVM functions in block-dmmd     block-dmmd

  - bsc#1037840: Xen-detect always showed HVM for PV guests

This update was imported from the SUSE:SLE-12-SP2:Update update project.

ID	名稱	產品	系列	已發布	已更新	嚴重性
102526	Citrix XenServer Multiple Vulnerabilities (CTX225941)	Nessus	Misc.	2017/8/16	2025/11/26	high
102907	OracleVM 3.2 : xen (OVMSA-2017-0149)	Nessus	OracleVM Local Security Checks	2017/9/1	2025/11/24	high
102686	Fedora 26 : xen (2017-f336ba205d)	Nessus	Fedora Local Security Checks	2017/8/23	2025/11/26	high
102906	OracleVM 3.3 : xen (OVMSA-2017-0148)	Nessus	OracleVM Local Security Checks	2017/9/1	2025/11/24	high
102954	SUSE SLES11 Security Update : xen (SUSE-SU-2017:2339-1)	Nessus	SuSE Local Security Checks	2017/9/5	2025/11/24	high
103146	Debian DSA-3969-1 : xen - security update	Nessus	Debian Local Security Checks	2017/9/13	2025/11/21	critical
103412	SUSE SLES12 Security Update : xen (SUSE-SU-2017:2541-1)	Nessus	SuSE Local Security Checks	2017/9/22	2025/11/20	high
102585	Xen Hypervisor Multiple Vulnerabilities (XSA-226 - XSA-230)	Nessus	Misc.	2017/8/18	2020/7/10	high
220498	Linux Distros Unpatched Vulnerability : CVE-2017-12855	Nessus	Misc.	2025/3/4	2026/7/29	medium
102952	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:2326-1)	Nessus	SuSE Local Security Checks	2017/9/5	2025/11/24	critical
102953	SUSE SLED12 Security Update : xen (SUSE-SU-2017:2327-1)	Nessus	SuSE Local Security Checks	2017/9/5	2025/11/24	high
103158	openSUSE Security Update : xen (openSUSE-2017-1022)	Nessus	SuSE Local Security Checks	2017/9/13	2025/11/21	critical

偵測

搜尋 Plugin

high

high

high

high

high

critical

high

high

medium

critical

high

critical