Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest kernel image that triggers (1) a buffer overflow during a decompression loop or (2) an out-of-bounds read in the loader involving unspecified length fields.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Integer overflows and lack of checking of length fields     (CVE-2011-1583)

Collective May/2011 update for Xen

Xen :

  - 675363 - Random lockups with kernel-xen. Possibly     graphics related.

  - 679344 - Xen: multi-vCPU pv guest may crash host

  - 681044 - update xenpaging.autostart.patch

  - 681302 - xm create -x <guest> returns 'ImportError: No     module named ext'

  - 688473 - potential buffer overflow in tools

  - 691738 - Xen does not find device create with npiv block

vm-install :

  - 688757 - SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic

  - 678152 - Xen: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

  - 631680 - OpenSUSE 11.3 KVM install of windows xp fails     on first reboot during installation.

Collective May/2011 update for Xen

Xen :

  - 691238 - L3: question on behaviour change xm list

  - 623680 - xen kernel freezes during boot when processor     module is loaded

  - 680824 - dom0 can't recognize boot disk when IOMMU is     enabled

  - 688473 - VUL-0: potential buffer overflow in tools

  - 679344 - VUL-0: Xen: multi-vCPU pv guest may crash host

  - 687981 - L3: mistyping model type when defining VIF     crashes

  - 675817 - Kernel panic when creating HVM guests on AMD     platforms with XSAVE

  - 678871 - dom0 hangs long time when starting hvm guests     with memory >= 64GB

  - 675363 - Random lockups with kernel-xen. Possibly     graphics related

  - 678229 - restore of sles HVM fails

  - 672833 - xen-tools bug causing problems with Ubuntu     10.10 under Xen 4.

  - 665610 - xm console > 1 to same VM messes up both     consoles

vm-install :

  - 688757 - SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic

  - 678152 - Xen: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0496 advisory.

    [3.0.3-120.el5_6.2]
    - Fix logic and integer overflow in xc_try_bzip2_decode() (rhbz 696938)
    - Fix logic and integer overflow in xc_try_lzma_decode() (rhbz 696938)
    - Fix integer and buffer overflows in xc_dom_probe_bzimage_kernel() (rhbz 696938)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was found that the xc_try_bzip2_decode() and xc_try_lzma_decode() decode routines did not correctly check for a possible buffer size overflow in the decoding loop. As well, several integer overflow flaws and missing error/range checking were found that could lead to an infinite loop. A privileged guest user could use these flaws to crash the guest or, possibly, execute arbitrary code in the privileged management domain (Dom0). (CVE-2011-1583)

The system must be rebooted for this update to take effect.

Several vulnerabilities were discovered in the Xen virtual machine hypervisor.

  - CVE-2011-1166     A 64-bit guest can get one of its vCPUs into non-kernel     mode without first providing a valid non-kernel     pagetable, thereby locking up the host system.

  - CVE-2011-1583, CVE-2011-3262     Local users can cause a denial of service and possibly     execute arbitrary code via a crafted paravirtualised     guest kernel image.

  - CVE-2011-1898     When using PCI passthrough on Intel VT-d chipsets that     do not have interrupt remapping, guest OS users can gain     host OS privileges by writing to the interrupt injection     registers.

The oldstable distribution (lenny) contains a different version of Xen not affected by these problems.

Collective May/2011 update for Xen

Xen :

  - 679344: Xen: multi-vCPU pv guest may crash host

  - 675817: Kernel panic when creating HVM guests on AMD     platforms with XSAVE

  - 678871: dom0 hangs long time when starting hvm guests     with memory >= 64GB

  - 675363: Random lockups with kernel-xen. Possibly     graphics related

  - 678229: restore of sles HVM fails

  - 672833: xen-tools bug causing problems with Ubuntu 10.10     under Xen 4.

  - 665610: xm console > 1 to same VM messes up both     consoles

  - 687981: mistyping model type when defining VIF crashes     VM

  - 688473: Fix potential buffer overflow in decode

  - 691238: revert accidental behaviour change in xm list

  - 680824: dom0 can't recognize boot disk when IOMMU is     enabled

  - 623680: xen kernel freezes during boot when processor     module is loaded vm-install :

  - 678152: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

  - 688757: SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic libvirt :

  - 674371: qemu aio mode per disk

  - 675861: Force FLR on for buggy SR-IOV devices

  - 678406: libvirt: several API calls do not honour     read-only

  - 684877: libvirt: error reporting in libvirtd is not     thread safe

  - 686737: virsh: Add option 'model' to attach-interface

  - 681546: Fix xmdomain.cfg to libvirt XML format     conversion

  - 688306: Handle support for recent KVM versions

Updated xen packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Red Hat Enterprise Linux.

It was found that the xc_try_bzip2_decode() and xc_try_lzma_decode() decode routines did not correctly check for a possible buffer size overflow in the decoding loop. As well, several integer overflow flaws and missing error/range checking were found that could lead to an infinite loop. A privileged guest user could use these flaws to crash the guest or, possibly, execute arbitrary code in the privileged management domain (Dom0). (CVE-2011-1583)

All xen users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

ID	Name	Product	Family	Severity
79473	OracleVM 2.2 : xen (OVMSA-2011-0007)	Nessus	OracleVM Local Security Checks	medium
76048	openSUSE Security Update : xen-201105 (openSUSE-SU-2011:0578-1)	Nessus	SuSE Local Security Checks	medium
75776	openSUSE Security Update : xen-201105 (openSUSE-SU-2011:0580-1)	Nessus	SuSE Local Security Checks	medium
68272	Oracle Linux 5 : xen (ELSA-2011-0496)	Nessus	Oracle Linux Local Security Checks	medium
61034	Scientific Linux Security Update : xen on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
56716	Debian DSA-2337-1 : xen - several vulnerabilities	Nessus	Debian Local Security Checks	high
54934	SuSE 11.1 Security Update : Xen (SAT Patch Number 4491)	Nessus	SuSE Local Security Checks	medium
53870	CentOS 5 : xen (CESA-2011:0496)	Nessus	CentOS Local Security Checks	medium
53853	RHEL 5 : xen (RHSA-2011:0496)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2011-1583

critical

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

medium

medium