Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges by "using DMA to generate MSI interrupts by writing to the interrupt injection registers."

Security / Collective Update for Xen

Xen :

  - bnc#702025 - VUL-0: xen: VT-d (PCI passthrough) MSI trap     injection (CVE-2011-1898)

  - bnc#703924 - update block-npiv scripts to support BFA     HBA

  - bnc#689954 - L3: Live migrations fail when guest     crashes: domain_crash_sync called from entry.S

  - bnc#693472 - Bridge hangs cause redundant ring failures     in SLE 11 SP1 HAE + XEN

  - bnc#582265 - xen-scsi.ko not supported

  - bnc#670465 - When connecting to Xen guest through     vncviewer mouse tracking is off.

  - bnc#684305 - on_crash is being ignored with kdump now     working in HVM

vm-install :

  - bnc#692625 - virt-manager has problems to install guest     from multiple CD

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-2025 advisory.

  - The Generic Receive Offload (GRO) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5     and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization (RHEV) Hypervisor     and other products, allows remote attackers to cause a denial of service via crafted VLAN packets that are     processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a     different vulnerability than CVE-2011-1478. (CVE-2011-1576)

  - Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not     have interrupt remapping, allows guest OS users to gain host OS privileges by using DMA to generate MSI     interrupts by writing to the interrupt injection registers. (CVE-2011-1898)

  - Race condition in the scan_get_next_rmap_item function in mm/ksm.c in the Linux kernel before 2.6.39.3,     when Kernel SamePage Merging (KSM) is enabled, allows local users to cause a denial of service (NULL     pointer dereference) or possibly have unspecified other impact via a crafted application. (CVE-2011-2183)

  - The Network Lock Manager (NLM) protocol implementation in the NFS client functionality in the Linux kernel     before 3.0 allows local users to cause a denial of service (system hang) via a LOCK_UN flock system call.
    (CVE-2011-2491)

  - The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data     structures, which allows local users to obtain potentially sensitive information from kernel memory via a     crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in     net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c.
    (CVE-2011-2492)

  - fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc/#####/io     files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by     discovering the length of another user's password. (CVE-2011-2495)

  - Integer underflow in the l2cap_config_req function in net/bluetooth/l2cap_core.c in the Linux kernel     before 3.0 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have     unspecified other impact via a small command-size value within the command header of a Logical Link     Control and Adaptation Protocol (L2CAP) configuration request, leading to a buffer overflow.
    (CVE-2011-2497)

  - Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users     to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID     value. (CVE-2011-2517)

  - Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to     cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a     write operation involving a block number corresponding to the largest possible 32-bit unsigned integer.
    (CVE-2011-2695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2011:1479 :

Updated kernel packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* Using PCI passthrough without interrupt remapping support allowed Xen hypervisor guests to generate MSI interrupts and thus potentially inject traps. A privileged guest user could use this flaw to crash the host or possibly escalate their privileges on the host. The fix for this issue can prevent PCI passthrough working and guests starting.
Refer to Red Hat Bugzilla bug 715555 for details. (CVE-2011-1898, Important)

* A flaw was found in the way CIFS (Common Internet File System) shares with DFS referrals at their root were handled. An attacker on the local network who is able to deploy a malicious CIFS server could create a CIFS network share that, when mounted, would cause the client system to crash. (CVE-2011-3363, Moderate)

* A NULL pointer dereference flaw was found in the way the Linux kernel's key management facility handled user-defined key types. A local, unprivileged user could use the keyctl utility to cause a denial of service. (CVE-2011-4110, Moderate)

* A flaw in the way memory containing security-related data was handled in tpm_read() could allow a local, unprivileged user to read the results of a previously run TPM command. (CVE-2011-1162, Low)

* A NULL pointer dereference flaw was found in the Linux kernel's HFS file system implementation. A local attacker could use this flaw to cause a denial of service by mounting a disk that contains a specially crafted HFS file system with a corrupted MDB extent record.
(CVE-2011-2203, Low)

* The I/O statistics from the taskstats subsystem could be read without any restrictions. A local, unprivileged user could use this flaw to gather confidential information, such as the length of a password used in a process. (CVE-2011-2494, Low)

Red Hat would like to thank Yogesh Sharma for reporting CVE-2011-3363;
Peter Huewe for reporting CVE-2011-1162; Clement Lecigne for reporting CVE-2011-2203; and Vasiliy Kulikov of Openwall for reporting CVE-2011-2494.

This update also fixes several bugs and adds one enhancement.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs and add the enhancement noted in the Technical Notes. The system must be rebooted for this update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1189 advisory.

  - kernel/signal.c in the Linux kernel before 2.6.39 allows local users to spoof the uid and pid of a signal     sender via a sigqueueinfo system call. (CVE-2011-1182)

  - The Generic Receive Offload (GRO) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5     and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization (RHEV) Hypervisor     and other products, allows remote attackers to cause a denial of service via crafted VLAN packets that are     processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a     different vulnerability than CVE-2011-1478. (CVE-2011-1576)

  - Multiple integer overflows in the next_pidmap function in kernel/pid.c in the Linux kernel before 2.6.38.4     allow local users to cause a denial of service (system crash) via a crafted (1) getdents or (2) readdir     system call. (CVE-2011-1593)

  - The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size     of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allows physically     proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive     information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability     than CVE-2011-1577. (CVE-2011-1776)

  - Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not     have interrupt remapping, allows guest OS users to gain host OS privileges by using DMA to generate MSI     interrupts by writing to the interrupt injection registers. (CVE-2011-1898)

  - Race condition in the scan_get_next_rmap_item function in mm/ksm.c in the Linux kernel before 2.6.39.3,     when Kernel SamePage Merging (KSM) is enabled, allows local users to cause a denial of service (NULL     pointer dereference) or possibly have unspecified other impact via a crafted application. (CVE-2011-2183)

  - The inet_diag_bc_audit function in net/ipv4/inet_diag.c in the Linux kernel before 2.6.39.3 does not     properly audit INET_DIAG bytecode, which allows local users to cause a denial of service (kernel infinite     loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message, as demonstrated by an     INET_DIAG_BC_JMP instruction with a zero yes value, a different vulnerability than CVE-2010-3880.
    (CVE-2011-2213)

  - The Network Lock Manager (NLM) protocol implementation in the NFS client functionality in the Linux kernel     before 3.0 allows local users to cause a denial of service (system hang) via a LOCK_UN flock system call.
    (CVE-2011-2491)

  - The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data     structures, which allows local users to obtain potentially sensitive information from kernel memory via a     crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in     net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c.
    (CVE-2011-2492)

  - fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc/#####/io     files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by     discovering the length of another user's password. (CVE-2011-2495)

  - Integer underflow in the l2cap_config_req function in net/bluetooth/l2cap_core.c in the Linux kernel     before 3.0 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have     unspecified other impact via a small command-size value within the command header of a Logical Link     Control and Adaptation Protocol (L2CAP) configuration request, leading to a buffer overflow.
    (CVE-2011-2497)

  - Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users     to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID     value. (CVE-2011-2517)

  - The gfs2_fallocate function in fs/gfs2/file.c in the Linux kernel before 3.0-rc1 does not ensure that the     size of a chunk allocation is a multiple of the block size, which allows local users to cause a denial of     service (BUG and system crash) by arranging for all resource groups to have too little free space.
    (CVE-2011-2689)

  - Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to     cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a     write operation involving a block number corresponding to the largest possible 32-bit unsigned integer.
    (CVE-2011-2695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* Using PCI passthrough without interrupt remapping support allowed Xen hypervisor guests to generate MSI interrupts and thus potentially inject traps. A privileged guest user could use this flaw to crash the host or possibly escalate their privileges on the host. The fix for this issue can prevent PCI passthrough working and guests starting.
Refer to Red Hat Bugzilla bug 715555 for details. (CVE-2011-1898, Important)

* A flaw was found in the way CIFS (Common Internet File System) shares with DFS referrals at their root were handled. An attacker on the local network who is able to deploy a malicious CIFS server could create a CIFS network share that, when mounted, would cause the client system to crash. (CVE-2011-3363, Moderate)

* A NULL pointer dereference flaw was found in the way the Linux kernel's key management facility handled user-defined key types. A local, unprivileged user could use the keyctl utility to cause a denial of service. (CVE-2011-4110, Moderate)

* A flaw in the way memory containing security-related data was handled in tpm_read() could allow a local, unprivileged user to read the results of a previously run TPM command. (CVE-2011-1162, Low)

* A NULL pointer dereference flaw was found in the Linux kernel's HFS file system implementation. A local attacker could use this flaw to cause a denial of service by mounting a disk that contains a specially crafted HFS file system with a corrupted MDB extent record.
(CVE-2011-2203, Low)

* The I/O statistics from the taskstats subsystem could be read without any restrictions. A local, unprivileged user could use this flaw to gather confidential information, such as the length of a password used in a process. (CVE-2011-2494, Low)

Red Hat would like to thank Yogesh Sharma for reporting CVE-2011-3363;
Peter Huewe for reporting CVE-2011-1162; Clement Lecigne for reporting CVE-2011-2203; and Vasiliy Kulikov of Openwall for reporting CVE-2011-2494.

This update also fixes several bugs and adds one enhancement.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs and add the enhancement noted in the Technical Notes. The system must be rebooted for this update to take effect.

Updated kernel packages that fix several security issues and various bugs are now available for Red Hat Enterprise Linux 5.6 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* Using PCI passthrough without interrupt remapping support allowed Xen hypervisor guests to generate MSI interrupts and thus potentially inject traps. A privileged guest user could use this flaw to crash the host or possibly escalate their privileges on the host. The fix for this issue can prevent PCI passthrough working and guests starting.
Refer to Red Hat Bugzilla bug 715555 for details. (CVE-2011-1898, Important)

* IPv6 fragment identification value generation could allow a remote attacker to disrupt a target system's networking, preventing legitimate users from accessing its services. (CVE-2011-2699, Important)

* Using the SG_IO ioctl to issue SCSI requests to partitions or LVM volumes resulted in the requests being passed to the underlying block device. If a privileged user only had access to a single partition or LVM volume, they could use this flaw to bypass those restrictions and gain read and write access (and be able to issue other SCSI commands) to the entire block device. Refer to Red Hat Knowledgebase article 67869, linked to in the References, for further details about this issue. (CVE-2011-4127, Important)

* A flaw was found in the way the Linux kernel handled robust list pointers of user-space held futexes across exec() calls. A local, unprivileged user could use this flaw to cause a denial of service or, eventually, escalate their privileges. (CVE-2012-0028, Important)

* A missing boundary check was found in the Linux kernel's HFS file system implementation. A local attacker could use this flaw to cause a denial of service or escalate their privileges by mounting a specially crafted disk. (CVE-2011-4330, Moderate)

Red Hat would like to thank Fernando Gont for reporting CVE-2011-2699, and Clement Lecigne for reporting CVE-2011-4330.

This update also fixes the following bugs :

* Previously, all timers for a Xen fully-virtualized domain were based on the time stamp counter (TSC) of the underlying physical CPU. This could cause observed time to go backwards on some hosts. This update moves all timers except HPET to the Xen monotonic system time, which fixes the bug as long as the HPET is removed from the configuration of the domain. (BZ#773359)

* Previously, tests of the Microsoft Server Virtualization Validation Program (SVVP) detected unreliability of the emulated HPET (High Performance Event Timer) on some hosts. Now, HPET can be configured as a per-domain configuration option; if it is disabled, the guest chooses a more reliable timer source. Disabling HPET is suggested for Windows guests, as well as fully-virtualized Linux guests that show occasional 'time went backwards' errors in the console. (BZ#773360)

* SG_IO ioctls were not implemented correctly in the Red Hat Enterprise Linux 5 virtio-blk driver. Sending an SG_IO ioctl request to a virtio-blk disk caused the sending thread to enter an uninterruptible sleep state ('D' state). With this update, SG_IO ioctls are rejected by the virtio-blk driver; the ioctl system call simply returns an ENOTTY ('Inappropriate ioctl for device') error and the thread continues normally. (BZ#784658)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - Using PCI passthrough without interrupt remapping     support allowed Xen hypervisor guests to generate MSI     interrupts and thus potentially inject traps. A     privileged guest user could use this flaw to crash the     host or possibly escalate their privileges on the host.
    The fix for this issue can prevent PCI passthrough     working and guests starting.(CVE-2011-1898, Important)

  - A flaw was found in the way CIFS (Common Internet File     System) shares with DFS referrals at their root were     handled. An attacker on the local network who is able to     deploy a malicious CIFS server could create a CIFS     network share that, when mounted, would cause the client     system to crash. (CVE-2011-3363, Moderate)

  - A NULL pointer dereference flaw was found in the way the     Linux kernel's key management facility handled     user-defined key types. A local, unprivileged user could     use the keyctl utility to cause a denial of service.
    (CVE-2011-4110, Moderate)

  - A flaw in the way memory containing security-related     data was handled in tpm_read() could allow a local,     unprivileged user to read the results of a previously     run TPM command. (CVE-2011-1162, Low)

  - A NULL pointer dereference flaw was found in the Linux     kernel's HFS file system implementation. A local     attacker could use this flaw to cause a denial of     service by mounting a disk that contains a specially     crafted HFS file system with a corrupted MDB extent     record. (CVE-2011-2203, Low)

  - The I/O statistics from the taskstats subsystem could be     read without any restrictions. A local, unprivileged     user could use this flaw to gather confidential     information, such as the length of a password used in a     process. (CVE-2011-2494, Low)

This update also fixes several bugs and adds one enhancement.

The system must be rebooted for this update to take effect.

Security issues :

  - Using PCI passthrough without interrupt remapping     support allowed KVM guests to generate MSI interrupts     and thus potentially inject traps. A privileged guest     user could use this flaw to crash the host or possibly     escalate their privileges on the host. The fix for this     issue can prevent PCI passthrough working and guests     starting. (CVE-2011-1898, Important)

  - Flaw in the client-side NLM implementation could allow a     local, unprivileged user to cause a denial of service.
    (CVE-2011-2491, Important)

  - Integer underflow in the Bluetooth implementation could     allow a remote attacker to cause a denial of service or     escalate their privileges by sending a specially crafted     request to a target system via Bluetooth.
    (CVE-2011-2497, Important)

  - Buffer overflows in the netlink-based wireless     configuration interface implementation could allow a     local user, who has the CAP_NET_ADMIN capability, to     cause a denial of service or escalate their privileges     on systems that have an active wireless interface.
    (CVE-2011-2517, Important)

  - Flaw in the way the maximum file offset was handled for     ext4 file systems could allow a local, unprivileged user     to cause a denial of service. (CVE-2011-2695, Important)

  - Flaw allowed napi_reuse_skb() to be called on VLAN     packets. An attacker on the local network could use this     flaw to send crafted packets to a target, possibly     causing a denial of service. (CVE-2011-1576, Moderate)

  - Integer signedness error in next_pidmap() could allow a     local, unprivileged user to cause a denial of service.
    (CVE-2011-1593, Moderate)

  - Race condition in the memory merging support (KSM) could     allow a local, unprivileged user to cause a denial of     service. KSM is off by default, but on systems running     VDSM, or on KVM hosts, it is likely turned on by the     ksm/ksmtuned services. (CVE-2011-2183, Moderate)

  - Flaw in inet_diag_bc_audit() could allow a local,     unprivileged user to cause a denial of service.
    (CVE-2011-2213, Moderate)

  - Flaw in the way space was allocated in the Global File     System 2 (GFS2) implementation. If the file system was     almost full, and a local, unprivileged user made an     fallocate() request, it could result in a denial of     service. Setting quotas to prevent users from using all     available disk space would prevent exploitation of this     flaw. (CVE-2011-2689, Moderate)

  - Local, unprivileged users could send signals via the     sigqueueinfo system call, with si_code set to SI_TKILL     and with spoofed process and user IDs, to other     processes. This flaw does not allow existing permission     checks to be bypassed; signals can only be sent if your     privileges allow you to already do so. (CVE-2011-1182,     Low)

  - Heap overflow in the EFI GUID Partition Table (GPT)     implementation could allow a local attacker to cause a     denial of service by mounting a disk containing crafted     partition tables. (CVE-2011-1776, Low)

  - Structure padding in two structures in the Bluetooth     implementation was not initialized properly before being     copied to user-space, possibly allowing local,     unprivileged users to leak kernel stack memory to     user-space. (CVE-2011-2492, Low)

  - /proc/[PID]/io is world-readable by default. Previously,     these files could be read without any further     restrictions. A local, unprivileged user could read     these files, belonging to other, possibly privileged     processes to gather confidential information, such as     the length of a password used in a process.
    (CVE-2011-2495, Low)

A security bug was fixed in Xen

  - A bug was found in the way Xen handles CPUID instruction     emulation during VM exits. An unprivileged guest user     can potentially use this flaw to crash the guest.
    (CVE-2011-1936)

This issue only affected systems running on x86 architecture with Intel processor and VMX virtualization extension enabled.

Several vulnerabilities were discovered in the Xen virtual machine hypervisor.

  - CVE-2011-1166     A 64-bit guest can get one of its vCPUs into non-kernel     mode without first providing a valid non-kernel     pagetable, thereby locking up the host system.

  - CVE-2011-1583, CVE-2011-3262     Local users can cause a denial of service and possibly     execute arbitrary code via a crafted paravirtualised     guest kernel image.

  - CVE-2011-1898     When using PCI passthrough on Intel VT-d chipsets that     do not have interrupt remapping, guest OS users can gain     host OS privileges by writing to the interrupt injection     registers.

The oldstable distribution (lenny) contains a different version of Xen not affected by these problems.

Security / Collective Update for Xen

Xen :

  - VUL-0: xen: VT-d (PCI passthrough) MSI trap injection.
    (CVE-2011-1898). (bnc#702025)

  - update block-npiv scripts to support BFA HBA.
    (bnc#703924)

  - L3: Live migrations fail when guest crashes:
    domain_crash_sync called from entry.S. (bnc#689954)

  - Bridge hangs cause redundant ring failures in SLE 11 SP1     HAE + XEN. (bnc#693472)

  - xen-scsi.ko not supported. (bnc#582265)

  - When connecting to Xen guest through vncviewer mouse     tracking is off. (bnc#670465)

  - on_crash is being ignored with kdump now working in HVM.
    (bnc#684305)

  - HVM taking too long to dump vmcore. (bnc#684297)

  - crm resource migrate fails with xen machines.
    (bnc#704160)

  - xm console DomUName hang after 'xm save/restore' of PVM     on the latest Xen vm-install:. (bnc#706574)

  - virt-manager has problems to install guest from multiple     CD. (bnc#692625)

Updated kernel packages that fix several security issues, various bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Security issues :

* Using PCI passthrough without interrupt remapping support allowed KVM guests to generate MSI interrupts and thus potentially inject traps. A privileged guest user could use this flaw to crash the host or possibly escalate their privileges on the host. The fix for this issue can prevent PCI passthrough working and guests starting. Refer to Red Hat Bugzilla bug 715555 for details. (CVE-2011-1898, Important)

* Flaw in the client-side NLM implementation could allow a local, unprivileged user to cause a denial of service. (CVE-2011-2491, Important)

* Integer underflow in the Bluetooth implementation could allow a remote attacker to cause a denial of service or escalate their privileges by sending a specially crafted request to a target system via Bluetooth. (CVE-2011-2497, Important)

* Buffer overflows in the netlink-based wireless configuration interface implementation could allow a local user, who has the CAP_NET_ADMIN capability, to cause a denial of service or escalate their privileges on systems that have an active wireless interface.
(CVE-2011-2517, Important)

* Flaw in the way the maximum file offset was handled for ext4 file systems could allow a local, unprivileged user to cause a denial of service. (CVE-2011-2695, Important)

* Flaw allowed napi_reuse_skb() to be called on VLAN packets. An attacker on the local network could use this flaw to send crafted packets to a target, possibly causing a denial of service.
(CVE-2011-1576, Moderate)

* Integer signedness error in next_pidmap() could allow a local, unprivileged user to cause a denial of service. (CVE-2011-1593, Moderate)

* Race condition in the memory merging support (KSM) could allow a local, unprivileged user to cause a denial of service. KSM is off by default, but on systems running VDSM, or on KVM hosts, it is likely turned on by the ksm/ksmtuned services. (CVE-2011-2183, Moderate)

* Flaw in inet_diag_bc_audit() could allow a local, unprivileged user to cause a denial of service. (CVE-2011-2213, Moderate)

* Flaw in the way space was allocated in the Global File System 2 (GFS2) implementation. If the file system was almost full, and a local, unprivileged user made an fallocate() request, it could result in a denial of service. Setting quotas to prevent users from using all available disk space would prevent exploitation of this flaw.
(CVE-2011-2689, Moderate)

* Local, unprivileged users could send signals via the sigqueueinfo system call, with si_code set to SI_TKILL and with spoofed process and user IDs, to other processes. This flaw does not allow existing permission checks to be bypassed; signals can only be sent if your privileges allow you to already do so. (CVE-2011-1182, Low)

* Heap overflow in the EFI GUID Partition Table (GPT) implementation could allow a local attacker to cause a denial of service by mounting a disk containing crafted partition tables. (CVE-2011-1776, Low)

* Structure padding in two structures in the Bluetooth implementation was not initialized properly before being copied to user-space, possibly allowing local, unprivileged users to leak kernel stack memory to user-space. (CVE-2011-2492, Low)

* /proc/[PID]/io is world-readable by default. Previously, these files could be read without any further restrictions. A local, unprivileged user could read these files, belonging to other, possibly privileged processes to gather confidential information, such as the length of a password used in a process. (CVE-2011-2495, Low)

Red Hat would like to thank Vasily Averin for reporting CVE-2011-2491;
Dan Rosenberg for reporting CVE-2011-2497 and CVE-2011-2213; Ryan Sweat for reporting CVE-2011-1576; Robert Swiecki for reporting CVE-2011-1593; Andrea Righi for reporting CVE-2011-2183; Julien Tinnes of the Google Security Team for reporting CVE-2011-1182; Timo Warns for reporting CVE-2011-1776; Marek Kroemeke and Filip Palian for reporting CVE-2011-2492; and Vasiliy Kulikov of Openwall for reporting CVE-2011-2495.

update to 4.1.1 - includes various bugfixes and fix for [CVE-2011-1898] guest with pci passthrough can gain privileged access to base domain

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update to 4.0.2 - includes various bugfixes and fix for [CVE-2011-1898] guest with pci passthrough can gain privileged access to base domain

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
76049	openSUSE Security Update : xen-201107 (openSUSE-SU-2011:0941-1)	Nessus	SuSE Local Security Checks	high
75777	openSUSE Security Update : xen-201107 (openSUSE-SU-2011:0941-1)	Nessus	SuSE Local Security Checks	high
68421	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2011-2025)	Nessus	Oracle Linux Local Security Checks	high
68394	Oracle Linux 5 : kernel (ELSA-2011-1479)	Nessus	Oracle Linux Local Security Checks	high
68331	Oracle Linux 6 : kernel (ELSA-2011-1189)	Nessus	Oracle Linux Local Security Checks	high
67086	CentOS 5 : kernel (CESA-2011:1479)	Nessus	CentOS Local Security Checks	high
64030	RHEL 5 : kernel (RHSA-2012:0358)	Nessus	Red Hat Local Security Checks	high
61181	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
61118	Scientific Linux Security Update : kernel on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
57266	SuSE 10 Security Update : Xen (ZYPP Patch Number 7654)	Nessus	SuSE Local Security Checks	high
56974	RHEL 5 : kernel (RHSA-2011:1479)	Nessus	Red Hat Local Security Checks	high
56716	Debian DSA-2337-1 : xen - several vulnerabilities	Nessus	Debian Local Security Checks	high
55973	SuSE 11.1 Security Update : Xen (SAT Patch Number 4977)	Nessus	SuSE Local Security Checks	high
55964	RHEL 6 : kernel (RHSA-2011:1189)	Nessus	Red Hat Local Security Checks	high
55464	Fedora 15 : xen-4.1.1-1.fc15 (2011-8421)	Nessus	Fedora Local Security Checks	high
55461	Fedora 14 : xen-4.0.2-1.fc14 (2011-8403)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2011-1898

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high