The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service (memory consumption) via a large (1) bzip2 or (2) lzma compressed kernel image.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - libxc: builder: limit maximum size of kernel/ramdisk.
    Allowing user supplied kernels of arbitrary sizes,     especially during decompression, can swallow up dom0     memory leading to either virtual address space     exhaustion in the builder process or allocation     failures/OOM killing of both toolstack and unrelated     processes. We disable these checks when building in a     stub domain for pvgrub since this uses the guest's own     memory and is isolated. Decompression of gzip compressed     kernels and ramdisks has been safe since     14954:58205257517d (Xen 3.1.0 onwards). This is XSA-25 /     CVE-2012-4544. Also make explicit checks for buffer     overflows in various decompression routines. These were     already ruled out due to other properties of the code     but check them as a belt-and-braces measure.

    [ Includes 25589:60f09d1ab1fe for CVE-2012-2625]     (CVE-2012-4544)

  - compat/gnttab: Prevent infinite loop in compat code c/s     20281:95ea2052b41b, which introduces Grant Table version     2 hypercalls introduces a vulnerability whereby the     compat hypercall handler can fall into an infinite loop.
    If the watchdog is enabled, Xen will die after the     timeout. This is a security problem, XSA-24 /     CVE-2012-4539. (CVE-2012-4539)

  - xen/mm/shadow: check toplevel pagetables are present     before unhooking them. If the guest has not fully     populated its top-level PAE entries when it calls     HVMOP_pagetable_dying, the shadow code could try to     unhook entries from MFN 0. Add a check to avoid that     case. This issue was introduced by c/s     21239:b9d2db109cf5. This is a security problem, XSA-23 /     CVE-2012-4538. (CVE-2012-4538)

  - x86/physmap: Prevent incorrect updates of m2p mappings     In certain conditions, such as low memory, set_p2m_entry     can fail. Currently, the p2m and m2p tables will get out     of sync because we still update the m2p table after the     p2m update has failed. If that happens, subsequent     guest-invoked memory operations can cause BUGs and     ASSERTs to kill Xen. This is fixed by only updating the     m2p table iff the p2m was successfully updated. This is     a security problem, XSA-22 / CVE-2012-4537.
    (CVE-2012-4537)

  - x86/physdev: Range check pirq parameter from guests     Otherwise Xen will read beyond either end of the struct     domain.arch.pirq_emuirq array, usually resulting in a     fatal page fault. This vulnerability was introduced by     c/s 23241:d21100f1d00e, which adds a call to     domain_pirq_to_emuirq which uses the guest provided pirq     value before range checking it, and was fixed by c/s     23573:584c2e5e03d9 which changed the behaviour of the     domain_pirq_to_emuirq macro to use radix trees instead     of a flat array. This is XSA-21 / CVE-2012-4536.
    (CVE-2012-4536)

  - VCPU/timers: Prevent overflow in calculations, leading     to DoS vulnerability The timer action for a vcpu     periodic timer is to calculate the next expiry time, and     to reinsert itself into the timer queue. If the deadline     ends up in the past, Xen never leaves __do_softirq. The     affected PCPU will stay in an infinite loop until Xen is     killed by the watchdog (if enabled). This is a security     problem, XSA-20 / CVE-2012-4535. (CVE-2012-4535)

  - Correct RTC time offset update error for HVM guest     changeset 24947:b198ada9689d

  - always release vm running lock on VM shutdown Before     this patch, when xend restarted, the VM running lock     will not be released on shutdown, so the VM could never     start again. Talked with Junjie, we recommend always     releasing the lock on VM shutdown. So even when xend     restarted, there should be no stale lock leaving there.

This security update of XEN fixes various bugs and security issues.

  - Upstream patch 26088-xend-xml-filesize-check.patch

  - bnc#787163 - CVE-2012-4544: xen: Domain builder Out-of-     memory due to malicious kernel/ramdisk (XSA 25)     CVE-2012-4544-xsa25.patch

  - bnc#779212 - CVE-2012-4411: XEN / qemu: guest     administrator can access qemu monitor console (XSA-19)     CVE-2012-4411-xsa19.patch

  - bnc#786516 - CVE-2012-4535: xen: Timer overflow DoS     vulnerability CVE-2012-4535-xsa20.patch

  - bnc#786518 - CVE-2012-4536: xen: pirq range check DoS     vulnerability CVE-2012-4536-xsa21.patch

  - bnc#786517 - CVE-2012-4537: xen: Memory mapping failure     DoS vulnerability CVE-2012-4537-xsa22.patch

  - bnc#786519 - CVE-2012-4538: xen: Unhooking empty PAE     entries DoS vulnerability CVE-2012-4538-xsa23.patch

  - bnc#786520 - CVE-2012-4539: xen: Grant table hypercall     infinite loop DoS vulnerability     CVE-2012-4539-xsa24.patch

  - bnc#784087 - L3: Xen BUG at io_apic.c:129     26102-x86-IOAPIC-legacy-not-first.patch

  - Upstream patches from Jan     26054-x86-AMD-perf-ctr-init.patch     26055-x86-oprof-hvm-mode.patch     26056-page-alloc-flush-filter.patch     26061-x86-oprof-counter-range.patch     26062-ACPI-ERST-move-data.patch     26063-x86-HPET-affinity-lock.patch     26093-HVM-PoD-grant-mem-type.patch

  - Upstream patches from Jan     25931-x86-domctl-iomem-mapping-checks.patch     25952-x86-MMIO-remap-permissions.patch

------------------------------------------------------------------- Mon Sep 24 16:41:58 CEST 2012 - ohering@suse.de

  - use BuildRequires: gcc46 only in sles11sp2 or 12.1 to     fix build in 11.4

------------------------------------------------------------------- Thu Sep 20 10:03:40 MDT 2012 - carnold@novell.com

  - Upstream patches from Jan     25808-domain_create-return-value.patch     25814-x86_64-set-debugreg-guest.patch     25815-x86-PoD-no-bug-in-non-translated.patch     25816-x86-hvm-map-pirq-range-check.patch     25833-32on64-bogus-pt_base-adjust.patch     25834-x86-S3-MSI-resume.patch     25835-adjust-rcu-lock-domain.patch     25836-VT-d-S3-MSI-resume.patch 25850-tmem-xsa-15-1.patch     25851-tmem-xsa-15-2.patch 25852-tmem-xsa-15-3.patch     25853-tmem-xsa-15-4.patch 25854-tmem-xsa-15-5.patch     25855-tmem-xsa-15-6.patch 25856-tmem-xsa-15-7.patch     25857-tmem-xsa-15-8.patch 25858-tmem-xsa-15-9.patch     25859-tmem-missing-break.patch 25860-tmem-cleanup.patch     25883-pt-MSI-cleanup.patch     25927-x86-domctl-ioport-mapping-range.patch     25929-tmem-restore-pool-version.patch

  - bnc#778105 - first XEN-PV VM fails to spawn xend:
    Increase wait time for disk to appear in host bootloader     Modified existing xen-domUloader.diff

  - Upstream patches from Jan     25752-ACPI-pm-op-valid-cpu.patch     25754-x86-PoD-early-access.patch     25755-x86-PoD-types.patch     25756-x86-MMIO-max-mapped-pfn.patch     25757-x86-EPT-PoD-1Gb-assert.patch     25764-x86-unknown-cpu-no-sysenter.patch     25765-x86_64-allow-unsafe-adjust.patch     25771-grant-copy-status-paged-out.patch     25773-x86-honor-no-real-mode.patch     25786-x86-prefer-multiboot-meminfo-over-e801.patch

  - bnc#777890 - CVE-2012-3497: xen: multiple TMEM hypercall     vulnerabilities (XSA-15)     CVE-2012-3497-tmem-xsa-15-1.patch     CVE-2012-3497-tmem-xsa-15-2.patch     CVE-2012-3497-tmem-xsa-15-3.patch     CVE-2012-3497-tmem-xsa-15-4.patch     CVE-2012-3497-tmem-xsa-15-5.patch     CVE-2012-3497-tmem-xsa-15-6.patch     CVE-2012-3497-tmem-xsa-15-7.patch     CVE-2012-3497-tmem-xsa-15-8.patch     CVE-2012-3497-tmem-xsa-15-9.patch     tmem-missing-break.patch

This security update of XEN fixes various bugs and security issues.

  - Upstream patch 26088-xend-xml-filesize-check.patch

  - bnc#787163 - CVE-2012-4544: xen: Domain builder Out-of-     memory due to malicious kernel/ramdisk (XSA 25)     CVE-2012-4544-xsa25.patch

  - bnc#779212 - CVE-2012-4411: XEN / qemu: guest     administrator can access qemu monitor console (XSA-19)     CVE-2012-4411-xsa19.patch

  - bnc#786516 - CVE-2012-4535: xen: Timer overflow DoS     vulnerability CVE-2012-4535-xsa20.patch

  - bnc#786518 - CVE-2012-4536: xen: pirq range check DoS     vulnerability CVE-2012-4536-xsa21.patch

  - bnc#786517 - CVE-2012-4537: xen: Memory mapping failure     DoS vulnerability CVE-2012-4537-xsa22.patch

  - bnc#786519 - CVE-2012-4538: xen: Unhooking empty PAE     entries DoS vulnerability CVE-2012-4538-xsa23.patch

  - bnc#786520 - CVE-2012-4539: xen: Grant table hypercall     infinite loop DoS vulnerability     CVE-2012-4539-xsa24.patch

  - bnc#784087 - L3: Xen BUG at io_apic.c:129     26102-x86-IOAPIC-legacy-not-first.patch

  - Upstream patches from Jan     26054-x86-AMD-perf-ctr-init.patch     26055-x86-oprof-hvm-mode.patch     26056-page-alloc-flush-filter.patch     26061-x86-oprof-counter-range.patch     26062-ACPI-ERST-move-data.patch     26063-x86-HPET-affinity-lock.patch     26093-HVM-PoD-grant-mem-type.patch

  - Upstream patches from Jan     25931-x86-domctl-iomem-mapping-checks.patch     25952-x86-MMIO-remap-permissions.patch

  - Upstream patches from Jan     25808-domain_create-return-value.patch     25814-x86_64-set-debugreg-guest.patch     25815-x86-PoD-no-bug-in-non-translated.patch     25816-x86-hvm-map-pirq-range-check.patch     25833-32on64-bogus-pt_base-adjust.patch     25834-x86-S3-MSI-resume.patch     25835-adjust-rcu-lock-domain.patch     25836-VT-d-S3-MSI-resume.patch 25850-tmem-xsa-15-1.patch     25851-tmem-xsa-15-2.patch 25852-tmem-xsa-15-3.patch     25853-tmem-xsa-15-4.patch 25854-tmem-xsa-15-5.patch     25855-tmem-xsa-15-6.patch 25856-tmem-xsa-15-7.patch     25857-tmem-xsa-15-8.patch 25858-tmem-xsa-15-9.patch     25859-tmem-missing-break.patch 25860-tmem-cleanup.patch     25883-pt-MSI-cleanup.patch     25927-x86-domctl-ioport-mapping-range.patch     25929-tmem-restore-pool-version.patch

  - bnc#778105 - first XEN-PV VM fails to spawn xend:
    Increase wait time for disk to appear in host bootloader     Modified existing xen-domUloader.diff

  - Upstream patches from Jan     25752-ACPI-pm-op-valid-cpu.patch     25754-x86-PoD-early-access.patch     25755-x86-PoD-types.patch     25756-x86-MMIO-max-mapped-pfn.patch     25757-x86-EPT-PoD-1Gb-assert.patch     25764-x86-unknown-cpu-no-sysenter.patch     25765-x86_64-allow-unsafe-adjust.patch     25771-grant-copy-status-paged-out.patch     25773-x86-honor-no-real-mode.patch     25786-x86-prefer-multiboot-meminfo-over-e801.patch

  - bnc#777890 - CVE-2012-3497: xen: multiple TMEM hypercall     vulnerabilities (XSA-15)     CVE-2012-3497-tmem-xsa-15-1.patch     CVE-2012-3497-tmem-xsa-15-2.patch     CVE-2012-3497-tmem-xsa-15-3.patch     CVE-2012-3497-tmem-xsa-15-4.patch     CVE-2012-3497-tmem-xsa-15-5.patch     CVE-2012-3497-tmem-xsa-15-6.patch     CVE-2012-3497-tmem-xsa-15-7.patch     CVE-2012-3497-tmem-xsa-15-8.patch     CVE-2012-3497-tmem-xsa-15-9.patch     tmem-missing-break.patch

Security Update for Xen

Following bug and security fixes were applied :

  - bnc#776995 - attaching scsi control luns with pvscsi

  - xend/pvscsi: fix passing of SCSI control LUNs     xen-bug776995-pvscsi-no-devname.patch

  - xend/pvscsi: fix usage of persistant device names for     SCSI devices xen-bug776995-pvscsi-persistent-names.patch

  - xend/pvscsi: update sysfs parser for Linux 3.0     xen-bug776995-pvscsi-sysfs-parser.patch

  - bnc#777090 - CVE-2012-3494: xen: hypercall set_debugreg     vulnerability (XSA-12) CVE-2012-3494-xsa12.patch

  - bnc#777088 - CVE-2012-3495: xen: hypercall     physdev_get_free_pirq vulnerability (XSA-13)     CVE-2012-3495-xsa13.patch

  - bnc#777091 - CVE-2012-3496: xen: XENMEM_populate_physmap     DoS vulnerability (XSA-14) CVE-2012-3496-xsa14.patch

  - bnc#777086 - CVE-2012-3498: xen: PHYSDEVOP_map_pirq     index vulnerability (XSA-16) CVE-2012-3498-xsa16.patch

  - bnc#777084 - CVE-2012-3515: xen: Qemu VT100 emulation     vulnerability (XSA-17) CVE-2012-3515-xsa17.patch

  - Upstream patches from Jan     25734-x86-MCG_CTL-default.patch     25735-x86-cpuid-masking-XeonE5.patch     25744-hypercall-return-long.patch

  - Update to Xen 4.1.3 c/s 23336 

  - Upstream or pending upstream patches from Jan     25587-fix-off-by-one-parsing-error.patch     25616-x86-MCi_CTL-default.patch     25617-vtd-qinval-addr.patch 25688-x86-nr_irqs_gsi.patch

  - bnc#773393 - VUL-0: CVE-2012-3433: xen: HVM guest     destroy p2m teardown host DoS vulnerability     CVE-2012-3433-xsa11.patch

  - bnc#773401 - VUL-1: CVE-2012-3432: xen: HVM guest user     mode MMIO emulation DoS     25682-x86-inconsistent-io-state.patch

  - bnc#762484 - VUL-1: CVE-2012-2625: xen: pv bootloader     doesn't check the size of the bzip2 or lzma compressed     kernel, leading to denial of service     25589-pygrub-size-limits.patch

  - bnc#767273 - unsupported /var/lock/subsys is still used     by xendomains init.xendomains

  - bnc#766283 - opensuse 12.2 pv guests can not start after     installation due to lack of grub2 support in the host     23686-pygrub-solaris.patch 23697-pygrub-grub2.patch     23944-pygrub-debug.patch 23998-pygrub-GPT.patch     23999-pygrub-grub2.patch 24000-pygrub-grub2.patch     24001-pygrub-grub2.patch 24002-pygrub-grub2.patch     24064-pygrub-HybridISO.patch     24401-pygrub-scrolling.patch 24402-pygrub-edit-fix.patch     24460-pygrub-extlinux.patch 24706-pygrub-extlinux.patch

Security Update for Xen Following fixes were done :

  - bnc#776995 - attaching scsi control luns with pvscsi

  - xend/pvscsi: fix passing of SCSI control LUNs     xen-bug776995-pvscsi-no-devname.patch

  - xend/pvscsi: fix usage of persistant device names for     SCSI devices xen-bug776995-pvscsi-persistent-names.patch

  - xend/pvscsi: update sysfs parser for Linux 3.0     xen-bug776995-pvscsi-sysfs-parser.patch

  - bnc#777090 - VUL-0: CVE-2012-3494: xen: hypercall     set_debugreg vulnerability (XSA-12)     CVE-2012-3494-xsa12.patch

  - bnc#777091 - VUL-0: CVE-2012-3496: xen:
    XENMEM_populate_physmap DoS vulnerability (XSA-14)     CVE-2012-3496-xsa14.patch

  - bnc#777084 - VUL-0: CVE-2012-3515: xen: Qemu VT100     emulation vulnerability (XSA-17)     CVE-2012-3515-xsa17.patch

  - bnc#744771 - VM with passed through PCI card fails to     reboot under dom0 load 24888-pci-release-devices.patch

  - Upstream patches from Jan     25431-x86-EDD-MBR-sig-check.patch     25459-page-list-splice.patch     25478-x86-unknown-NMI-deadlock.patch     25480-x86_64-sysret-canonical.patch     25481-x86_64-AMD-erratum-121.patch     25485-x86_64-canonical-checks.patch     25587-param-parse-limit.patch     25617-vtd-qinval-addr.patch 25688-x86-nr_irqs_gsi.patch

  - bnc#773393 - VUL-0: CVE-2012-3433: xen: HVM guest     destroy p2m teardown host DoS vulnerability     CVE-2012-3433-xsa11.patch

  - bnc#773401 - VUL-1: CVE-2012-3432: xen: HVM guest user     mode MMIO emulation DoS     25682-x86-inconsistent-io-state.patch

  - bnc#762484 - VUL-1: CVE-2012-2625: xen: pv bootloader     doesn't check the size of the bzip2 or lzma compressed     kernel, leading to denial of service     25589-pygrub-size-limits.patch

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1130 advisory.

    [3.0.3-135.el5_8.4]
    - pygrub: Improve handling of big files (rhbz 821704)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated xen packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Red Hat Enterprise Linux.

A flaw was found in the way the pyGrub boot loader handled compressed kernel images. A privileged guest user in a para-virtualized guest (a DomU) could use this flaw to create a crafted kernel image that, when attempting to boot it, could result in an out-of-memory condition in the privileged domain (the Dom0). (CVE-2012-2625)

Red Hat would like to thank Xinli Niu for reporting this issue.

All users of xen are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, the xend service must be restarted for this update to take effect.

Xen was updated to fix several security issues :

  - A xen HVM guest destroy p2m teardown host DoS     vulnerability was fixed, where malicious guest could     lock/crash the host. (CVE-2012-3433)

  - A xen HVM guest user mode MMIO emulation DoS was fixed.
    (CVE-2012-3432)

  - The xen pv bootloader doesn't check the size of the     bzip2 or lzma compressed kernel, leading to denial of     service (crash). (CVE-2012-2625)

Also the following bug in XEN has been fixed :

  - Xen HVM DomU crash during Windows Server 2008 R2     install, when maxmem > memory This update also included     bugfixes for:. (bnc#746702)

  - vm-install: - bnc#762963 - ReaR: Unable to recover a     paravirtualized XEN guest

  - virt-manager - SLE11-SP2 ONLY

  - virt-manager fails to start after upgrade to SLES11 SP2     from SLES10. (bnc#764982)

Xen was updated to fix several security issues :

  - A xen HVM guest destroy p2m teardown host DoS     vulnerability was fixed, where malicious guest could     lock/crash the host. (CVE-2012-3433)

  - A xen HVM guest user mode MMIO emulation DoS was fixed.
    (CVE-2012-3432)

  - The xen pv bootloader doesn't check the size of the     bzip2 or lzma compressed kernel, leading to denial of     service (crash). (CVE-2012-2625)

Also the following bug in XEN was fixed :

  - Xen HVM DomU crash during Windows Server 2008 R2     install, when maxmem > memory This update also included     bugfixes for:. (bnc#746702)

  - vm-install: - bnc#762963 - ReaR: Unable to recover a     paravirtualized XEN guest

XEN was updated to fix multiple bugs and security issues.

The following security issues have been fixed :

  - xen: hypercall set_debugreg vulnerability (XSA-12).
    (CVE-2012-3494)

  - xen: Qemu VT100 emulation vulnerability (XSA-17).
    (CVE-2012-3515)

  - xen: pv bootloader doesn't check the size of the bzip2     or lzma compressed kernel, leading to denial of service.
    (CVE-2012-2625)

The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Scientific Linux.

A flaw was found in the way the pyGrub boot loader handled compressed kernel images. A privileged guest user in a para-virtualized guest (a DomU) could use this flaw to create a crafted kernel image that, when attempting to boot it, could result in an out-of-memory condition in the privileged domain (the Dom0). (CVE-2012-2625)

All users of xen are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, the xend service must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1130 advisory.

    The xen packages contain administration tools and the xend service for     managing the kernel-xen kernel for virtualization on Red Hat Enterprise     Linux.

    A flaw was found in the way the pyGrub boot loader handled compressed     kernel images. A privileged guest user in a para-virtualized guest (a DomU)     could use this flaw to create a crafted kernel image that, when attempting     to boot it, could result in an out-of-memory condition in the privileged     domain (the Dom0). (CVE-2012-2625)

    Red Hat would like to thank Xinli Niu for reporting this issue.

    All users of xen are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue. After installing the     updated packages, the xend service must be restarted for this update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	low
79489	OracleVM 3.1 : xen (OVMSA-2012-0051)	Nessus	OracleVM Local Security Checks	medium
74821	openSUSE Security Update : XEN (openSUSE-SU-2012:1573-1)	Nessus	SuSE Local Security Checks	high
74820	openSUSE Security Update : XEN (openSUSE-SU-2012:1572-1)	Nessus	SuSE Local Security Checks	high
74751	openSUSE Security Update : Xen (openSUSE-SU-2012:1176-1)	Nessus	SuSE Local Security Checks	high
74750	openSUSE Security Update : Xen (openSUSE-SU-2012:1172-1)	Nessus	SuSE Local Security Checks	high
74749	openSUSE Security Update : Xen (openSUSE-SU-2012:1174-1)	Nessus	SuSE Local Security Checks	high
68588	Oracle Linux 5 : xen (ELSA-2012-1130)	Nessus	Oracle Linux Local Security Checks	medium
67092	CentOS 5 : xen (CESA-2012:1130)	Nessus	CentOS Local Security Checks	low
64235	SuSE 11.2 Security Update : Xen and libvirt (SAT Patch Number 6640)	Nessus	SuSE Local Security Checks	medium
64234	SuSE 11.1 Security Update : Xen (SAT Patch Number 6653)	Nessus	SuSE Local Security Checks	medium
62025	SuSE 10 Security Update : Xen (ZYPP Patch Number 8268)	Nessus	SuSE Local Security Checks	high
61408	Scientific Linux Security Update : xen on SL5.x i386/x86_64 (20120731)	Nessus	Scientific Linux Local Security Checks	low
61376	RHEL 5 : xen (RHSA-2012:1130)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2012-2625

medium

Tenable Plugins

low

medium

high

high

high

high

high

medium

low

medium

medium

high

low

medium