The handle_mmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service (guest OS crash) via unspecified operations on MMIO regions.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2012-3432 / XSA-10: HVM guest user mode MMIO     emulation DoS vulnerability [orabug 14463558]     (CVE-2012-3432)

Security Update for Xen

Following bug and security fixes were applied :

  - bnc#776995 - attaching scsi control luns with pvscsi

  - xend/pvscsi: fix passing of SCSI control LUNs     xen-bug776995-pvscsi-no-devname.patch

  - xend/pvscsi: fix usage of persistant device names for     SCSI devices xen-bug776995-pvscsi-persistent-names.patch

  - xend/pvscsi: update sysfs parser for Linux 3.0     xen-bug776995-pvscsi-sysfs-parser.patch

  - bnc#777090 - CVE-2012-3494: xen: hypercall set_debugreg     vulnerability (XSA-12) CVE-2012-3494-xsa12.patch

  - bnc#777088 - CVE-2012-3495: xen: hypercall     physdev_get_free_pirq vulnerability (XSA-13)     CVE-2012-3495-xsa13.patch

  - bnc#777091 - CVE-2012-3496: xen: XENMEM_populate_physmap     DoS vulnerability (XSA-14) CVE-2012-3496-xsa14.patch

  - bnc#777086 - CVE-2012-3498: xen: PHYSDEVOP_map_pirq     index vulnerability (XSA-16) CVE-2012-3498-xsa16.patch

  - bnc#777084 - CVE-2012-3515: xen: Qemu VT100 emulation     vulnerability (XSA-17) CVE-2012-3515-xsa17.patch

  - Upstream patches from Jan     25734-x86-MCG_CTL-default.patch     25735-x86-cpuid-masking-XeonE5.patch     25744-hypercall-return-long.patch

  - Update to Xen 4.1.3 c/s 23336 

  - Upstream or pending upstream patches from Jan     25587-fix-off-by-one-parsing-error.patch     25616-x86-MCi_CTL-default.patch     25617-vtd-qinval-addr.patch 25688-x86-nr_irqs_gsi.patch

  - bnc#773393 - VUL-0: CVE-2012-3433: xen: HVM guest     destroy p2m teardown host DoS vulnerability     CVE-2012-3433-xsa11.patch

  - bnc#773401 - VUL-1: CVE-2012-3432: xen: HVM guest user     mode MMIO emulation DoS     25682-x86-inconsistent-io-state.patch

  - bnc#762484 - VUL-1: CVE-2012-2625: xen: pv bootloader     doesn't check the size of the bzip2 or lzma compressed     kernel, leading to denial of service     25589-pygrub-size-limits.patch

  - bnc#767273 - unsupported /var/lock/subsys is still used     by xendomains init.xendomains

  - bnc#766283 - opensuse 12.2 pv guests can not start after     installation due to lack of grub2 support in the host     23686-pygrub-solaris.patch 23697-pygrub-grub2.patch     23944-pygrub-debug.patch 23998-pygrub-GPT.patch     23999-pygrub-grub2.patch 24000-pygrub-grub2.patch     24001-pygrub-grub2.patch 24002-pygrub-grub2.patch     24064-pygrub-HybridISO.patch     24401-pygrub-scrolling.patch 24402-pygrub-edit-fix.patch     24460-pygrub-extlinux.patch 24706-pygrub-extlinux.patch

Security Update for Xen Following fixes were done :

  - bnc#776995 - attaching scsi control luns with pvscsi

  - xend/pvscsi: fix passing of SCSI control LUNs     xen-bug776995-pvscsi-no-devname.patch

  - xend/pvscsi: fix usage of persistant device names for     SCSI devices xen-bug776995-pvscsi-persistent-names.patch

  - xend/pvscsi: update sysfs parser for Linux 3.0     xen-bug776995-pvscsi-sysfs-parser.patch

  - bnc#777090 - VUL-0: CVE-2012-3494: xen: hypercall     set_debugreg vulnerability (XSA-12)     CVE-2012-3494-xsa12.patch

  - bnc#777091 - VUL-0: CVE-2012-3496: xen:
    XENMEM_populate_physmap DoS vulnerability (XSA-14)     CVE-2012-3496-xsa14.patch

  - bnc#777084 - VUL-0: CVE-2012-3515: xen: Qemu VT100     emulation vulnerability (XSA-17)     CVE-2012-3515-xsa17.patch

  - bnc#744771 - VM with passed through PCI card fails to     reboot under dom0 load 24888-pci-release-devices.patch

  - Upstream patches from Jan     25431-x86-EDD-MBR-sig-check.patch     25459-page-list-splice.patch     25478-x86-unknown-NMI-deadlock.patch     25480-x86_64-sysret-canonical.patch     25481-x86_64-AMD-erratum-121.patch     25485-x86_64-canonical-checks.patch     25587-param-parse-limit.patch     25617-vtd-qinval-addr.patch 25688-x86-nr_irqs_gsi.patch

  - bnc#773393 - VUL-0: CVE-2012-3433: xen: HVM guest     destroy p2m teardown host DoS vulnerability     CVE-2012-3433-xsa11.patch

  - bnc#773401 - VUL-1: CVE-2012-3432: xen: HVM guest user     mode MMIO emulation DoS     25682-x86-inconsistent-io-state.patch

  - bnc#762484 - VUL-1: CVE-2012-2625: xen: pv bootloader     doesn't check the size of the bzip2 or lzma compressed     kernel, leading to denial of service     25589-pygrub-size-limits.patch

The remote host is affected by the vulnerability described in GLSA-201309-24 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Guest domains could possibly gain privileges, execute arbitrary code, or       cause a Denial of Service on the host domain (Dom0). Additionally, guest       domains could gain information about other virtual machines running on       the same host or read arbitrary files on the host.
  Workaround :

    The CVEs listed below do not currently have fixes, but only apply to Xen       setups which have &ldquo;tmem&rdquo; specified on the hypervisor command line.
      TMEM is not currently supported for use in production systems, and       administrators using tmem should disable it.
      Relevant CVEs:
      * CVE-2012-2497
      * CVE-2012-6030
      * CVE-2012-6031
      * CVE-2012-6032
      * CVE-2012-6033
      * CVE-2012-6034
      * CVE-2012-6035
      * CVE-2012-6036

Xen was updated to fix several security issues :

  - A xen HVM guest destroy p2m teardown host DoS     vulnerability was fixed, where malicious guest could     lock/crash the host. (CVE-2012-3433)

  - A xen HVM guest user mode MMIO emulation DoS was fixed.
    (CVE-2012-3432)

  - The xen pv bootloader doesn't check the size of the     bzip2 or lzma compressed kernel, leading to denial of     service (crash). (CVE-2012-2625)

Also the following bug in XEN has been fixed :

  - Xen HVM DomU crash during Windows Server 2008 R2     install, when maxmem > memory This update also included     bugfixes for:. (bnc#746702)

  - vm-install: - bnc#762963 - ReaR: Unable to recover a     paravirtualized XEN guest

  - virt-manager - SLE11-SP2 ONLY

  - virt-manager fails to start after upgrade to SLES11 SP2     from SLES10. (bnc#764982)

Xen was updated to fix several security issues :

  - A xen HVM guest destroy p2m teardown host DoS     vulnerability was fixed, where malicious guest could     lock/crash the host. (CVE-2012-3433)

  - A xen HVM guest user mode MMIO emulation DoS was fixed.
    (CVE-2012-3432)

  - The xen pv bootloader doesn't check the size of the     bzip2 or lzma compressed kernel, leading to denial of     service (crash). (CVE-2012-2625)

Also the following bug in XEN was fixed :

  - Xen HVM DomU crash during Windows Server 2008 R2     install, when maxmem > memory This update also included     bugfixes for:. (bnc#746702)

  - vm-install: - bnc#762963 - ReaR: Unable to recover a     paravirtualized XEN guest

Several denial-of-service vulnerabilities have been discovered in Xen, the popular virtualization software. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2012-3432     Guest mode unprivileged code, which has been granted the     privilege to access MMIO regions, may leverage that     access to crash the whole guest. Since this can be used     to crash a client from within, this vulnerability is     considered to have low impact.

  - CVE-2012-3433     A guest kernel can cause the host to become unresponsive     for a period of time, potentially leading to a DoS.
    Since an attacker with full control in the guest can     impact the host, this vulnerability is considered to     have high impact.

in rare circumstances an unprivileged user can crash an HVM guest [XSA-10] (#843766)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

in rare circumstances an unprivileged user can crash an HVM guest [XSA-10] (#843766), remove a dependency on PyXML and Require python-lxml instead of PyXML (#842843) adjust systemd service files not to report failures when running without a hypervisor or when xendomains.service doesn't find anything to start

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
79481	OracleVM 2.2 : xen (OVMSA-2012-0036)	Nessus	OracleVM Local Security Checks	low
74751	openSUSE Security Update : Xen (openSUSE-SU-2012:1176-1)	Nessus	SuSE Local Security Checks	high
74750	openSUSE Security Update : Xen (openSUSE-SU-2012:1172-1)	Nessus	SuSE Local Security Checks	high
74749	openSUSE Security Update : Xen (openSUSE-SU-2012:1174-1)	Nessus	SuSE Local Security Checks	high
70184	GLSA-201309-24 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
64235	SuSE 11.2 Security Update : Xen and libvirt (SAT Patch Number 6640)	Nessus	SuSE Local Security Checks	medium
64234	SuSE 11.1 Security Update : Xen (SAT Patch Number 6653)	Nessus	SuSE Local Security Checks	medium
61578	Debian DSA-2531-1 : xen - Denial of Service	Nessus	Debian Local Security Checks	medium
61423	Fedora 16 : xen-4.1.2-9.fc16 (2012-11190)	Nessus	Fedora Local Security Checks	low
61422	Fedora 17 : xen-4.1.2-24.fc17 (2012-11182)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2012-3432

medium

Tenable Plugins

low

high

high

high

high

medium

medium

medium

low

low