Array index error in the HVMOP_set_mem_access handler in Xen 4.1 allows local HVM guest OS administrators to cause a denial of service (crash) or obtain sensitive information via unspecified vectors.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2012-0057 for details.

This update of XEN fixes various denial of service bugs.

  - bnc#789945 - CVE-2012-5510: xen: Grant table version     switch list corruption vulnerability (XSA-26)

  - bnc#789944 - CVE-2012-5511: xen: Several HVM operations     do not validate the range of their inputs (XSA-27)

  - bnc#789940 - CVE-2012-5512: xen: HVMOP_get_mem_access     crash / HVMOP_set_mem_access information leak (XSA-28)

  - bnc#789951 - CVE-2012-5513: xen: XENMEM_exchange may     overwrite hypervisor memory (XSA-29)

  - bnc#789948 - CVE-2012-5514: xen: Missing unlock in     guest_physmap_mark_populate_on_demand() (XSA-30)

  - bnc#789950 - CVE-2012-5515: xen: Several memory     hypercall operations allow invalid extent order values     (XSA-31)

  - bnc#789988 - FATAL PAGE FAULT in hypervisor     (arch_do_domctl)     25931-x86-domctl-iomem-mapping-checks.patch

  - Upstream patches from Jan     26132-tmem-save-NULL-check.patch     26134-x86-shadow-invlpg-check.patch     26148-vcpu-timer-overflow.patch (Replaces     CVE-2012-4535-xsa20.patch)     26149-x86-p2m-physmap-error-path.patch (Replaces     CVE-2012-4537-xsa22.patch)     26150-x86-shadow-unhook-toplevel-check.patch (Replaces     CVE-2012-4538-xsa23.patch)     26151-gnttab-compat-get-status-frames.patch (Replaces     CVE-2012-4539-xsa24.patch)

  - bnc#777628 - guest 'disappears' after live migration     Updated block-dmmd script

  - Fix exception in balloon.py and osdep.py     xen-max-free-mem.diff

  - bnc#792476 - efi files missing in latest XEN update     Revert c/s 25751 EFI Makefile changes in     23614-x86_64-EFI-boot.patch

XEN was updated to fix various denial of service issues.

  - bnc#789945 - CVE-2012-5510: xen: Grant table version     switch list corruption vulnerability (XSA-26)

  - bnc#789944 - CVE-2012-5511: xen: Several HVM operations     do not validate the range of their inputs (XSA-27)

  - bnc#789940 - CVE-2012-5512: xen: HVMOP_get_mem_access     crash / HVMOP_set_mem_access information leak (XSA-28)

  - bnc#789951 - CVE-2012-5513: xen: XENMEM_exchange may     overwrite hypervisor memory (XSA-29)

  - bnc#789948 - CVE-2012-5514: xen: Missing unlock in     guest_physmap_mark_populate_on_demand() (XSA-30)

  - bnc#789950 - CVE-2012-5515: xen: Several memory     hypercall operations allow invalid extent order values     (XSA-31)

  - bnc#789988 - FATAL PAGE FAULT in hypervisor     (arch_do_domctl)

  - Upstream patches from Jan     26132-tmem-save-NULL-check.patch     26134-x86-shadow-invlpg-check.patch     26148-vcpu-timer-overflow.patch (Replaces     CVE-2012-4535-xsa20.patch)     26149-x86-p2m-physmap-error-path.patch (Replaces     CVE-2012-4537-xsa22.patch)     26150-x86-shadow-unhook-toplevel-check.patch (Replaces     CVE-2012-4538-xsa23.patch)

  - bnc#777628 - guest 'disappears' after live migration     Updated block-dmmd script

  - Fix exception in balloon.py and osdep.py     xen-max-free-mem.diff

  - bnc#792476 - efi files missing in latest XEN update     Revert c/s 25751 EFI Makefile changes in     23614-x86_64-EFI-boot.patch

The remote host is affected by the vulnerability described in GLSA-201309-24 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Guest domains could possibly gain privileges, execute arbitrary code, or       cause a Denial of Service on the host domain (Dom0). Additionally, guest       domains could gain information about other virtual machines running on       the same host or read arbitrary files on the host.
  Workaround :

    The CVEs listed below do not currently have fixes, but only apply to Xen       setups which have &ldquo;tmem&rdquo; specified on the hypervisor command line.
      TMEM is not currently supported for use in production systems, and       administrators using tmem should disable it.
      Relevant CVEs:
      * CVE-2012-2497
      * CVE-2012-6030
      * CVE-2012-6031
      * CVE-2012-6032
      * CVE-2012-6033
      * CVE-2012-6034
      * CVE-2012-6035
      * CVE-2012-6036

This update fixes the following security issues in xen :

  - Grant table version switch list corruption vulnerability     (XSA-26). (CVE-2012-5510)

  - Several HVM operations do not validate the range of     their inputs (XSA-27). (CVE-2012-5511)

  - HVMOP_get_mem_access crash / HVMOP_set_mem_access     information leak (XSA-28). (CVE-2012-5512)

  - XENMEM_exchange may overwrite hypervisor memory     (XSA-29). (CVE-2012-5513)

  - Missing unlock in     guest_physmap_mark_populate_on_demand() (XSA-30).
    (CVE-2012-5514)

  - Several memory hypercall operations allow invalid extent     order values (XSA-31) Also the following bugs have been     fixed and upstream patches have been applied:.
    (CVE-2012-5515)

  - FATAL PAGE FAULT in hypervisor (arch_do_domctl)

  - 25931-x86-domctl-iomem-mapping-checks.patch

  - 26132-tmem-save-NULL-check.patch

  - 26134-x86-shadow-invlpg-check.patch

  - 26148-vcpu-timer-overflow.patch (Replaces     CVE-2012-4535-xsa20.patch)

  - 26149-x86-p2m-physmap-error-path.patch (Replaces     CVE-2012-4537-xsa22.patch)

  - 26150-x86-shadow-unhook-toplevel-check.patch (Replaces     CVE-2012-4538-xsa23.patch)

  - 26151-gnttab-compat-get-status-frames.patch (Replaces     CVE-2012-4539-xsa24.patch)

  - efi files missing in latest XEN update. (bnc#792476)

A guest can cause xen to crash [XSA-26, CVE-2012-5510] (#883082) An HVM guest can cause xen to run slowly or crash [XSA-27, CVE-2012-5511] (#883084) An HVM guest can cause xen to crash or leak information [XSA-28, CVE-2012-5512] (#883085) A PV guest can cause xen to crash and might be able escalate privileges [XSA-29, CVE-2012-5513] (#883088) An HVM guest can cause xen to hang [XSA-30, CVE-2012-5514] (#883091) A guest can cause xen to hang [XSA-31, CVE-2012-5515] (#883092)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	low
79491	OracleVM 3.1 : xen (OVMSA-2012-0057)	Nessus	OracleVM Local Security Checks	medium
74852	openSUSE Security Update : xen (openSUSE-SU-2012:1685-1)	Nessus	SuSE Local Security Checks	medium
74850	openSUSE Security Update : xen (openSUSE-SU-2012:1687-1)	Nessus	SuSE Local Security Checks	medium
70184	GLSA-201309-24 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
64232	SuSE 11.2 Security Update : Xen (SAT Patch Number 7133)	Nessus	SuSE Local Security Checks	medium
63275	Fedora 16 : xen-4.1.3-6.fc16 (2012-19828)	Nessus	Fedora Local Security Checks	medium
63252	Fedora 17 : xen-4.1.3-7.fc17 (2012-19717)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-5512

medium

Tenable Plugins

low

medium

medium

medium

high

medium

medium

medium