The get_page_from_gfn hypercall function in Xen 4.2 allows local PV guest OS administrators to cause a denial of service (crash) via a crafted GFN that triggers a buffer over-read.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The XENMEM_exchange handler in Xen 4.2 and earlier does not properly check the memory address, which
    allows local PV guest OS administrators to cause a denial of service (crash) or possibly gain privileges
    via unspecified vectors that overwrite memory in the hypervisor reserved range. (CVE-2012-5513)

  - Xen 4.x, when downgrading the grant table version, does not properly remove the status page from the
    tracking list when freeing the page, which allows local guest OS administrators to cause a denial of
    service (hypervisor crash) via unspecified vectors. (CVE-2012-5510)

  - Stack-based buffer overflow in the dirty video RAM tracking functionality in Xen 3.4 through 4.1 allows
    local HVM guest OS administrators to cause a denial of service (crash) via a large bitmap image.
    (CVE-2012-5511)

  - The guest_physmap_mark_populate_on_demand function in Xen 4.2 and earlier does not properly unlock the
    subject GFNs when checking if they are in use, which allows local guest HVM administrators to cause a
    denial of service (hang) via unspecified vectors. (CVE-2012-5514)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The XENMEM_exchange handler in Xen 4.2 and earlier does not properly check the memory address, which
    allows local PV guest OS administrators to cause a denial of service (crash) or possibly gain privileges
    via unspecified vectors that overwrite memory in the hypervisor reserved range. (CVE-2012-5513)

  - The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local
    para-virtualized guest users to cause a denial of service (memory consumption) via a large (1) bzip2 or
    (2) lzma compressed kernel image. (CVE-2012-2625)

  - Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cause a denial
    of service (Xen infinite loop and physical CPU consumption) by setting a VCPU with an "inappropriate
    deadline." (CVE-2012-4535)

  - Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables
    when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of
    service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability."
    (CVE-2012-4537)

  - The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state
    when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service
    (hypervisor crash) via unspecified vectors. (CVE-2012-4538)

The remote host is affected by the vulnerability described in GLSA-201309-24 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Guest domains could possibly gain privileges, execute arbitrary code, or       cause a Denial of Service on the host domain (Dom0). Additionally, guest       domains could gain information about other virtual machines running on       the same host or read arbitrary files on the host.
  Workaround :

    The CVEs listed below do not currently have fixes, but only apply to Xen       setups which have &ldquo;tmem&rdquo; specified on the hypervisor command line.
      TMEM is not currently supported for use in production systems, and       administrators using tmem should disable it.
      Relevant CVEs:
      * CVE-2012-2497
      * CVE-2012-6030
      * CVE-2012-6031
      * CVE-2012-6032
      * CVE-2012-6033
      * CVE-2012-6034
      * CVE-2012-6035
      * CVE-2012-6036

A guest can cause xen to crash [XSA-26, CVE-2012-5510] (#883082) An HVM guest can cause xen to run slowly or crash [XSA-27, CVE-2012-5511] (#883084) A PV guest can cause xen to crash and might be able escalate privileges [XSA-29, CVE-2012-5513] (#883088) An HVM guest can cause xen to hang [XSA-30, CVE-2012-5514] (#883091) A guest can cause xen to hang [XSA-31, CVE-2012-5515] (#883092) A PV guest can cause xen to crash and might be able escalate privileges [XSA-32, CVE-2012-5525] (#883094)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
401327	Alpine: multiple xen packages: security update to 4.2.0-r6 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
401327	Alpine: multiple xen packages: security update to 4.2.0-r6 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
401189	Alpine: multiple xen packages: security update to 4.2.0-r7 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
401189	Alpine: multiple xen packages: security update to 4.2.0-r7 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
70184	GLSA-201309-24 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
63239	Fedora 18 : xen-4.2.0-6.fc18 (2012-19652)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-5525

medium

Tenable Plugins

high

high

high

high

high

medium