qemu-nbd in QEMU, as used in Xen 4.2.x, determines the format of a raw disk image based on the header, which allows local guest OS administrators to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted, a different vulnerability than CVE-2008-2004.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an
    IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service (hypervisor
    crash) by triggering a #GP fault, which is not properly handled by another IRET instruction.
    (CVE-2013-1917)

  - Xen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain clients to
    gain access to IRQs and cause a denial of service via vectors related to "passed-through IRQs or PCI
    devices." (CVE-2013-1919)

  - Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running "under memory pressure" and the Xen Security
    Module (XSM) is enabled, uses the wrong ordering of operations when extending the per-domain event channel
    tracking table, which causes a use-after-free and allows local guest kernels to inject arbitrary events
    and gain privileges via unspecified vectors. (CVE-2013-1920)

  - qemu-nbd in QEMU, as used in Xen 4.2.x, determines the format of a raw disk image based on the header,
    which allows local guest OS administrators to read arbitrary files on the host by modifying the header to
    identify a different format, which is used when the guest is restarted, a different vulnerability than
    CVE-2008-2004. (CVE-2013-1922)

XEN was updated to 4.2.2, fixing lots of bugs and several security issues.

Various upstream patches were also merged into this version by our developers.

Detailed buglist :

  - bnc#824676 - Failed to setup devices for vm instance     when start multiple vms simultaneously

  - bnc#817799 - sles9sp4 guest fails to start after     upgrading to sles11 sp3

  - bnc#826882 - xen: CVE-2013-1432: XSA-58: Page reference     counting error due to XSA-45/CVE-2013-1918 fixes

  - Add upstream patch to fix devid assignment in libxl     27184-libxl-devid-fix.patch

  - bnc#823608 - xen: XSA-57: libxl allows guest write     access to sensitive console related xenstore keys     27178-libxl-Restrict-permissions-on-PV-console-device-xe     nstore-nodes.patch

  - bnc#823011 - xen: XSA-55: Multiple vulnerabilities in     libelf PV kernel handling

  - bnc#808269 - Fully Virtualized Windows VM install is     failed on Ivy Bridge platforms with Xen kernel

  - bnc#801663 - performance of mirror lvm unsuitable for     production block-dmmd

  - bnc#817904 - [SLES11SP3 BCS Bug] Crashkernel fails to     boot after panic on XEN kernel SP3 Beta 4 and RC1

  - Upstream AMD Erratum patch from Jan

  - bnc#813675 - - xen: CVE-2013-1919: XSA-46: Several     access permission issues with IRQs for unprivileged     guests

  - bnc#820917 - CVE-2013-2076: xen: Information leak on     XSAVE/XRSTOR capable AMD CPUs (XSA-52)

  - bnc#820919 - CVE-2013-2077: xen: Hypervisor crash due to     missing exception recovery on XRSTOR (XSA-53)

  - bnc#820920 - CVE-2013-2078: xen: Hypervisor crash due to     missing exception recovery on XSETBV (XSA-54)

  - bnc#808085 - aacraid driver panics mapping INT A when     booting kernel-xen

  - bnc#817210 - openSUSE 12.3 Domain 0 doesn't boot with     i915 graphics controller under Xen with VT-d enabled

  - bnc#819416 - xen: CVE-2013-2072: XSA-56: Buffer overflow     in xencontrol Python bindings affecting xend

  - bnc#818183 - xen: CVE-2013-2007: XSA-51: qga set umask     0077 when daemonizing

  - add lndir to BuildRequires

  - remove     xen.migrate.tools_notify_restore_to_hangup_during_migrat     ion_--abort_if_busy.patch It changed migration protocol     and upstream wants a different solution

  - bnc#802221 - fix xenpaging readd     xenpaging.qemu.flush-cache.patch

  - bnc#808269 - Fully Virtualized Windows VM install is     failed on Ivy Bridge platforms with Xen kernel

  - Additional fix for bnc#816159     CVE-2013-1918-xsa45-followup.patch

  - bnc#817068 - Xen guest with >1 sr-iov vf won't start

  - Update to Xen 4.2.2 c/s 26064 The following recent     security patches are included in the tarball     CVE-2013-0151-xsa34.patch (bnc#797285)     CVE-2012-6075-xsa41.patch (bnc#797523)     CVE-2013-1917-xsa44.patch (bnc#813673)     CVE-2013-1919-xsa46.patch (bnc#813675)

  - bnc#816159 - xen: CVE-2013-1918: XSA-45: Several long     latency operations are not preemptible

  - bnc#816163 - xen: CVE-2013-1952: XSA-49: VT-d interrupt     remapping source validation flaw for bridges

  - bnc#809662 - can't use pv-grub to start domU (pygrub     does work) xen.spec

  - bnc#814709 - Unable to create XEN virtual machines in     SLED 11 SP2 on Kyoto

  - bnc#813673 - CVE-2013-1917: xen: Xen PV DoS     vulnerability with SYSENTER

  - bnc#813675 - CVE-2013-1919: xen: Several access     permission issues with IRQs for unprivileged guests

  - bnc#814059 - xen: qemu-nbd format-guessing due to     missing format specification

The Xen hypervisor and tool-suite have been updated to fix security issues and bugs :

  - XSA-73: A lock order reversal between page allocation     and grant table locks could lead to host crashes or even     host code execution. (CVE-2013-4494)

  - XSA-74: A lock order reversal between page_alloc_lock     and mm_rwlock could lead to deadlocks. (CVE-2013-4553)

  - XSA-76: Hypercalls exposed to privilege rings 1 and 2 of     HVM guests which might lead to Hypervisor escalation     under specific circumstances. (CVE-2013-4554)

  - XSA-78: Insufficient TLB flushing in VT-d (iommu) code     could lead to access of memory that was revoked.
    (CVE-2013-6375)

  - XSA-75: A host crash due to guest VMX instruction     execution was fixed. Non-security bugs have also been     fixed:. (CVE-2013-4551)

  - It is possible to start a VM twice on the same node.
    (bnc#840997)

  - In HP's UEFI x86_64 platform and SLES 11-SP3, dom0 will     could lock-up on multiple blades nPar. (bnc#842417)

  - Xen Hypervisor panics on 8-blades nPar with 46-bit     memory addressing. (bnc#848014)

  - Soft lock-up with PCI pass-through and many VCPUs.
    (bnc#846849)

  - Boot Failure with Xen kernel in UEFI mode with error 'No     memory for trampoline'. (bnc#833483)

  - Increase the maximum supported CPUs in the Hypervisor to     512.

The remote host is affected by the vulnerability described in GLSA-201309-24 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Guest domains could possibly gain privileges, execute arbitrary code, or       cause a Denial of Service on the host domain (Dom0). Additionally, guest       domains could gain information about other virtual machines running on       the same host or read arbitrary files on the host.
  Workaround :

    The CVEs listed below do not currently have fixes, but only apply to Xen       setups which have &ldquo;tmem&rdquo; specified on the hypervisor command line.
      TMEM is not currently supported for use in production systems, and       administrators using tmem should disable it.
      Relevant CVEs:
      * CVE-2012-2497
      * CVE-2012-6030
      * CVE-2012-6031
      * CVE-2012-6032
      * CVE-2012-6033
      * CVE-2012-6034
      * CVE-2012-6035
      * CVE-2012-6036

- CVE-2013-1922: qemu-nbd block format auto-detection     vulnerability (bz #952574, bz #923219)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix booting 3.8 kernels with qemu-system-arm (bz     #922796)

    - Fix crash with -vga qxl, sdl, and F19 guest (bz       #949126)

    - CVE-2013-1922: qemu-nbd block format auto-detection       vulnerability (bz #952574, bz #923219)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Rebased to version 1.4.1

    - qemu stable release 1.4.1 (bz #952599)

    - CVE-2013-1922: qemu-nbd block format auto-detection       vulnerability (bz #952574, bz #923219)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
401310	Alpine: multiple xen packages: security update to 4.2.1-r6 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
401310	Alpine: multiple xen packages: security update to 4.2.1-r6 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
75130	openSUSE Security Update : xen (openSUSE-SU-2013:1404-1)	Nessus	SuSE Local Security Checks	high
71562	SuSE 11.3 Security Update : Xen (SAT Patch Number 8588)	Nessus	SuSE Local Security Checks	high
70184	GLSA-201309-24 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
66261	Fedora 17 : qemu-1.0.1-6.fc17 (2013-6211)	Nessus	Fedora Local Security Checks	low
66223	Fedora 18 : qemu-1.2.2-11.fc18 (2013-6221)	Nessus	Fedora Local Security Checks	low
66222	Fedora 19 : qemu-1.4.1-1.fc19 (2013-6185)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2013-1922

medium

Tenable Plugins

critical

critical

high

high

high

low

low

low