The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause a denial of service (domain grant reference consumption) via unspecified vectors.

XEN has been updated to version 4.2.3 c/s 26170, fixing various bugs and security issues.

  - CVE-2013-4416: XSA-72: Fixed ocaml xenstored that     mishandled oversized message replies

  - CVE-2013-4355: XSA-63: Fixed information leaks through     I/O instruction emulation

  - CVE-2013-4361: XSA-66: Fixed information leak through     fbld instruction emulation

  - CVE-2013-4368: XSA-67: Fixed information leak through     outs instruction emulation

  - CVE-2013-4369: XSA-68: Fixed possible null dereference     when parsing vif ratelimiting info

  - CVE-2013-4370: XSA-69: Fixed misplaced free in ocaml     xc_vcpu_getaffinity stub

  - CVE-2013-4371: XSA-70: Fixed use-after-free in     libxl_list_cpupool under memory pressure

  - CVE-2013-4375: XSA-71: xen: qemu disk backend (qdisk)     resource leak

  - CVE-2013-1442: XSA-62: Fixed information leak on AVX     and/or LWP capable CPUs

  - CVE-2013-1432: XSA-58: Page reference counting error due     to XSA-45/CVE-2013-1918 fixes.

Various bugs have also been fixed :

  - Boot failure with xen kernel in UEFI mode with error 'No     memory for trampoline' (bnc#833483)

  - Improvements to block-dmmd script (bnc#828623)

  - MTU size on Dom0 gets reset when booting DomU with e1000     device (bnc#840196)

  - In HP's UEFI x86_64 platform and with xen environment,     in booting stage, xen hypervisor will panic.
    (bnc#833251)

  - Xen: migration broken from xsave-capable to     xsave-incapable host (bnc#833796)

  - In xen, 'shutdown -y 0 -h' cannot power off system     (bnc#834751)

  - In HP's UEFI x86_64 platform with xen environment, xen     hypervisor will panic on multiple blades nPar.
    (bnc#839600)

  - vcpus not started after upgrading Dom0 from SLES 11 SP2     to SP3 (bnc#835896)

  - SLES 11 SP3 Xen security patch does not automatically     update UEFI boot binary (bnc#836239)

  - Failed to setup devices for vm instance when start     multiple vms simultaneously (bnc#824676)

  - SLES 9 SP4 guest fails to start after upgrading to SLES     11 SP3 (bnc#817799)

  - Various upstream fixes have been included.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201407-03 (Xen: Multiple Vunlerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can utilize multiple vectors to execute arbitrary       code, cause Denial of Service, or gain access to data on the host.
  Workaround :

    There is no known workaround at this time.

Xen was updated to 4.2.3 c/s 26170 to fix various bugs and security issues.

Following issues were fixed :

  - bnc#845520 - CVE-2013-4416: xen: ocaml xenstored     mishandles oversized message replies

  - bnc#833483 - Boot Failure with xen kernel in UEFI mode     with error 'No memory for trampoline'

  - Improvements to block-dmmd script bnc#828623

  - bnc#840196 - MTU size on Dom0 gets reset when booting     DomU with e1000 device

  - bnc#840592 - CVE-2013-4355: XSA-63: xen: Information     leaks through I/O instruction emulation

  - bnc#841766 - CVE-2013-4361: XSA-66: xen: Information     leak through fbld instruction emulation

  - bnc#842511 - CVE-2013-4368: XSA-67: xen: Information     leak through outs instruction emulation

  - bnc#842512 - CVE-2013-4369: XSA-68: xen: possible null     dereference when parsing vif ratelimiting info

  - bnc#842513 - CVE-2013-4370: XSA-69: xen: misplaced free     in ocaml xc_vcpu_getaffinity stub

  - bnc#842514 - CVE-2013-4371: XSA-70: xen: use-after-free     in libxl_list_cpupool under memory pressure

  - bnc#842515 - CVE-2013-4375: XSA-71: xen: qemu disk     backend (qdisk) resource leak

  - bnc#839596 - CVE-2013-1442: XSA-62: xen: Information     leak on AVX and/or LWP capable CPUs

  - bnc#833251 - [HP BCS SLES11 Bug]: In HP&rsquo;s UEFI     x86_64 platform and with xen environment, in booting     stage ,xen hypervisor will panic.

  - bnc#833796 - Xen: migration broken from xsave-capable to     xsave-incapable host

  - bnc#834751 - [HP BCS SLES11 Bug]: In xen,     &ldquo;shutdown &ndash;y 0 &ndash;h&rdquo; cannot power     off system

  - bnc#839600 - [HP BCS SLES11 Bug]: In HP&rsquo;s UEFI     x86_64 platform and sles11sp3 with xen environment, xen     hypervisor will panic on multiple blades nPar. 

  - bnc#833251 - [HP BCS SLES11 Bug]: In HP&rsquo;s UEFI     x86_64 platform and with xen environment, in booting     stage ,xen hypervisor will panic.

  - bnc#835896 - vcpus not started after upgrading Dom0 from     11SP2 to SP3

  - bnc#836239 - SLES 11 SP3 Xen security patch does not     automatically update UEFI boot binary

Asias He discovered that QEMU incorrectly handled SCSI controllers with more than 256 attached devices. A local user could possibly use this flaw to elevate privileges. (CVE-2013-4344)

It was discovered that QEMU incorrectly handled Xen disks. A local guest could possibly use this flaw to consume resources, resulting in a denial of service. This issue only affected Ubuntu 12.10 and Ubuntu 13.10. (CVE-2013-4375)

Sibiao Luo discovered that QEMU incorrectly handled device hot-unplugging. A local user could possibly use this flaw to cause a denial of service. This issue only affected Ubuntu 13.10.
(CVE-2013-4377).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Xen hypervisor and tool-suite have been updated to fix security issues and bugs :

  - XSA-73: A lock order reversal between page allocation     and grant table locks could lead to host crashes or even     host code execution. (CVE-2013-4494)

  - XSA-74: A lock order reversal between page_alloc_lock     and mm_rwlock could lead to deadlocks. (CVE-2013-4553)

  - XSA-76: Hypercalls exposed to privilege rings 1 and 2 of     HVM guests which might lead to Hypervisor escalation     under specific circumstances. (CVE-2013-4554)

  - XSA-78: Insufficient TLB flushing in VT-d (iommu) code     could lead to access of memory that was revoked.
    (CVE-2013-6375)

  - XSA-75: A host crash due to guest VMX instruction     execution was fixed. Non-security bugs have also been     fixed:. (CVE-2013-4551)

  - It is possible to start a VM twice on the same node.
    (bnc#840997)

  - In HP's UEFI x86_64 platform and SLES 11-SP3, dom0 will     could lock-up on multiple blades nPar. (bnc#842417)

  - Xen Hypervisor panics on 8-blades nPar with 46-bit     memory addressing. (bnc#848014)

  - Soft lock-up with PCI pass-through and many VCPUs.
    (bnc#846849)

  - Boot Failure with Xen kernel in UEFI mode with error 'No     memory for trampoline'. (bnc#833483)

  - Increase the maximum supported CPUs in the Hypervisor to     512.

XEN has been updated to version 4.2.3 c/s 26170, fixing various bugs and security issues.

  - XSA-72: Fixed ocaml xenstored that mishandled oversized     message replies. (CVE-2013-4416)

  - XSA-63: Fixed information leaks through I/O instruction     emulation. (CVE-2013-4355)

  - XSA-66: Fixed information leak through fbld instruction     emulation. (CVE-2013-4361)

  - XSA-67: Fixed information leak through outs instruction     emulation. (CVE-2013-4368)

  - XSA-68: Fixed possible null dereference when parsing vif     ratelimiting info. (CVE-2013-4369)

  - XSA-69: Fixed misplaced free in ocaml     xc_vcpu_getaffinity stub. (CVE-2013-4370)

  - XSA-70: Fixed use-after-free in libxl_list_cpupool under     memory pressure. (CVE-2013-4371)

  - XSA-71: xen: qemu disk backend (qdisk) resource leak.
    (CVE-2013-4375)

  - XSA-62: Fixed information leak on AVX and/or LWP capable     CPUs. (CVE-2013-1442)

  - XSA-58: Page reference counting error due to     XSA-45/CVE-2013-1918 fixes. Various bugs have also been     fixed:. (CVE-2013-1432)

  - Boot failure with xen kernel in UEFI mode with error 'No     memory for trampoline'. (bnc#833483)

  - Improvements to block-dmmd script. (bnc#828623)

  - MTU size on Dom0 gets reset when booting DomU with e1000     device. (bnc#840196)

  - In HP's UEFI x86_64 platform and with xen environment,     in booting stage, xen hypervisor will panic.
    (bnc#833251)

  - Xen: migration broken from xsave-capable to     xsave-incapable host. (bnc#833796)

  - In xen, 'shutdown -y 0 -h' cannot power off system.
    (bnc#834751)

  - In HP's UEFI x86_64 platform with xen environment, xen     hypervisor will panic on multiple blades nPar.
    (bnc#839600)

  - vcpus not started after upgrading Dom0 from SLES 11 SP2     to SP3. (bnc#835896)

  - SLES 11 SP3 Xen security patch does not automatically     update UEFI boot binary. (bnc#836239)

  - Failed to setup devices for vm instance when start     multiple vms simultaneously. (bnc#824676)

  - SLES 9 SP4 guest fails to start after upgrading to SLES     11 SP3. (bnc#817799)

  - Various upstream fixes have been included.

Five security fixes CVE-2013-4368 CVE-2013-4369 CVE-2013-4370 CVE-2013-4371 CVE-2013-4375

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
83602	SUSE SLED11 / SLES11 Security Update : Xen (SUSE-SU-2013:1774-1)	Nessus	SuSE Local Security Checks	high
76544	GLSA-201407-03 : Xen: Multiple Vunlerabilities	Nessus	Gentoo Local Security Checks	high
74865	openSUSE Security Update : xen (openSUSE-SU-2013:1953-1)	Nessus	SuSE Local Security Checks	medium
72231	Ubuntu 12.04 LTS / 12.10 / 13.10 : qemu, qemu-kvm vulnerabilities (USN-2092-1)	Nessus	Ubuntu Local Security Checks	medium
71562	SuSE 11.3 Security Update : Xen (SAT Patch Number 8588)	Nessus	SuSE Local Security Checks	high
70969	SuSE 11.2 / 11.3 Security Update : Xen (SAT Patch Numbers 8478 / 8479)	Nessus	SuSE Local Security Checks	high
70550	Fedora 18 : xen-4.2.3-4.fc18 (2013-19053)	Nessus	Fedora Local Security Checks	medium
70549	Fedora 19 : xen-4.2.3-4.fc19 (2013-19048)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4375

medium

Tenable Plugins

high

high

medium

medium

high

high

medium

medium