Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, which allows local HVM guest users to cause a denial of service (host crash) via unspecified vectors related to "guest VMX instruction execution."

The remote host is affected by the vulnerability described in GLSA-201407-03 (Xen: Multiple Vunlerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can utilize multiple vectors to execute arbitrary       code, cause Denial of Service, or gain access to data on the host.
  Workaround :

    There is no known workaround at this time.

Xen was updated to fix various bugs and security issues :

Update to Xen version 4.2.4 c/s 26280.

  - bnc#861256 - CVE-2014-1950: xen: XSA-88: use-after-free     in xc_cpupool_getinfo() under memory pressure. (fix     included with update)

  - bnc#863297: xend/pvscsi: recognize also SCSI CDROM     devices

  - bnc#858496 - CVE-2014-1642: Xen: XSA-83: Out-of-memory     condition yielding memory corruption during IRQ setup

  - bnc#860163 - xen: XSA-84: integer overflow in several     XSM/Flask hypercalls (CVE-2014-1891 CVE-2014-1892     CVE-2014-1893 CVE-2014-1894)

  - bnc#860165 - CVE-2014-1895: xen: XSA-85: Off-by-one     error in FLASK_AVC_CACHESTAT hypercall

  - bnc#860300 - CVE-2014-1896: xen: XSA-86: libvchan     failure handling malicious ring indexes

  - bnc#860302 - CVE-2014-1666: xen: XSA-87:
    PHYSDEVOP_(prepare,release)_msix exposed to unprivileged     guests

  - bnc#858311 - Server is not booting in kernel XEN after     latest updates - (XEN) setup 0000:00:18.0 for d0 failed     (-19)

  - bnc#858496 - CVE-2014-1642: Xen: XSA-83: Out-of-memory     condition yielding memory corruption during IRQ setup

  - bnc#853049 - CVE-2013-6885: xen: XSA-82: Guest     triggerable AMD CPU erratum may cause host hang

  - bnc#853048 - CVE-2013-6400: xen: XSA-80: IOMMU TLB     flushing may be inadvertently suppressed

  - bnc#831120 - CVE-2013-2212: xen: XSA-60: Excessive time     to disable caching with HVM guests with PCI passthrough

  - bnc#848014 - [HP HPS] Xen hypervisor panics on 8-blades     nPar with 46-bit memory addressing

  - bnc#833251 - [HP BCS SLES11 Bug]: In HPs UEFI x86_64     platform and with xen environment, in booting stage ,xen     hypervisor will panic.

  - pygrub: Support (/dev/xvda) style disk specifications

  - bnc#849667 - CVE-2014-1895: xen: XSA-74: Lock order     reversal between page_alloc_lock and mm_rwlock

  - bnc#849668 - CVE-2013-4554: xen: XSA-76: Hypercalls     exposed to privilege rings 1 and 2 of HVM guests

  - bnc#842417 - In HPs UEFI x86_64 platform and sles11sp3     with xen environment, dom0 will soft lockup on multiple     blades nPar.

  - bnc#848014 - [HP HPS] Xen hypervisor panics on 8-blades     nPar with 46-bit memory addressing

  - bnc#846849 - Soft lockup with PCI passthrough and many     VCPUs

  - bnc#833483 - Boot Failure with xen kernel in UEFI mode     with error 'No memory for trampoline'

  - bnc#849665 - CVE-2013-4551: xen: XSA-75: Host crash due     to guest VMX instruction execution

  - The upstream version of checking for xend when using the     'xl' command is used is not working.

  - bnc#840997 - It is possible to start a VM twice on the     same node.

  - bnc#848657 - xen: CVE-2013-4494: XSA-73: Lock order     reversal between page allocation and grant table locks

Xen was updated to 4.3.1 and also to fix various security issues and bugs :

  - bnc#851749 - Xen service file does not call xend     properly xend.service 

  - Add missing requires to pciutils package for xend-tools

  - bnc#851386 - xen: XSA-78: Insufficient TLB flushing in     VT-d (iommu) code

  - Make -devel package depend on libuuid-devel, since     libxl.h includes uuid.h

  - bnc#849667 - CVE-2013-4553: xen: XSA-74: Lock order     reversal between page_alloc_lock and mm_rwlock

  - bnc#849665 - CVE-2013-4551: xen: XSA-75: Host crash due     to guest VMX instruction execution

  - bnc#849668 - CVE-2013-4554: xen: XSA-76: Hypercalls     exposed to privilege rings 1 and 2 of HVM guests

  - bnc#848657 - xen: CVE-2013-4494: XSA-73: Lock order     reversal between page allocation and grant table locks

  - Update to Xen 4.3.1 

  - bnc#845520 - CVE-2013-4416: xen: ocaml xenstored     mishandles oversized message replies

The Xen hypervisor and tool-suite have been updated to fix security issues and bugs :

  - XSA-73: A lock order reversal between page allocation     and grant table locks could lead to host crashes or even     host code execution. (CVE-2013-4494)

  - XSA-74: A lock order reversal between page_alloc_lock     and mm_rwlock could lead to deadlocks. (CVE-2013-4553)

  - XSA-76: Hypercalls exposed to privilege rings 1 and 2 of     HVM guests which might lead to Hypervisor escalation     under specific circumstances. (CVE-2013-4554)

  - XSA-78: Insufficient TLB flushing in VT-d (iommu) code     could lead to access of memory that was revoked.
    (CVE-2013-6375)

  - XSA-75: A host crash due to guest VMX instruction     execution was fixed. Non-security bugs have also been     fixed:. (CVE-2013-4551)

  - It is possible to start a VM twice on the same node.
    (bnc#840997)

  - In HP's UEFI x86_64 platform and SLES 11-SP3, dom0 will     could lock-up on multiple blades nPar. (bnc#842417)

  - Xen Hypervisor panics on 8-blades nPar with 46-bit     memory addressing. (bnc#848014)

  - Soft lock-up with PCI pass-through and many VCPUs.
    (bnc#846849)

  - Boot Failure with Xen kernel in UEFI mode with error 'No     memory for trampoline'. (bnc#833483)

  - Increase the maximum supported CPUs in the Hypervisor to     512.

Host crash due to HVM guest VMX instruction execution

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
76544	GLSA-201407-03 : Xen: Multiple Vunlerabilities	Nessus	Gentoo Local Security Checks	high
75312	openSUSE Security Update : xen (openSUSE-SU-2014:0483-1)	Nessus	SuSE Local Security Checks	high
75232	openSUSE Security Update : xen (openSUSE-SU-2013:1876-1)	Nessus	SuSE Local Security Checks	medium
71562	SuSE 11.3 Security Update : Xen (SAT Patch Number 8588)	Nessus	SuSE Local Security Checks	high
70992	Fedora 18 : xen-4.2.3-8.fc18 (2013-21057)	Nessus	Fedora Local Security Checks	medium
70991	Fedora 19 : xen-4.2.3-8.fc19 (2013-21041)	Nessus	Fedora Local Security Checks	medium
70911	Fedora 20 : xen-4.3.1-2.fc20 (2013-21000)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4551

medium

Tenable Plugins

high

high

medium

high

medium

medium

medium