The HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a denial of service (hypervisor crash) or possibly execute arbitrary code by leveraging a separate qemu-dm vulnerability to trigger invalid page table translations for unspecified memory page types.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The hvm_msr_read_intercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR
    range for x2APIC emulation, which allows local HVM guests to cause a denial of service (host crash) or
    read data from the hypervisor or other guests via unspecified vectors. (CVE-2014-7188)

  - The HVMOP_set_mem_access HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit
    allow local guest administrators to cause a denial of service (CPU consumption) by leveraging access to
    certain service domains for HVM guests and a large input. (CVE-2014-2599)

  - The HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a
    denial of service (hypervisor crash) or possibly execute arbitrary code by leveraging a separate qemu-dm
    vulnerability to trigger invalid page table translations for unspecified memory page types.
    (CVE-2014-3124)

  - The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x does not properly check the return value from
    the IRQ setup check, which allows local HVM guest administrators to cause a denial of service (NULL
    pointer dereference and crash) via unspecified vectors. (CVE-2014-3967)

  - The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x allows local guest HVM administrators to
    cause a denial of service (host crash) via a large number of crafted requests, which trigger an error
    messages to be logged. (CVE-2014-3968)

xen was updated to fix 14 security issues :

  - Guest effectable page reference leak in     MMU_MACHPHYS_UPDATE handling (CVE-2014-9030).

  - Insufficient bounding of 'REP MOVS' to MMIO emulated     inside the hypervisor (CVE-2014-8867).

  - Missing privilege level checks in x86 HLT, LGDT, LIDT,     and LMSW emulation (CVE-2014-7155).

  - Hypervisor heap contents leaked to guests     (CVE-2014-4021).

  - Missing privilege level checks in x86 emulation of far     branches (CVE-2014-8595).

  - Insufficient restrictions on certain MMU update     hypercalls (CVE-2014-8594).

  - Intel VT-d Interrupt Remapping engines can be evaded by     native NMI interrupts (CVE-2013-3495).

  - Missing privilege level checks in x86 emulation of     software interrupts (CVE-2014-7156).

  - Race condition in HVMOP_track_dirty_vram     (CVE-2014-7154).

  - Improper MSR range used for x2APIC emulation     (CVE-2014-7188).

  - HVMOP_set_mem_type allows invalid P2M entries to be     created (CVE-2014-3124).

  - HVMOP_set_mem_access is not preemptible (CVE-2014-2599).

  - Excessive checking in compatibility mode hypercall     argument translation (CVE-2014-8866).

  - Guest user mode triggerable VM exits not handled by     hypervisor (bnc#903850).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

XEN was updated to fix security issues and bugs.

Security issues fixed :

  - bnc#897657 - CVE-2014-7188: XSA-108 Improper MSR range     used for x2APIC emulation

  - bnc#895802 - CVE-2014-7156: XSA-106: Missing privilege     level checks in x86 emulation of software interrupts

  - bnc#895799 - CVE-2014-7155: XSA-105: Missing privilege     level checks in x86 HLT, LGDT, LIDT, and LMSW emulation

  - bnc#895798 - CVE-2014-7154: XSA-104: Race condition in     HVMOP_track_dirty_vram

  - bnc#864801 - CVE-2013-4540: qemu: zaurus: buffer overrun     on invalid state load

  - bnc#875668 - CVE-2014-3124: XSA-92: HVMOP_set_mem_type     allows invalid P2M entries to be created

  - bnc#878841 - CVE-2014-3967, CVE-2014-3968: XSA-96: Xen:
    Vulnerabilities in HVM MSI injection

  - bnc#880751 - CVE-2014-4021: XSA-100: Hypervisor heap     contents leaked to guests

  - bnc#842006 - CVE-2013-4344: XSA-65: xen: qemu SCSI     REPORT LUNS buffer overflow 

Other bugs fixed :

  - bnc#896023 - Adjust xentop column layout

  - bnc#820873 - The 'long' option doesn't work with 'xl     list'

  - bnc#882127 - Xen kernel panics on booting SLES12 Beta 8

  - bnc#865682 - Local attach support for PHY backends using     scripts

  - bnc#798770 - Improve multipath support for npiv devices

Multiple security issues have been discovered in the Xen virtualisation solution which may result in information leaks or denial of service.

The remote host is affected by the vulnerability described in GLSA-201407-03 (Xen: Multiple Vunlerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can utilize multiple vectors to execute arbitrary       code, cause Denial of Service, or gain access to data on the host.
  Workaround :

    There is no known workaround at this time.

HVMOP_set_mem_type allows invalid P2M entries to be created

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
401191	Alpine: multiple xen packages: security update to 4.3.2-r4 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
401191	Alpine: multiple xen packages: security update to 4.3.2-r4 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
83654	SUSE SLES11 Security Update : xen (SUSE-SU-2014:1710-1)	Nessus	SuSE Local Security Checks	high
78117	openSUSE Security Update : xen (openSUSE-SU-2014:1281-1)	Nessus	SuSE Local Security Checks	high
77240	Debian DSA-3006-1 : xen - security update	Nessus	Debian Local Security Checks	high
76544	GLSA-201407-03 : Xen: Multiple Vunlerabilities	Nessus	Gentoo Local Security Checks	high
73955	Fedora 19 : xen-4.2.4-4.fc19 (2014-5941)	Nessus	Fedora Local Security Checks	medium
73952	Fedora 20 : xen-4.3.2-3.fc20 (2014-5915)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-3124

critical

Tenable Plugins

critical

critical

high

high

high

high

medium

medium