The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x allows local guest HVM administrators to cause a denial of service (host crash) via a large number of crafted requests, which trigger an error messages to be logged.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The hvm_msr_read_intercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR
    range for x2APIC emulation, which allows local HVM guests to cause a denial of service (host crash) or
    read data from the hypervisor or other guests via unspecified vectors. (CVE-2014-7188)

  - The HVMOP_set_mem_access HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit
    allow local guest administrators to cause a denial of service (CPU consumption) by leveraging access to
    certain service domains for HVM guests and a large input. (CVE-2014-2599)

  - The HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a
    denial of service (hypervisor crash) or possibly execute arbitrary code by leveraging a separate qemu-dm
    vulnerability to trigger invalid page table translations for unspecified memory page types.
    (CVE-2014-3124)

  - The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x does not properly check the return value from
    the IRQ setup check, which allows local HVM guest administrators to cause a denial of service (NULL
    pointer dereference and crash) via unspecified vectors. (CVE-2014-3967)

  - The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x allows local guest HVM administrators to
    cause a denial of service (host crash) via a large number of crafted requests, which trigger an error
    messages to be logged. (CVE-2014-3968)

The remote host is affected by the vulnerability described in GLSA-201504-04 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen.  Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly cause a Denial of Service condition or       obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The SUSE Linux Enterprise 11 Service Pack 3 Xen package was updated to fix various bugs and security issues.

The following security issues have been fixed :

  - XSA-108: CVE-2014-7188: Improper MSR range used for     x2APIC emulation. (bnc#897657)

  - XSA-106: CVE-2014-7156: Missing privilege level checks     in x86 emulation of software interrupts. (bnc#895802)

  - XSA-105: CVE-2014-7155: Missing privilege level checks     in x86 HLT, LGDT, LIDT, and LMSW emulation. (bnc#895799)

  - XSA-104: CVE-2014-7154: Race condition in     HVMOP_track_dirty_vram. (bnc#895798)

  - XSA-100: CVE-2014-4021: Hypervisor heap contents leaked     to guests. (bnc#880751)

  - XSA-96: CVE-2014-3967 / CVE-2014-3968: Vulnerabilities     in HVM MSI injection. (bnc#878841)

  - XSA-89: CVE-2014-2599: HVMOP_set_mem_access is not     preemptible. (bnc#867910)

  - XSA-65: CVE-2013-4344: qemu SCSI REPORT LUNS buffer     overflow. (bnc#842006)

  - qemu: zaurus: buffer overrun on invalid state load     (bnc#864801) The following non-security issues have been     fixed:. (CVE-2013-4540)

  - xend: Fix netif convertToDeviceNumber for running     domains. (bnc#891539)

  - Installing SLES12 as a VM on SLES11 SP3 fails because of     btrfs in the VM. (bnc#882092)

  - XEN kernel panic do_device_not_available(). (bnc#881900)

  - Boot Failure with xen kernel in UEFI mode with error 'No     memory for trampoline'. (bnc#833483)

  - SLES 11 SP3 vm-install should get RHEL 7 support when     released. (bnc#862608)

  - SLES 11 SP3 XEN kiso version cause softlockup on 8     blades npar(480 cpu). (bnc#858178)

  - Local attach support for PHY backends using scripts     local_attach_support_for_phy.patch. (bnc#865682)

  - Improve multipath support for npiv devices block-npiv     (bnc#798770)

XEN was updated to fix security issues and bugs.

Security issues fixed :

  - bnc#897657 - CVE-2014-7188: XSA-108 Improper MSR range     used for x2APIC emulation

  - bnc#895802 - CVE-2014-7156: XSA-106: Missing privilege     level checks in x86 emulation of software interrupts

  - bnc#895799 - CVE-2014-7155: XSA-105: Missing privilege     level checks in x86 HLT, LGDT, LIDT, and LMSW emulation

  - bnc#895798 - CVE-2014-7154: XSA-104: Race condition in     HVMOP_track_dirty_vram

  - bnc#864801 - CVE-2013-4540: qemu: zaurus: buffer overrun     on invalid state load

  - bnc#875668 - CVE-2014-3124: XSA-92: HVMOP_set_mem_type     allows invalid P2M entries to be created

  - bnc#878841 - CVE-2014-3967, CVE-2014-3968: XSA-96: Xen:
    Vulnerabilities in HVM MSI injection

  - bnc#880751 - CVE-2014-4021: XSA-100: Hypervisor heap     contents leaked to guests

  - bnc#842006 - CVE-2013-4344: XSA-65: xen: qemu SCSI     REPORT LUNS buffer overflow 

Other bugs fixed :

  - bnc#896023 - Adjust xentop column layout

  - bnc#820873 - The 'long' option doesn't work with 'xl     list'

  - bnc#882127 - Xen kernel panics on booting SLES12 Beta 8

  - bnc#865682 - Local attach support for PHY backends using     scripts

  - bnc#798770 - Improve multipath support for npiv devices

XEN was updated to fix various bugs and security issues.

Security issues fixed :

  - bnc#897657 - CVE-2014-7188: XSA-108 Improper MSR range     used for x2APIC emulation

  - bnc#895802 - CVE-2014-7156: XSA-106: Missing privilege     level checks in x86 emulation of software interrupts

  - bnc#895799 - CVE-2014-7155: XSA-105: Missing privilege     level checks in x86 HLT, LGDT, LIDT, and LMSW emulation

  - bnc#895798 - CVE-2014-7154: XSA-104: Race condition in     HVMOP_track_dirty_vram

  - bnc#864801 - CVE-2013-4540: qemu: zaurus: buffer overrun     on invalid state load 

  - bnc#880751 - CVE-2014-4021: XSA-100: Hypervisor heap     contents leaked to guests

  - bnc#878841 - CVE-2014-3967,CVE-2014-3968: XSA-96:
    Vulnerabilities in HVM MSI injection

  - bnc#867910 - CVE-2014-2599: XSA-89: HVMOP_set_mem_access     is not preemptible

  - bnc#842006 - CVE-2013-4344: XSA-65: xen: qemu SCSI     REPORT LUNS buffer overflow

Other bugs fixed :

  - bnc#896023 - Adjust xentop column layout

  - bnc#891539 - xend: fix netif convertToDeviceNumber for     running domains

  - bnc#820873 - The 'long' option doesn't work with 'xl     list'

  - bnc#881900 - XEN kernel panic do_device_not_available()

  - bnc#833483 - Boot Failure with xen kernel in UEFI mode     with error 'No memory for trampoline'

  - bnc#862608 - SLES 11 SP3 vm-install should get RHEL 7     support when released

  - bnc#858178 - [HP HPS Bug]: SLES11sp3 XEN kiso version     cause softlockup on 8 blades npar(480 cpu)

  - bnc#865682 - Local attach support for PHY backends using     scripts

  - bnc#798770 - Improve multipath support for npiv devices

Fix %if line typo in the spec file, Vulnerabilities in HVM MSI injection

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vulnerabilities in HVM MSI injection

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
401191	Alpine: multiple xen packages: security update to 4.3.2-r4 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
401191	Alpine: multiple xen packages: security update to 4.3.2-r4 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
82734	GLSA-201504-04 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
78652	SuSE 11.3 Security Update : Xen (SAT Patch Number 9828)	Nessus	SuSE Local Security Checks	Local	high
78117	openSUSE Security Update : xen (openSUSE-SU-2014:1281-1)	Nessus	SuSE Local Security Checks	Local	high
78116	openSUSE Security Update : xen (openSUSE-SU-2014:1279-1)	Nessus	SuSE Local Security Checks	Local	high
76221	Fedora 20 : xen-4.3.2-5.fc20 (2014-7423)	Nessus	Fedora Local Security Checks	Local	medium
76220	Fedora 19 : xen-4.2.4-5.fc19 (2014-7408)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2014-3968

critical

Tenable Plugins

critical

critical

high

high

high

high

medium

medium