Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests, which allows local guest OS users to obtain sensitive information via unspecified vectors.

xen was updated to fix 10 security issues :

  - Guest effectable page reference leak in     MMU_MACHPHYS_UPDATE handling (CVE-2014-9030).

  - Insufficient bounding of 'REP MOVS' to MMIO emulated     inside the hypervisor (CVE-2014-8867).

  - Missing privilege level checks in x86 emulation of far     branches (CVE-2014-8595).

  - Missing privilege level checks in x86 HLT, LGDT, LIDT,     and LMSW emulation (CVE-2014-7155).

  - Hypervisor heap contents leaked to guests     (CVE-2014-4021).

  - Missing privilege level checks in x86 emulation of far     branches (CVE-2014-8595).

  - Insufficient restrictions on certain MMU update     hypercalls (CVE-2014-8594).

  - Intel VT-d Interrupt Remapping engines can be evaded by     native NMI interrupts (CVE-2013-3495).

  - Missing privilege level checks in x86 emulation of     software interrupts (CVE-2014-7156).

  - Race condition in HVMOP_track_dirty_vram     (CVE-2014-7154).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xen was updated to fix 14 security issues :

  - Guest effectable page reference leak in     MMU_MACHPHYS_UPDATE handling (CVE-2014-9030).

  - Insufficient bounding of 'REP MOVS' to MMIO emulated     inside the hypervisor (CVE-2014-8867).

  - Missing privilege level checks in x86 HLT, LGDT, LIDT,     and LMSW emulation (CVE-2014-7155).

  - Hypervisor heap contents leaked to guests     (CVE-2014-4021).

  - Missing privilege level checks in x86 emulation of far     branches (CVE-2014-8595).

  - Insufficient restrictions on certain MMU update     hypercalls (CVE-2014-8594).

  - Intel VT-d Interrupt Remapping engines can be evaded by     native NMI interrupts (CVE-2013-3495).

  - Missing privilege level checks in x86 emulation of     software interrupts (CVE-2014-7156).

  - Race condition in HVMOP_track_dirty_vram     (CVE-2014-7154).

  - Improper MSR range used for x2APIC emulation     (CVE-2014-7188).

  - HVMOP_set_mem_type allows invalid P2M entries to be     created (CVE-2014-3124).

  - HVMOP_set_mem_access is not preemptible (CVE-2014-2599).

  - Excessive checking in compatibility mode hypercall     argument translation (CVE-2014-8866).

  - Guest user mode triggerable VM exits not handled by     hypervisor (bnc#903850).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Xen has been updated to fix six security issues :

  - Guest effectable page reference leak in     MMU_MACHPHYS_UPDATE handling (CVE-2014-9030).

  - Insufficient bounding of 'REP MOVS' to MMIO emulated     inside the hypervisor (CVE-2014-8867).

  - Missing privilege level checks in x86 emulation of far     branches (CVE-2014-8595).

  - Guest user mode triggerable VM exits not handled by     hypervisor (bnc#903850).

  - Missing privilege level checks in x86 HLT, LGDT, LIDT,     and LMSW emulation (CVE-2014-7155).

  - Hypervisor heap contents leaked to guests     (CVE-2014-4021).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0004 for details.

The SUSE Linux Enterprise 11 Service Pack 3 Xen package was updated to fix various bugs and security issues.

The following security issues have been fixed :

  - XSA-108: CVE-2014-7188: Improper MSR range used for     x2APIC emulation. (bnc#897657)

  - XSA-106: CVE-2014-7156: Missing privilege level checks     in x86 emulation of software interrupts. (bnc#895802)

  - XSA-105: CVE-2014-7155: Missing privilege level checks     in x86 HLT, LGDT, LIDT, and LMSW emulation. (bnc#895799)

  - XSA-104: CVE-2014-7154: Race condition in     HVMOP_track_dirty_vram. (bnc#895798)

  - XSA-100: CVE-2014-4021: Hypervisor heap contents leaked     to guests. (bnc#880751)

  - XSA-96: CVE-2014-3967 / CVE-2014-3968: Vulnerabilities     in HVM MSI injection. (bnc#878841)

  - XSA-89: CVE-2014-2599: HVMOP_set_mem_access is not     preemptible. (bnc#867910)

  - XSA-65: CVE-2013-4344: qemu SCSI REPORT LUNS buffer     overflow. (bnc#842006)

  - qemu: zaurus: buffer overrun on invalid state load     (bnc#864801) The following non-security issues have been     fixed:. (CVE-2013-4540)

  - xend: Fix netif convertToDeviceNumber for running     domains. (bnc#891539)

  - Installing SLES12 as a VM on SLES11 SP3 fails because of     btrfs in the VM. (bnc#882092)

  - XEN kernel panic do_device_not_available(). (bnc#881900)

  - Boot Failure with xen kernel in UEFI mode with error 'No     memory for trampoline'. (bnc#833483)

  - SLES 11 SP3 vm-install should get RHEL 7 support when     released. (bnc#862608)

  - SLES 11 SP3 XEN kiso version cause softlockup on 8     blades npar(480 cpu). (bnc#858178)

  - Local attach support for PHY backends using scripts     local_attach_support_for_phy.patch. (bnc#865682)

  - Improve multipath support for npiv devices block-npiv     (bnc#798770)

XEN was updated to fix security issues and bugs.

Security issues fixed :

  - bnc#897657 - CVE-2014-7188: XSA-108 Improper MSR range     used for x2APIC emulation

  - bnc#895802 - CVE-2014-7156: XSA-106: Missing privilege     level checks in x86 emulation of software interrupts

  - bnc#895799 - CVE-2014-7155: XSA-105: Missing privilege     level checks in x86 HLT, LGDT, LIDT, and LMSW emulation

  - bnc#895798 - CVE-2014-7154: XSA-104: Race condition in     HVMOP_track_dirty_vram

  - bnc#864801 - CVE-2013-4540: qemu: zaurus: buffer overrun     on invalid state load

  - bnc#875668 - CVE-2014-3124: XSA-92: HVMOP_set_mem_type     allows invalid P2M entries to be created

  - bnc#878841 - CVE-2014-3967, CVE-2014-3968: XSA-96: Xen:
    Vulnerabilities in HVM MSI injection

  - bnc#880751 - CVE-2014-4021: XSA-100: Hypervisor heap     contents leaked to guests

  - bnc#842006 - CVE-2013-4344: XSA-65: xen: qemu SCSI     REPORT LUNS buffer overflow 

Other bugs fixed :

  - bnc#896023 - Adjust xentop column layout

  - bnc#820873 - The 'long' option doesn't work with 'xl     list'

  - bnc#882127 - Xen kernel panics on booting SLES12 Beta 8

  - bnc#865682 - Local attach support for PHY backends using     scripts

  - bnc#798770 - Improve multipath support for npiv devices

XEN was updated to fix various bugs and security issues.

Security issues fixed :

  - bnc#897657 - CVE-2014-7188: XSA-108 Improper MSR range     used for x2APIC emulation

  - bnc#895802 - CVE-2014-7156: XSA-106: Missing privilege     level checks in x86 emulation of software interrupts

  - bnc#895799 - CVE-2014-7155: XSA-105: Missing privilege     level checks in x86 HLT, LGDT, LIDT, and LMSW emulation

  - bnc#895798 - CVE-2014-7154: XSA-104: Race condition in     HVMOP_track_dirty_vram

  - bnc#864801 - CVE-2013-4540: qemu: zaurus: buffer overrun     on invalid state load 

  - bnc#880751 - CVE-2014-4021: XSA-100: Hypervisor heap     contents leaked to guests

  - bnc#878841 - CVE-2014-3967,CVE-2014-3968: XSA-96:
    Vulnerabilities in HVM MSI injection

  - bnc#867910 - CVE-2014-2599: XSA-89: HVMOP_set_mem_access     is not preemptible

  - bnc#842006 - CVE-2013-4344: XSA-65: xen: qemu SCSI     REPORT LUNS buffer overflow

Other bugs fixed :

  - bnc#896023 - Adjust xentop column layout

  - bnc#891539 - xend: fix netif convertToDeviceNumber for     running domains

  - bnc#820873 - The 'long' option doesn't work with 'xl     list'

  - bnc#881900 - XEN kernel panic do_device_not_available()

  - bnc#833483 - Boot Failure with xen kernel in UEFI mode     with error 'No memory for trampoline'

  - bnc#862608 - SLES 11 SP3 vm-install should get RHEL 7     support when released

  - bnc#858178 - [HP HPS Bug]: SLES11sp3 XEN kiso version     cause softlockup on 8 blades npar(480 cpu)

  - bnc#865682 - Local attach support for PHY backends using     scripts

  - bnc#798770 - Improve multipath support for npiv devices

Multiple security issues have been discovered in the Xen virtualisation solution which may result in information leaks or denial of service.

From Red Hat Security Advisory 2014:0926 :

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A NULL pointer dereference flaw was found in the rds_iw_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system. (CVE-2014-2678, Moderate)

* It was found that the Xen hypervisor implementation did not properly clean memory pages previously allocated by the hypervisor. A privileged guest user could potentially use this flaw to read data relating to other guests or the hypervisor itself. (CVE-2014-4021, Moderate)

Red Hat would like to thank the Xen project for reporting CVE-2014-4021. Upstream acknowledges Jan Beulich as the original reporter.

This update also fixes the following bugs :

* A bug in the journaling block device (jbd and jbd2) code could, under certain circumstances, trigger a BUG_ON() assertion and result in a kernel oops. This happened when an application performed an extensive number of commits to the journal of the ext3 file system and there was no currently active transaction while synchronizing the file's in-core state. This problem has been resolved by correcting respective test conditions in the jbd and jbd2 code. (BZ#1097528)

* After a statically defined gateway became unreachable and its corresponding neighbor entry entered a FAILED state, the gateway stayed in the FAILED state even after it became reachable again. As a consequence, traffic was not routed through that gateway. This update allows probing such a gateway automatically so that the traffic can be routed through this gateway again once it becomes reachable.
(BZ#1106354)

* Due to an incorrect condition check in the IPv6 code, the ipv6 driver was unable to correctly assemble incoming packet fragments, which resulted in a high IPv6 packet loss rate. This update fixes the said check for a fragment overlap and ensures that incoming IPv6 packet fragments are now processed as expected. (BZ#1107932)

* Recent changes in the d_splice_alias() function introduced a bug that allowed d_splice_alias() to return a dentry from a different directory than the directory being looked up. As a consequence in cluster environment, a kernel panic could be triggered when a directory was being removed while a concurrent cross-directory operation was performed on this directory on another cluster node.
This update avoids the kernel panic in this situation by correcting the search logic in the d_splice_alias() function so that the function can no longer return a dentry from an incorrect directory.
(BZ#1109720)

* The NFSv4 server did not handle multiple OPEN operations to the same file separately, which could cause the NFSv4 client to repeatedly send CLOSE requests with the same state ID, even though the NFS server rejected the request with an NFS4ERR_OLD_STATEID (10024) error code.
This update ensures that the NFSv4 client no longer re-sends the same CLOSE request after receiving NFS4ERR_OLD_STATEID. (BZ#1113468)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

- A NULL pointer dereference flaw was found in the     rds_iw_laddr_check() function in the Linux kernel's     implementation of Reliable Datagram Sockets (RDS). A     local, unprivileged user could use this flaw to crash     the system. (CVE-2014-2678, Moderate)

  - It was found that the Xen hypervisor implementation did     not properly clean memory pages previously allocated by     the hypervisor. A privileged guest user could     potentially use this flaw to read data relating to other     guests or the hypervisor itself. (CVE-2014-4021,     Moderate)

This update also fixes the following bugs :

  - A bug in the journaling block device (jbd and jbd2) code     could, under certain circumstances, trigger a BUG_ON()     assertion and result in a kernel oops. This happened     when an application performed an extensive number of     commits to the journal of the ext3 file system and there     was no currently active transaction while synchronizing     the file's in-core state. This problem has been resolved     by correcting respective test conditions in the jbd and     jbd2 code.

  - After a statically defined gateway became unreachable     and its corresponding neighbor entry entered a FAILED     state, the gateway stayed in the FAILED state even after     it became reachable again. As a consequence, traffic was     not routed through that gateway. This update allows     probing such a gateway automatically so that the traffic     can be routed through this gateway again once it becomes     reachable.

  - Due to an incorrect condition check in the IPv6 code,     the ipv6 driver was unable to correctly assemble     incoming packet fragments, which resulted in a high IPv6     packet loss rate. This update fixes the said check for a     fragment overlap and ensures that incoming IPv6 packet     fragments are now processed as expected.

  - Recent changes in the d_splice_alias() function     introduced a bug that allowed d_splice_alias() to return     a dentry from a different directory than the directory     being looked up. As a consequence in cluster     environment, a kernel panic could be triggered when a     directory was being removed while a concurrent     cross-directory operation was performed on this     directory on another cluster node. This update avoids     the kernel panic in this situation by correcting the     search logic in the d_splice_alias() function so that     the function can no longer return a dentry from an     incorrect directory.

  - The NFSv4 server did not handle multiple OPEN operations     to the same file separately, which could cause the NFSv4     client to repeatedly send CLOSE requests with the same     state ID, even though the NFS server rejected the     request with an NFS4ERR_OLD_STATEID (10024) error code.
    This update ensures that the NFSv4 client no longer     re-sends the same CLOSE request after receiving     NFS4ERR_OLD_STATEID.

The system must be rebooted for this update to take effect.

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A NULL pointer dereference flaw was found in the rds_iw_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system. (CVE-2014-2678, Moderate)

* It was found that the Xen hypervisor implementation did not properly clean memory pages previously allocated by the hypervisor. A privileged guest user could potentially use this flaw to read data relating to other guests or the hypervisor itself. (CVE-2014-4021, Moderate)

Red Hat would like to thank the Xen project for reporting CVE-2014-4021. Upstream acknowledges Jan Beulich as the original reporter.

This update also fixes the following bugs :

* A bug in the journaling block device (jbd and jbd2) code could, under certain circumstances, trigger a BUG_ON() assertion and result in a kernel oops. This happened when an application performed an extensive number of commits to the journal of the ext3 file system and there was no currently active transaction while synchronizing the file's in-core state. This problem has been resolved by correcting respective test conditions in the jbd and jbd2 code. (BZ#1097528)

* After a statically defined gateway became unreachable and its corresponding neighbor entry entered a FAILED state, the gateway stayed in the FAILED state even after it became reachable again. As a consequence, traffic was not routed through that gateway. This update allows probing such a gateway automatically so that the traffic can be routed through this gateway again once it becomes reachable.
(BZ#1106354)

* Due to an incorrect condition check in the IPv6 code, the ipv6 driver was unable to correctly assemble incoming packet fragments, which resulted in a high IPv6 packet loss rate. This update fixes the said check for a fragment overlap and ensures that incoming IPv6 packet fragments are now processed as expected. (BZ#1107932)

* Recent changes in the d_splice_alias() function introduced a bug that allowed d_splice_alias() to return a dentry from a different directory than the directory being looked up. As a consequence in cluster environment, a kernel panic could be triggered when a directory was being removed while a concurrent cross-directory operation was performed on this directory on another cluster node.
This update avoids the kernel panic in this situation by correcting the search logic in the d_splice_alias() function so that the function can no longer return a dentry from an incorrect directory.
(BZ#1109720)

* The NFSv4 server did not handle multiple OPEN operations to the same file separately, which could cause the NFSv4 client to repeatedly send CLOSE requests with the same state ID, even though the NFS server rejected the request with an NFS4ERR_OLD_STATEID (10024) error code.
This update ensures that the NFSv4 client no longer re-sends the same CLOSE request after receiving NFS4ERR_OLD_STATEID. (BZ#1113468)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote host is running a version of Citrix XenServer that is affected by multiple vulnerabilities :

  - An information disclosure exists due to the Xen     hypervisor's failure to properly clean memory pages.
    (CVE-2014-4021)

  - An unspecified vulnerability exists due to a buffer     overflow in the HVM graphics console. (CVE-2014-4947)

  - XenServer is affected by an unspecified denial of     service and information disclosure vulnerability.
    (CVE-2014-4948)

The remote host is affected by the vulnerability described in GLSA-201407-03 (Xen: Multiple Vunlerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can utilize multiple vectors to execute arbitrary       code, cause Denial of Service, or gain access to data on the host.
  Workaround :

    There is no known workaround at this time.

Hypervisor heap contents leaked to guest, with extra patch to avoid regression

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
83659	SUSE SLES11 Security Update : xen (SUSE-SU-2014:1732-1)	Nessus	SuSE Local Security Checks	high
83654	SUSE SLES11 Security Update : xen (SUSE-SU-2014:1710-1)	Nessus	SuSE Local Security Checks	high
83651	SUSE SLES10 Security Update : Xen (SUSE-SU-2014:1691-1)	Nessus	SuSE Local Security Checks	high
80928	OracleVM 3.3 : xen (OVMSA-2015-0004)	Nessus	OracleVM Local Security Checks	medium
78652	SuSE 11.3 Security Update : Xen (SAT Patch Number 9828)	Nessus	SuSE Local Security Checks	high
78117	openSUSE Security Update : xen (openSUSE-SU-2014:1281-1)	Nessus	SuSE Local Security Checks	high
78116	openSUSE Security Update : xen (openSUSE-SU-2014:1279-1)	Nessus	SuSE Local Security Checks	high
77240	Debian DSA-3006-1 : xen - security update	Nessus	Debian Local Security Checks	high
76856	Oracle Linux 5 : kernel (ELSA-2014-0926)	Nessus	Oracle Linux Local Security Checks	medium
76782	Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20140723)	Nessus	Scientific Linux Local Security Checks	medium
76779	CentOS 5 : kernel (CESA-2014:0926)	Nessus	CentOS Local Security Checks	medium
76771	Citrix XenServer Multiple Vulnerabilities (CTX140984)	Nessus	Misc.	critical
76751	RHEL 5 : kernel (RHSA-2014:0926)	Nessus	Red Hat Local Security Checks	medium
76544	GLSA-201407-03 : Xen: Multiple Vunlerabilities	Nessus	Gentoo Local Security Checks	high
76371	Fedora 19 : xen-4.2.4-6.fc19 (2014-7734)	Nessus	Fedora Local Security Checks	low
76370	Fedora 20 : xen-4.3.2-6.fc20 (2014-7722)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2014-4021

critical

Tenable Plugins

high

high

high

medium

high

high

high

high

medium

medium

medium

critical

medium

high

low

low