libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image.

The remote host is affected by the vulnerability described in GLSA-201604-03 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly cause a Denial of Service condition or       obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

This update for xen fixes the following security issues :

  - CVE-2015-8550: paravirtualized drivers incautious about     shared memory contents (XSA-155, boo#957988)

  - CVE-2015-8558: qemu: usb: infinite loop in     ehci_advance_state results in DoS (boo#959006)

  - CVE-2015-7549: qemu pci: NULL pointer dereference issue     (boo#958918)

  - CVE-2015-8504: qemu: ui: vnc: avoid floating point     exception (boo#958493)

  - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling     (XSA-164, boo#958007) 

  - CVE-2015-8555: information leak in legacy x86 FPU/XMM     initialization (XSA-165, boo#958009)

  - boo#958523 xen: ioreq handling possibly susceptible to     multiple read issue (XSA-166)

  - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop     in processing command block list (boo#956832)

  - boo#956592: xen: virtual PMU is unsupported (XSA-163)

  - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error     handling issues (XSA-159, boo#956408)

  - CVE-2015-8341: xen: libxl leak of pv kernel and initrd     on error (XSA-160, boo#956409)

  - CVE-2015-7504: xen: heap buffer overflow vulnerability     in pcnet emulator (XSA-162, boo#956411)

  - CVE-2015-7311: xen: libxl fails to honour readonly flag     on disks with qemu-xen (xsa-142, boo#947165)

  - CVE-2015-8104: Xen: guest to host DoS by triggering an     infinite loop in microcode via #DB exception     (boo#954405)

  - CVE-2015-5307: xen: x86: CPU lockup during fault     delivery (XSA-156, boo#954018)

  - CVE-2015-7970: xen: x86: Long latency populate-on-demand     operation is not preemptible (XSA-150, boo#950704)

This update fixes the following security issues :

  - bsc#955399 - Fix xm migrate --log_progress. Due to logic     error progress was not logged when requested.

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#955399 - Fix xm migrate --live. The options were not     passed due to a merge error. As a result the migration     was not live, instead the suspended guest was migrated.

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)

  - bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand     balloon size inaccuracy can crash guests (XSA-153)

  - Drop     5604f239-x86-PV-properly-populate-descriptor-tables.patc     h

  - bsc#950703 - CVE-2015-7969: xen: leak of main per-domain     vcpu pointer array (DoS) (XSA-149)

  - bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain     profiling-related vcpu pointer array (DoS) (XSA-151)

  - bsc#950706 - CVE-2015-7971: xen: x86: some pmu and     profiling hypercalls log without rate limiting (XSA-152)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156) CVE-2015-5307-xsa156.patch

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)     563212c9-x86-PoD-Eager-sweep-for-zeroed-pages.patch

  - bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand     balloon size inaccuracy can crash guests (XSA-153)     xsa153-libxl.patch xend-xsa153.patch

  - Drop     5604f239-x86-PV-properly-populate-descriptor-tables.patc     h

  - bsc#950703 - CVE-2015-7969: xen: leak of main per-domain     vcpu pointer array (DoS) (XSA-149)

  - bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain     profiling-related vcpu pointer array (DoS) (XSA-151)

  - bsc#950706 - CVE-2015-7971: xen: x86: some pmu and     profiling hypercalls log without rate limiting (XSA-152)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)

  - bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand     balloon size inaccuracy can crash guests (XSA-153)

  - bsc#950703 - CVE-2015-7969: xen: leak of main per-domain     vcpu pointer array (DoS) (XSA-149)

  - bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain     profiling-related vcpu pointer array (DoS) (XSA-151)

  - bsc#950706 - CVE-2015-7971: xen: x86: some pmu and     profiling hypercalls log without rate limiting (XSA-152)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - Revert x86/IO-APIC: don't create pIRQ mapping from     masked RTE until kernel maintenance release goes out.

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)

This update fixes the following security issues :

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

  - bsc#950704 - CVE-2015-7970 xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)     563212c9-x86-PoD-Eager-sweep-for-zeroed-pages.patch

Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure.

xen was updated to fix 12 security issues.

These security issues were fixed :

  - CVE-2015-7972: Populate-on-demand balloon size     inaccuracy can crash guests (bsc#951845).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array (DoS) (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling-related vcpu     pointer array (DoS) (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

  - CVE-2015-4037: Insecure temporary file use in     /net/slirp.c (bsc#932267).

  - CVE-2014-0222: Validate L2 table size to avoid integer     overflows (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7311: libxl fails to honour readonly flag on     disks with qemu-xen (bsc#947165).

  - CVE-2015-5165: QEMU leak of uninitialized heap memory in     rtl8139 device model (bsc#939712).

  - CVE-2015-5166: Use after free in QEMU/Xen block unplug     protocol (bsc#939709).

  - CVE-2015-5154: Host code execution via IDE subsystem     CD-ROM (bsc#938344).

  - CVE-2015-3259: xl command line config handling stack     overflow (bsc#935634).

These non-security issues were fixed :

  - bsc#907514: Bus fatal error and sles12 sudden reboot has     been observed

  - bsc#910258: SLES12 Xen host crashes with FATAL NMI after     shutdown of guest with VT-d NIC

  - bsc#918984: Bus fatal error and sles11-SP4 sudden reboot     has been observed

  - bsc#923967: Partner-L3: Bus fatal error and sles11-SP3     sudden reboot has been observed

  - bsc#901488: Intel ixgbe driver assigns rx/tx queues per     core resulting in irq problems on servers with a large     amount of CPU cores

  - bsc#945167: Running command xl pci-assignable-add     03:10.1 secondly show errors

  - bsc#949138: Setting vcpu affinity under Xen causes     libvirtd abort

  - bsc#944463: VUL-0: CVE-2015-5239: qemu-kvm: Integer     overflow in vnc_client_read() and protocol_client_msg()

  - bsc#944697: VUL-1: CVE-2015-6815: qemu: net: e1000:
    infinite loop issue

  - bsc#925466: Kdump does not work in a XEN environment

xen was updated to fix 13 security issues.

These security issues were fixed :

  - CVE-2015-7972: Populate-on-demand balloon size     inaccuracy can crash guests (bsc#951845).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array (DoS) (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling-related vcpu     pointer array (DoS) (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

  - CVE-2015-4037: Insecure temporary file use in     /net/slirp.c (bsc#932267).

  - CVE-2014-0222: Validate L2 table size to avoid integer     overflows (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7311: libxl fails to honour readonly flag on     disks with qemu-xen (bsc#947165).

  - CVE-2015-5165: QEMU leak of uninitialized heap memory in     rtl8139 device model (bsc#939712).

  - CVE-2015-5166: Use after free in QEMU/Xen block unplug     protocol (bsc#939709).

  - CVE-2015-5239: Integer overflow in vnc_client_read() and     protocol_client_msg() (bsc#944463).

  - CVE-2015-6815: e1000: infinite loop issue (bsc#944697).

  - CVE-2015-5154: Host code execution via IDE subsystem     CD-ROM (bsc#938344).

This non-security issues was fixed :

  - bsc#941074: VmError: Device 51728 (vbd) could not be     connected. Hotplug scripts not working.

The Xen Project reports :

Callers of libxl can specify that a disk should be read-only to the guest. However, there is no code in libxl to pass this information to qemu-xen (the upstream-based qemu); and indeed there is no way in qemu to make a disk read-only.

The vulnerability is exploitable only via devices emulated by the device model, not the parallel PV devices for supporting PVHVM.
Normally the PVHVM device unplug protocol renders the emulated devices inaccessible early in boot.

Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images.

CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected.

xen was updated to version 4.4.3 to fix nine security issues.

These security issues were fixed :

  - CVE-2015-4037: The slirp_smb function in net/slirp.c     created temporary files with predictable names, which     allowed local users to cause a denial of service     (instantiation failure) by creating /tmp/qemu-smb.*-*     files before the program (bsc#932267).

  - CVE-2014-0222: Integer overflow in the qcow_open     function allowed remote attackers to cause a denial of     service (crash) via a large L2 table in a QCOW version 1     image (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7311: libxl in Xen did not properly handle the     readonly flag on disks when using the qemu-xen device     model, which allowed local guest users to write to a     read-only disk image (bsc#947165).

  - CVE-2015-5239: Integer overflow in vnc_client_read() and     protocol_client_msg() (bsc#944463).

  - CVE-2015-6815: With e1000 NIC emulation support it was     possible to enter an infinite loop (bsc#944697).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array leading to denial of service (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling- related     vcpu pointer array leading to denial of service     (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xen was updated to fix nine security issues.

These security issues were fixed :

  - CVE-2015-4037: The slirp_smb function in net/slirp.c     created temporary files with predictable names, which     allowed local users to cause a denial of service     (instantiation failure) by creating /tmp/qemu-smb.*-*     files before the program (bsc#932267).

  - CVE-2014-0222: Integer overflow in the qcow_open     function allowed remote attackers to cause a denial of     service (crash) via a large L2 table in a QCOW version 1     image (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7311: libxl in Xen did not properly handle the     readonly flag on disks when using the qemu-xen device     model, which allowed local guest users to write to a     read-only disk image (bsc#947165).

  - CVE-2015-5239: Integer overflow in vnc_client_read() and     protocol_client_msg() (bsc#944463).

  - CVE-2015-6815: With e1000 NIC emulation support it was     possible to enter an infinite loop (bsc#944697).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array leading to denial of service (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling- related     vcpu pointer array leading to denial of service     (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libxl fails to honour readonly flag on disks with qemu-xen [XSA-142 (possible fix)] ---- update to xen-4.4.3, including Use after free in QEMU/Xen block unplug protocol [XSA-139, CVE-2015-5166], QEMU leak of uninitialized heap memory in rtl8139 device model [XSA-140, CVE-2015-5165]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libxl fails to honour readonly flag on disks with qemu-xen [XSA-142 (possible fix)] ---- Use after free in QEMU/Xen block unplug protocol [XSA-139, CVE-2015-5166] QEMU leak of uninitialized heap memory in rtl8139 device model [XSA-140, CVE-2015-5165]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libxl fails to honour readonly flag on disks with qemu-xen [XSA-142 (possible fix)]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
90380	GLSA-201604-03 : Xen: Multiple vulnerabilities (Venom)	Nessus	Gentoo Local Security Checks	critical
88124	openSUSE Security Update : xen (openSUSE-2016-34)	Nessus	SuSE Local Security Checks	high
87650	SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:2338-1)	Nessus	SuSE Local Security Checks	high
87591	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:2328-1)	Nessus	SuSE Local Security Checks	high
87590	SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:2326-1)	Nessus	SuSE Local Security Checks	high
87588	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:2324-1)	Nessus	SuSE Local Security Checks	high
87443	openSUSE Security Update : xen (openSUSE-2015-893)	Nessus	SuSE Local Security Checks	high
87393	openSUSE Security Update : xen (openSUSE-2015-892)	Nessus	SuSE Local Security Checks	medium
87288	Debian DSA-3414-1 : xen - security update	Nessus	Debian Local Security Checks	medium
86909	openSUSE Security Update : xen (openSUSE-2015-750)	Nessus	SuSE Local Security Checks	medium
86863	openSUSE Security Update : xen (openSUSE-2015-729)	Nessus	SuSE Local Security Checks	medium
86835	FreeBSD : xen-tools -- libxl fails to honour readonly flag on disks with qemu-xen (301b04d7-881c-11e5-ab94-002590263bf5)	Nessus	FreeBSD Local Security Checks	low
86756	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:1908-1)	Nessus	SuSE Local Security Checks	medium
86753	SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:1894-1)	Nessus	SuSE Local Security Checks	medium
86704	SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:1853-1)	Nessus	SuSE Local Security Checks	medium
86163	Fedora 21 : xen-4.4.3-3.fc21 (2015-15946)	Nessus	Fedora Local Security Checks	high
86162	Fedora 22 : xen-4.5.1-8.fc22 (2015-15944)	Nessus	Fedora Local Security Checks	high
86055	Fedora 23 : xen-4.5.1-8.fc23 (2015-15943)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2015-7311

medium

Tenable Plugins

critical

high

high

high

high

high

high

medium

medium

medium

medium

low

medium

medium

medium

high

high

low