The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.

The remote host is affected by the vulnerability described in GLSA-201604-03 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly cause a Denial of Service condition or       obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure.

The oldstable distribution (wheezy) will be updated in a separate DSA.

eepro100: Prevent two endless loops [CVE-2015-8345], pcnet: fix rx buffer overflow [CVE-2015-7512], ui: vnc: avoid floating point exception [CVE-2015-8504], additional patch for [XSA-158, CVE-2015-8338] long running memory operations on ARM [XSA-158, CVE-2015-8338] XENMEM_exchange error handling issues [XSA-159, CVE-2015-8339, CVE-2015-8340] libxl leak of pv kernel and initrd on error [XSA-160, CVE-2015-8341] ---- heap buffer overflow vulnerability in pcnet emulator [XSA-162, CVE-2015-7504], virtual PMU is unsupported [XSA-163]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

eepro100: Prevent two endless loops [CVE-2015-8345] (#1285215), pcnet:
fix rx buffer overflow [CVE-2015-7512], ui: vnc: avoid floating point exception [CVE-2015-8504], additional patch for [XSA-158, CVE-2015-8338] long running memory operations on ARM [XSA-158, CVE-2015-8338] XENMEM_exchange error handling issues [XSA-159, CVE-2015-8339, CVE-2015-8340] libxl leak of pv kernel and initrd on error [XSA-160, CVE-2015-8341] ---- heap buffer overflow vulnerability in pcnet emulator [XSA-162, CVE-2015-7504], virtual PMU is unsupported [XSA-163]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/VMX: prevent INVVPID failure due to non-canonical     guest address While INVLPG (and on SVM INVLPGA) don't     fault on non-canonical addresses, INVVPID fails (in the     'individual address' case) when passed such an address.
    Since such intercepted INVLPG are effectively no-ops     anyway, don't fix this in vmx_invlpg_intercept, but     instead have paging_invlpg never return true in such a     case. This is XSA-168. (CVE-2016-1571)

  - x86/mm: PV superpage handling lacks sanity checks     MMUEXT_[,UN]MARK_SUPER fail to check the input MFN for     validity before dereferencing pointers into the     superpage frame table. get_superpage has a similar     issue. This is XSA-167. (CVE-2016-1570)

  - x86/HVM: avoid reading ioreq state more than once     Otherwise, especially when the compiler chooses to     translate the switch to a jump table, unpredictable     behavior (and in the jump table case arbitrary code     execution) can result. This is XSA-166.

  - x86: don't leak ST(n)/XMMn values to domains first using     them FNINIT doesn't alter these registers, and hence     using it is insufficient to initialize a guest's initial     state. This is XSA-165. (CVE-2015-8555)

  - MSI-X: avoid array overrun upon MSI-X table writes     pt_msix_init allocates msix->msix_entry[] to just cover     msix->total_entries entries. While pci_msix_readl     resorts to reading physical memory for out of bounds     reads, pci_msix_writel so far simply accessed/corrupted     unrelated memory. pt_iomem_map's call to     cpu_register_physical_memory registers a page granular     region, which is necessary as the Pending Bit Array may     share space with the MSI-X table (but nothing else is     allowed to). This also explains why pci_msix_readl     actually honors out of bounds reads, but pci_msi_writel     doesn't need to. This is XSA-164. (CVE-2015-8554)

  - From 43a10fecd6f4a9d8adf9f5d85e3d5e7187e2d54a Mon Sep 17     00:00:00 2001 From: Ian Jackson Date: Wed, 18 Nov 2015     15:34:54 +0000 Subject: [PATCH] libxl: Fix     bootloader-related virtual memory leak on pv build     failure The bootloader may call     libxl__file_reference_map, which mmap's the pv_kernel     and pv_ramdisk into process memory. This was only     unmapped, however, on the success path of     libxl__build_pv. If there were a failure anywhere     between libxl_bootloader.c:parse_bootloader_result and     the end of libxl__build_pv, the calls to     libxl__file_reference_unmap would be skipped, leaking     the mapped virtual memory. Ideally this would be fixed     by adding the unmap calls to the destruction path for     libxl__domain_build_state. Unfortunately the lifetime of     the libxl__domain_build_state is opaque, and it doesn't     have a proper destruction path. But, the only thing in     it that isn't from the gc are these bootloader     references, and they are only ever set for one     libxl__domain_build_state, the one which is     libxl__domain_create_state.build_state. So we can clean     up in the exit path from libxl__domain_create_*, which     always comes through domcreate_complete. Remove the     now-redundant unmaps in libxl__build_pv's success path.
    This is XSA-160.

    Based on xen.org's xsa160.patch Conflicts: adjust patch     context to match OVM 3.3 code base (CVE-2015-8341)

  - memory: fix XENMEM_exchange error handling assign_pages     can fail due to the domain getting killed in parallel,     which should not result in a hypervisor crash. Also     delete a redundant put_gfn - all relevant paths leading     to the 'fail' label already do this (and there are also     paths where it was plain wrong). All of the put_gfn-s     got introduced by 51032ca058 ('Modify naming of queries     into the p2m'), including the otherwise unneeded     initializer for k (with even a kind of misleading     comment - the compiler warning could actually have     served as a hint that the use is wrong). This is     XSA-159.

22326022] (CVE-2015-8339, CVE-2015-8340)

  - x86/HVM: always intercept #AC and #DB Both being benign     exceptions, and both being possible to get triggered by     exception delivery, this is required to prevent a guest     from locking up a CPU (resulting from no other VM exits     occurring once getting into such a loop). The specific     scenarios: 1) #AC may be raised during exception     delivery if the handler is set to be a ring-3 one by a     32-bit guest, and the stack is misaligned. 2) #DB may be     raised during exception delivery when a breakpoint got     placed on a data structure involved in delivering the     exception. This can result in an endless loop when a     64-bit guest uses a non-zero IST for the vector 1 IDT     entry, but even without use of IST the time it takes     until a contributory fault would get raised (results     depending on the handler) may be quite long. This is     XSA-156.

(CVE-2015-5307, CVE-2015-8104)

This update for xen fixes the following issues :

  - CVE-2015-8567,CVE-2015-8568: xen: qemu: net: vmxnet3:
    host memory leakage (boo#959387)

  - CVE-2015-8550: xen: paravirtualized drivers incautious     about shared memory contents (XSA-155, boo#957988)

  - CVE-2015-8558: xen: qemu: usb: infinite loop in     ehci_advance_state results in DoS (boo#959006)

  - CVE-2015-7549: xen: qemu pci: NULL pointer dereference     issue (boo#958918)

  - CVE-2015-8504: xen: qemu: ui: vnc: avoid floating point     exception (boo#958493)

  - CVE-2015-8554: xen: qemu-dm buffer overrun in MSI-X     handling (XSA-164, boo#958007)

  - CVE-2015-8555: xen: information leak in legacy x86     FPU/XMM initialization (XSA-165, boo#958009)

  - boo#958523: xen: ioreq handling possibly susceptible to     multiple read issue (XSA-166)

  - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop     in processing command block list (boo#956832)

  - CVE-2015-5307: xen: x86: CPU lockup during fault     delivery (XSA-156, boo#954018)

  - boo#956592: xen: virtual PMU is unsupported (XSA-163)

  - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error     handling issues (XSA-159, boo#956408)

  - CVE-2015-8341: xen: libxl leak of pv kernel and initrd     on error (XSA-160, boo#956409)

  - CVE-2015-7504: xen: heap buffer overflow vulnerability     in pcnet emulator (XSA-162, boo#956411)

This update for xen fixes the following security issues :

  - CVE-2015-8568 CVE-2015-8567: xen: qemu: net: vmxnet3:
    host memory leakage (boo#959387)

  - CVE-2015-8550: xen: paravirtualized drivers incautious     about shared memory contents (XSA-155, boo#957988)

  - CVE-2015-8558: xen: qemu: usb: infinite loop in     ehci_advance_state results in DoS (boo#959006)

  - CVE-2015-7549: xen: qemu pci: NULL pointer dereference     issue (boo#958918)

  - CVE-2015-8504: xen: qemu: ui: vnc: avoid floating point     exception (boo#958493)

  - CVE-2015-8554: xen: qemu-dm buffer overrun in MSI-X     handling (XSA-164, boo#958007)

  - CVE-2015-8555: xen: information leak in legacy x86     FPU/XMM initialization (XSA-165, boo#958009)

  - boo#958523: xen: ioreq handling possibly susceptible to     multiple read issue (XSA-166)

  - CVE-2015-5307: xen: x86: CPU lockup during fault     delivery (XSA-156, boo#954018)

  - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop     in processing command block list (boo#956832)

  - boo#956592: xen: virtual PMU is unsupported (XSA-163)

  - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error     handling issues (XSA-159, boo#956408)

  - CVE-2015-8341: xen: libxl leak of pv kernel and initrd     on error (XSA-160, boo#956409)

  - CVE-2015-7504: xen: heap buffer overflow vulnerability     in pcnet emulator (XSA-162, boo#956411)

This update for xen fixes the following security issues :

  - CVE-2015-8550: paravirtualized drivers incautious about     shared memory contents (XSA-155, boo#957988)

  - CVE-2015-8558: qemu: usb: infinite loop in     ehci_advance_state results in DoS (boo#959006)

  - CVE-2015-7549: qemu pci: NULL pointer dereference issue     (boo#958918)

  - CVE-2015-8504: qemu: ui: vnc: avoid floating point     exception (boo#958493)

  - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling     (XSA-164, boo#958007) 

  - CVE-2015-8555: information leak in legacy x86 FPU/XMM     initialization (XSA-165, boo#958009)

  - boo#958523 xen: ioreq handling possibly susceptible to     multiple read issue (XSA-166)

  - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop     in processing command block list (boo#956832)

  - boo#956592: xen: virtual PMU is unsupported (XSA-163)

  - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error     handling issues (XSA-159, boo#956408)

  - CVE-2015-8341: xen: libxl leak of pv kernel and initrd     on error (XSA-160, boo#956409)

  - CVE-2015-7504: xen: heap buffer overflow vulnerability     in pcnet emulator (XSA-162, boo#956411)

  - CVE-2015-7311: xen: libxl fails to honour readonly flag     on disks with qemu-xen (xsa-142, boo#947165)

  - CVE-2015-8104: Xen: guest to host DoS by triggering an     infinite loop in microcode via #DB exception     (boo#954405)

  - CVE-2015-5307: xen: x86: CPU lockup during fault     delivery (XSA-156, boo#954018)

  - CVE-2015-7970: xen: x86: Long latency populate-on-demand     operation is not preemptible (XSA-150, boo#950704)

The Xen Project reports :

When constructing a guest which is configured to use a PV bootloader which runs as a userspace process in the toolstack domain (e.g.
pygrub) libxl creates a mapping of the files to be used as kernel and initial ramdisk when building the guest domain.

However if building the domain subsequently fails these mappings would not be released leading to a leak of virtual address space in the calling process, as well as preventing the recovery of the temporary disk files containing the kernel and initial ramdisk.

For toolstacks which manage multiple domains within the same process, an attacker who is able to repeatedly start a suitable domain (or many such domains) can cause an out-of-memory condition in the toolstack process, leading to a denial of service.

Under the same circumstances an attacker can also cause files to accumulate on the toolstack domain filesystem (usually under /var in dom0) used to temporarily store the kernel and initial ramdisk, perhaps leading to a denial of service against arbitrary other services using that filesystem.

This update fixes the following security issues :

  - bsc#955399 - Fix xm migrate --log_progress. Due to logic     error progress was not logged when requested.

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#955399 - Fix xm migrate --live. The options were not     passed due to a merge error. As a result the migration     was not live, instead the suspended guest was migrated.

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)

  - bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand     balloon size inaccuracy can crash guests (XSA-153)

  - Drop     5604f239-x86-PV-properly-populate-descriptor-tables.patc     h

  - bsc#950703 - CVE-2015-7969: xen: leak of main per-domain     vcpu pointer array (DoS) (XSA-149)

  - bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain     profiling-related vcpu pointer array (DoS) (XSA-151)

  - bsc#950706 - CVE-2015-7971: xen: x86: some pmu and     profiling hypercalls log without rate limiting (XSA-152)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156) CVE-2015-5307-xsa156.patch

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)     563212c9-x86-PoD-Eager-sweep-for-zeroed-pages.patch

  - bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand     balloon size inaccuracy can crash guests (XSA-153)     xsa153-libxl.patch xend-xsa153.patch

  - Drop     5604f239-x86-PV-properly-populate-descriptor-tables.patc     h

  - bsc#950703 - CVE-2015-7969: xen: leak of main per-domain     vcpu pointer array (DoS) (XSA-149)

  - bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain     profiling-related vcpu pointer array (DoS) (XSA-151)

  - bsc#950706 - CVE-2015-7971: xen: x86: some pmu and     profiling hypercalls log without rate limiting (XSA-152)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)

  - bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand     balloon size inaccuracy can crash guests (XSA-153)

  - bsc#950703 - CVE-2015-7969: xen: leak of main per-domain     vcpu pointer array (DoS) (XSA-149)

  - bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain     profiling-related vcpu pointer array (DoS) (XSA-151)

  - bsc#950706 - CVE-2015-7971: xen: x86: some pmu and     profiling hypercalls log without rate limiting (XSA-152)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - Revert x86/IO-APIC: don't create pIRQ mapping from     masked RTE until kernel maintenance release goes out.

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
90380	GLSA-201604-03 : Xen: Multiple vulnerabilities (Venom)	Nessus	Gentoo Local Security Checks	critical
90030	Debian DSA-3519-1 : xen - security update	Nessus	Debian Local Security Checks	high
89151	Fedora 23 : xen-4.5.2-5.fc23 (2015-12a089920e)	Nessus	Fedora Local Security Checks	critical
89135	Fedora 22 : xen-4.5.2-5.fc22 (2015-08e4af5a20)	Nessus	Fedora Local Security Checks	critical
88170	OracleVM 3.3 : xen (OVMSA-2016-0007)	Nessus	OracleVM Local Security Checks	high
88126	openSUSE Security Update : xen (openSUSE-2016-36)	Nessus	SuSE Local Security Checks	high
88125	openSUSE Security Update : xen (openSUSE-2016-35)	Nessus	SuSE Local Security Checks	high
88124	openSUSE Security Update : xen (openSUSE-2016-34)	Nessus	SuSE Local Security Checks	high
87745	FreeBSD : xen-tools -- libxl leak of pv kernel and initrd on error (5d1d4473-b40d-11e5-9728-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
87650	SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:2338-1)	Nessus	SuSE Local Security Checks	high
87591	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:2328-1)	Nessus	SuSE Local Security Checks	high
87590	SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:2326-1)	Nessus	SuSE Local Security Checks	high
87588	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:2324-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-8341

high

Tenable Plugins

critical

high

critical

critical

high

high

high

high

high

high

high

high

high