The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (NULL pointer dereference and host OS crash) by creating concurrent domains and holding references to them, related to VMID exhaustion.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly
    handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local
    guest OS users to gain privileges via a crafted mapping of memory. (CVE-2016-4480)

  - The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of
    service (host disk consumption) by writing to stdout or stderr. (CVE-2014-3672)

  - The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows
    local guest OS administrators to execute arbitrary code on the host by changing access modes after setting
    the bank register, aka the "Dark Portal" issue. (CVE-2016-3710)

  - Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-
    of-bounds read and QEMU process crash) by editing VGA registers in VBE mode. (CVE-2016-3712)

  - Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which
    allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a
    hugetlbfs mapped area. (CVE-2016-3961)

Multiple vulnerabilities have been discovered in the Xen hypervisor.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-8338     Julien Grall discovered that Xen on ARM was susceptible     to denial of service via long running memory operations.

  - CVE-2016-4480     Jan Beulich discovered that incorrect page table     handling could result in privilege escalation inside a     Xen guest instance.

  - CVE-2016-4962     Wei Liu discovered multiple cases of missing input     sanitising in libxl which could result in denial of     service.

  - CVE-2016-5242     Aaron Cornelius discovered that incorrect resource     handling on ARM systems could result in denial of     service.

  - CVE-2016-6258     Jeremie Boutoille discovered that incorrect pagetable     handling in PV instances could result in guest to host     privilege escalation.

fix for CVE-2016-2858 doesn't build with qemu-xen enabled Unsanitised guest input in libxl device handling code [XSA-175, CVE-2016-4962] (#1342132) Unsanitised driver domain input in libxl device handling [XSA-178, CVE-2016-4963] (#1342131) arm: Host crash caused by VMID exhaust [XSA-181] (#1342530) Qemu: display: vmsvga: out-of-bounds read in vmsvga_fifo_read_raw() routine [CVE-2016-4454] (#1340741) Qemu:
display: vmsvga: infinite loop in vmsvga_fifo_run() routine [CVE-2016-4453] (#1340746) Qemu: scsi: esp: OOB write when using non-DMA mode in get_cmd [CVE-2016-5238] (#1341931)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Qemu: scsi: esp: OOB r/w access while processing ESP_FIFO [CVE-2016-5338] (#1343323) Qemu: scsi: megasas: information leakage in megasas_ctrl_get_info [CVE-2016-5337] (#1343909)

----

fix for CVE-2016-2858 doesn't build with qemu-xen enabled Unsanitised guest input in libxl device handling code [XSA-175, CVE-2016-4962] (#1342132) Unsanitised driver domain input in libxl device handling [XSA-178, CVE-2016-4963] (#1342131) arm: Host crash caused by VMID exhaust [XSA-181] (#1342530) Qemu: display: vmsvga: out-of-bounds read in vmsvga_fifo_read_raw() routine [CVE-2016-4454] (#1340741) Qemu:
display: vmsvga: infinite loop in vmsvga_fifo_run() routine [CVE-2016-4453] (#1340746) Qemu: scsi: esp: OOB write when using non-DMA mode in get_cmd [CVE-2016-5238] (#1341931)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
401022	Alpine: multiple xen packages: security update to 4.6.1-r2 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
401022	Alpine: multiple xen packages: security update to 4.6.1-r2 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
92614	Debian DSA-3633-1 : xen - security update (Bunker Buster)	Nessus	Debian Local Security Checks	high
92081	Fedora 24 : xen (2016-389be30b95)	Nessus	Fedora Local Security Checks	medium
92059	Fedora 23 : xen (2016-103752d2a9)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2016-5242

medium

Tenable Plugins

high

high

high

medium

high