Xen through 4.8.x does not validate a vCPU array index upon the sending of an SGI, which allows guest OS users to cause a denial of service (hypervisor crash), aka XSA-225.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a
    GNTMAP_device_map and GNTMAP_host_map mapping, which allows guest OS users to cause a denial of service
    (count mismanagement and memory corruption) or obtain privileged host OS access, aka XSA-224 bug 2.
    (CVE-2017-10921)

  - The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows
    guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by
    leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka
    XSA-216. (CVE-2017-10911)

  - Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS
    access, aka XSA-217. (CVE-2017-10912)

  - The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of
    concurrent unmap calls, which allows backend attackers to obtain sensitive information or gain privileges,
    aka XSA-218 bug 1. (CVE-2017-10913)

  - The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows
    guest OS users to cause a denial of service (memory consumption), or possibly obtain sensitive information
    or gain privileges, aka XSA-218 bug 2. (CVE-2017-10914)

xen: various flaws (#1463247) blkif responses leak backend stack data [XSA-216] page transfer may allow PV guest to elevate privilege [XSA-217] Races in the grant table unmap code [XSA-218] x86:
insufficient reference counts during shadow emulation [XSA-219] x86:
PKRU and BND* leakage between vCPU-s [XSA-220] NULL pointer deref in event channel poll [XSA-221] (#1463231) stale P2M mappings due to insufficient error checking [XSA-222] ARM guest disabling interrupt may crash Xen [XSA-223] grant table operations mishandle reference counts [XSA-224] arm: vgic: Out-of-bound access when sending SGIs [XSA-225]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xen: various flaws (#1463247) blkif responses leak backend stack data [XSA-216] page transfer may allow PV guest to elevate privilege [XSA-217] Races in the grant table unmap code [XSA-218] x86:
insufficient reference counts during shadow emulation [XSA-219] x86:
PKRU and BND* leakage between vCPU-s [XSA-220] stale P2M mappings due to insufficient error checking [XSA-222] ARM guest disabling interrupt may crash Xen [XSA-223] grant table operations mishandle reference counts [XSA-224] arm: vgic: Out-of-bound access when sending SGIs [XSA-225] NULL pointer deref in event channel poll [XSA-221] (#1463231)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
424718	Alpine: multiple xen packages: security update to 4.9.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
424718	Alpine: multiple xen packages: security update to 4.9.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
407890	Alpine: xen: security update to 4.8.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
407890	Alpine: xen: security update to 4.8.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
407881	Alpine: xen: security update to 4.7.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
407881	Alpine: xen: security update to 4.7.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
407867	Alpine: xen: security update to 4.6.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
407867	Alpine: xen: security update to 4.6.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
101638	Fedora 26 : xen (2017-5c6a9b07a3)	Nessus	Fedora Local Security Checks	critical
101183	Fedora 24 : xen (2017-b3bdaf58bc)	Nessus	Fedora Local Security Checks	critical
101028	Fedora 25 : xen (2017-c3149b5fcb)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2017-10923

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical