An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest OS users to obtain sensitive information from DRAM after a reboot, because disjoint blocks, and physical addresses that do not start at zero, are mishandled.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin
    would be accompanied by a suitable page reference. Other portions of code, however, did not match up with
    that assumption. When such a grant copy operation is being done on a grant of a dying domain, the
    assumption turns out wrong. A malicious guest administrator can cause hypervisor memory corruption, most
    likely resulting in host crash and a Denial of Service. Privilege escalation and information leaks cannot
    be ruled out. (CVE-2017-15597)

  - An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on
    the host OS because of a race condition that can cause a stale TLB entry. (CVE-2017-15588)

  - An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive
    information from the host OS (or an arbitrary guest OS) because intercepted I/O operations can cause a
    write of data from uninitialized hypervisor stack memory. (CVE-2017-15589)

  - An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service
    (hypervisor crash) or possibly gain privileges because MSI mapping was mishandled. (CVE-2017-15590)

  - An issue was discovered in Xen 4.5.x through 4.9.x allowing attackers (who control a stub domain kernel or
    tool stack) to cause a denial of service (host OS crash) because of a missing comparison (of range start
    to range end) within the DMOP map/unmap implementation. (CVE-2017-15591)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin
    would be accompanied by a suitable page reference. Other portions of code, however, did not match up with
    that assumption. When such a grant copy operation is being done on a grant of a dying domain, the
    assumption turns out wrong. A malicious guest administrator can cause hypervisor memory corruption, most
    likely resulting in host crash and a Denial of Service. Privilege escalation and information leaks cannot
    be ruled out. (CVE-2017-15597)

  - An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on
    the host OS because of a race condition that can cause a stale TLB entry. (CVE-2017-15588)

  - An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive
    information from the host OS (or an arbitrary guest OS) because intercepted I/O operations can cause a
    write of data from uninitialized hypervisor stack memory. (CVE-2017-15589)

  - An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service
    (hypervisor crash) or possibly gain privileges because MSI mapping was mishandled. (CVE-2017-15590)

  - An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service
    (hypervisor crash) or possibly gain privileges because self-linear shadow mappings are mishandled for
    translated guests. (CVE-2017-15592)

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, informations leaks or privilege escalation.

For Debian 8 'Jessie', these problems have been fixed in version 4.4.4lts2-0+deb8u1.

We recommend that you upgrade your xen packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201801-14 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       referenced CVE identifiers for details.
  Impact :

    A local attacker could potentially execute arbitrary code with the       privileges of the Xen (QEMU) process on the host, gain privileges on the       host system, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, information leaks, privilege escalation or the execution of arbitrary code.

ID	Name	Product	Family	Type	Severity
407893	Alpine: xen: security update to 4.8.2-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
407893	Alpine: xen: security update to 4.8.2-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
407883	Alpine: xen: security update to 4.7.3-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
407883	Alpine: xen: security update to 4.7.3-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
407868	Alpine: xen: security update to 4.6.6-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
407868	Alpine: xen: security update to 4.6.6-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
118215	Debian DLA-1549-1 : xen security update	Nessus	Debian Local Security Checks	Local	critical
106038	GLSA-201801-14 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
104819	Debian DSA-4050-1 : xen - security update	Nessus	Debian Local Security Checks	Local	critical

Detections

Analytics

CVE-2017-17046

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

high

critical