Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-214.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV
    guest OS users to execute arbitrary code on the host OS, aka XSA-213. (CVE-2017-8903)

  - Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka
    guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS,
    aka XSA-214. (CVE-2017-8904)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Xen through 4.8.x mishandles the contains segment descriptors property during GNTTABOP_transfer (aka     guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS,     aka XSA-214. (CVE-2017-8904)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV
    guest OS users to execute arbitrary code on the host OS, aka XSA-213. (CVE-2017-8903)

  - Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka
    guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS,
    aka XSA-214. (CVE-2017-8904)

  - Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users
    to execute arbitrary code on the host OS, aka XSA-215. (CVE-2017-8905)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV
    guest OS users to execute arbitrary code on the host OS, aka XSA-213. (CVE-2017-8903)

  - Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka
    guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS,
    aka XSA-214. (CVE-2017-8904)

  - Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users
    to execute arbitrary code on the host OS, aka XSA-215. (CVE-2017-8905)

  - A parameter verification issue was discovered in Xen through 4.9.x. The function `alloc_heap_pages` allows
    callers to specify the first NUMA node that should be used for allocations through the `memflags`
    parameter; the node is extracted using the `MEMF_get_node` macro. While the function checks to see if the
    special constant `NUMA_NO_NODE` is specified, it otherwise does not handle the case where `node >=
    MAX_NUMNODES`. This allows an out-of-bounds access to an internal array. (CVE-2017-14316)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV
    guest OS users to execute arbitrary code on the host OS, aka XSA-213. (CVE-2017-8903)

  - Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling
    of SYSCALL singlestep during emulation. (CVE-2016-10013)

  - Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host
    hang or crash) by modifying the instruction stream asynchronously while performing certain kernel
    operations. (CVE-2016-10024)

  - VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM)
    allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing
    NULL pointer check. (CVE-2016-10025)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0039 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0153 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0142 for details.

xen: various flaws (#1447345) x86: 64bit PV guest breakout via pagetable use-after-mode-change [XSA-213] grant transfer allows PV guest to elevate privileges [XSA-214]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - BUILDINFO: xen     commit=74b662e79bc874fe8ad8a93d2891e6569c380004

  - BUILDINFO: QEMU upstream     commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - gnttab: __gnttab_unmap_common_complete is all-or-nothing     (Jan Beulich) [Orabug: 26288614]

  - gnttab: correct logic to get page references during map     requests (George Dunlap) [Orabug: 26288614]

  - gnttab: never create host mapping unless asked to (Jan     Beulich) 

  - gnttab: Fix handling of dev_bus_addr during unmap     (George Dunlap) 

  - x86/shadow: Hold references for the duration of emulated     writes (Andrew Cooper) [Orabug: 26288568]

  - x86/mm: disallow page stealing from HVM domains (Jan     Beulich) 

  - guest_physmap_remove_page needs its return value checked     (Jan Beulich) [Orabug: 26288602]

  - xen/memory: Fix return value handing of     guest_remove_page (Andrew Cooper) [Orabug: 26288602]

  - evtchn: avoid NULL derefs (Jan Beulich) [Orabug:
    26288583]

  - gnttab: correct maptrack table accesses (Jan Beulich)     [Orabug: 26288557]

  - gnttab: Avoid potential double-put of maptrack entry     (George Dunlap) 

  - gnttab: fix unmap pin accounting race (Jan Beulich)     [Orabug: 26288557]

  - IOMMU: handle IOMMU mapping and unmapping failures (Quan     Xu) [Orabug: 26288557]

  - xen/disk: don't leak stack data via response ring (Jan     Beulich) 

  - BUILDINFO: xen     commit=7b45c3eb48a884f56f072a97a9a8da4d0b1077ed

  - BUILDINFO: QEMU upstream     commit=44c5f0a55d9a73e592426c33ce5705c969681955

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - livepatch: Wrong usage of spinlock on debug console.
    (Konrad Rzeszutek Wilk) [Orabug: 26248311]

  - BUILDINFO: xen     commit=40e21e7aea2b8bbc991346c3f516dfac4f94affe

  - BUILDINFO: QEMU upstream     commit=44c5f0a55d9a73e592426c33ce5705c969681955

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - x86/do_invalid_op should use is_active_kernel_text     rather than having its (Konrad Rzeszutek Wilk) [Orabug:
    26129273]

  - BUILDINFO: xen     commit=0eadc919cf32139e5565e0d869ed09f35c0a3212

  - BUILDINFO: QEMU upstream     commit=44c5f0a55d9a73e592426c33ce5705c969681955

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - kexec: Add spinlock for the whole hypercall. (Konrad     Rzeszutek Wilk) 

  - kexec: clear kexec_image slot when unloading kexec image     (Bhavesh Davda) [Orabug: 25861742]

  - BUILDINFO: xen     commit=8b90d66cd941599d50ee80e14fd144e337814bf6

  - BUILDINFO: QEMU upstream     commit=44c5f0a55d9a73e592426c33ce5705c969681955

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - x86: correct create_bounce_frame (tagged with CVE     number) (Boris Ostrovsky) [Orabug: 25927739]     (CVE-2017-8905)

  - x86: discard type information when stealing pages     (tagged with CVE number) (Boris Ostrovsky) [Orabug:
    25927669] (CVE-2017-8904)

  - multicall: deal with early exit conditions (tagged with     CVE number) (Boris Ostrovsky) [Orabug: 25927592]     (CVE-2017-8903)

  - BUILDINFO: xen     commit=583dedab5ceddbae4d0384de0ade8feeee75f78c

  - BUILDINFO: QEMU upstream     commit=fcd17fdf18b95a9e408acc84f6d2b37cf3fc0335

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - tools/libxc: Set max_elem to zero in     xc_lockprof_query_number (Boris Ostrovsky) [Orabug:
    26020611]

Multiple vulnerabilities have been discovered in the Xen hypervisor.
The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2016-9932 (XSA-200)

CMPXCHG8B emulation allows local HVM guest OS users to obtain sensitive information from host stack memory.

CVE-2017-7995

Description Xen checks access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads.

CVE-2017-8903 (XSA-213)

Xen mishandles page tables after an IRET hypercall which can lead to arbitrary code execution on the host OS. The vulnerability is only exposed to 64-bit PV guests.

CVE-2017-8904 (XSA-214)

Xen mishandles the 'contains segment descriptors' property during GNTTABOP_transfer. This might allow PV guest OS users to execute arbitrary code on the host OS.

CVE-2017-8905 (XSA-215)

Xen mishandles a failsafe callback which might allow PV guest OS users to execute arbitrary code on the host OS.

For Debian 7 'Wheezy', these problems have been fixed in version 4.1.6.lts1-8.

We recommend that you upgrade your xen packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201705-11 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers and Xen Security Advisory referenced below for details.
  Impact :

    A local attacker could potentially execute arbitrary code with       privileges of Xen (QEMU) process on the host, gain privileges on the host       system, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

xen: various flaws (#1447345) x86: 64bit PV guest breakout via pagetable use-after-mode-change [XSA-213] grant transfer allows PV guest to elevate privileges [XSA-214] possible memory corruption via failsafe callback [XSA-215]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
424715	Alpine: multiple xen packages: security update to 4.8.1-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424715	Alpine: multiple xen packages: security update to 4.8.1-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
221247	Linux Distros Unpatched Vulnerability : CVE-2017-8904	Nessus	Misc.	high
407879	Alpine: xen: security update to 4.7.2-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407879	Alpine: xen: security update to 4.7.2-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
407866	Alpine: xen: security update to 4.6.3-r9	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407866	Alpine: xen: security update to 4.6.3-r9	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
407864	Alpine: xen: security update to 4.6.3-r7	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407864	Alpine: xen: security update to 4.6.3-r7	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
140019	OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
111992	OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
103830	OracleVM 3.4 : xen (OVMSA-2017-0153)	Nessus	OracleVM Local Security Checks	critical
102835	OracleVM 3.4 : xen (OVMSA-2017-0142)	Nessus	OracleVM Local Security Checks	critical
101659	Fedora 26 : xen (2017-77ca39d254)	Nessus	Fedora Local Security Checks	high
101195	OracleVM 3.4 : xen (OVMSA-2017-0116)	Nessus	OracleVM Local Security Checks	high
100575	Debian DLA-964-1 : xen security update	Nessus	Debian Local Security Checks	high
100443	GLSA-201705-11 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
100198	Fedora 24 : xen (2017-c9d71f0860)	Nessus	Fedora Local Security Checks	high
100189	Fedora 25 : xen (2017-5ae70ac6a5)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-8904

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

critical

critical

critical

critical

high

high

high

high

high

high