An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected). Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected; they are always read only. Only systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host and guest together usually support PVHVM, the issue is exploitable only if the malicious guest administrator has control of the guest kernel or guest kernel command line.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when     setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest     administrators or (in some situations) users may be able to write to supposedly read-only disk images.
    Only emulated SCSI disks (specified as sd in the libxl disk configuration, or an equivalent) are     affected. IDE disks (hd) are not affected (because attempts to make them readonly are rejected).
    Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless     of the nature of the backing storage on the host) are not affected; they are always read only. Only     systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only     systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the     libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided     that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host     and guest together usually support PVHVM, the issue is exploitable only if the malicious guest     administrator has control of the guest kernel or guest kernel command line. (CVE-2018-12892)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when
    setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest
    administrators or (in some situations) users may be able to write to supposedly read-only disk images.
    Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are
    affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected).
    Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless
    of the nature of the backing storage on the host) are not affected; they are always read only. Only
    systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only
    systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the
    libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided
    that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host
    and guest together usually support PVHVM, the issue is exploitable only if the malicious guest
    administrator has control of the guest kernel or guest kernel command line. (CVE-2018-12892)

  - Systems with microprocessors utilizing speculative execution and speculative execution of memory reads
    before the addresses of all prior memory writes are known may allow unauthorized disclosure of information
    to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB),
    Variant 4. (CVE-2018-3639)

  - System software utilizing Lazy FP state restore technique on systems using Intel Core-based
    microprocessors may potentially allow a local process to infer data from another process through a
    speculative execution side channel. (CVE-2018-3665)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when
    setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest
    administrators or (in some situations) users may be able to write to supposedly read-only disk images.
    Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are
    affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected).
    Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless
    of the nature of the backing storage on the host) are not affected; they are always read only. Only
    systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only
    systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the
    libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided
    that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host
    and guest together usually support PVHVM, the issue is exploitable only if the malicious guest
    administrator has control of the guest kernel or guest kernel command line. (CVE-2018-12892)

  - Systems with microprocessors utilizing speculative execution and address translations may allow
    unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access
    via a terminal page fault and a side-channel analysis. (CVE-2018-3620)

  - Systems with microprocessors utilizing speculative execution and address translations may allow
    unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access
    with guest OS privilege via a terminal page fault and a side-channel analysis. (CVE-2018-3646)

  - An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process.
    For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few
    rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page
    table contents, a malicious guest may cause such bypasses to be used for an unbounded number of
    iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host.
    Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions
    from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of
    attacks, due to them lacking preemption checks altogether in the affected code paths. Only x86 systems are
    affected. ARM systems are not affected. Only multi-vCPU x86 PV guests can leverage the vulnerability. x86
    HVM or PVH guests as well as x86 single-vCPU PV ones cannot leverage the vulnerability. (CVE-2018-12891)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Systems with microprocessors utilizing speculative execution and speculative execution of memory reads
    before the addresses of all prior memory writes are known may allow unauthorized disclosure of information
    to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB),
    Variant 4. (CVE-2018-3639)

  - System software utilizing Lazy FP state restore technique on systems using Intel Core-based
    microprocessors may potentially allow a local process to infer data from another process through a
    speculative execution side channel. (CVE-2018-3665)

  - An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process.
    For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few
    rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page
    table contents, a malicious guest may cause such bypasses to be used for an unbounded number of
    iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host.
    Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions
    from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of
    attacks, due to them lacking preemption checks altogether in the affected code paths. Only x86 systems are
    affected. ARM systems are not affected. Only multi-vCPU x86 PV guests can leverage the vulnerability. x86
    HVM or PVH guests as well as x86 single-vCPU PV ones cannot leverage the vulnerability. (CVE-2018-12891)

  - An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when
    setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest
    administrators or (in some situations) users may be able to write to supposedly read-only disk images.
    Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are
    affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected).
    Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless
    of the nature of the backing storage on the host) are not affected; they are always read only. Only
    systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only
    systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the
    libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided
    that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host
    and guest together usually support PVHVM, the issue is exploitable only if the malicious guest
    administrator has control of the guest kernel or guest kernel command line. (CVE-2018-12892)

  - An issue was discovered in Xen through 4.10.x. One of the fixes in XSA-260 added some safety checks to
    help prevent Xen livelocking with debug exceptions. Unfortunately, due to an oversight, at least one of
    these safety checks can be triggered by a guest. A malicious PV guest can crash Xen, leading to a Denial
    of Service. All Xen systems which have applied the XSA-260 fix are vulnerable. Only x86 systems are
    vulnerable. ARM systems are not vulnerable. Only x86 PV guests can exploit the vulnerability. x86 HVM and
    PVH guests cannot exploit the vulnerability. An attacker needs to be able to control hardware debugging
    facilities to exploit the vulnerability, but such permissions are typically available to unprivileged
    users. (CVE-2018-12893)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when
    setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest
    administrators or (in some situations) users may be able to write to supposedly read-only disk images.
    Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are
    affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected).
    Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless
    of the nature of the backing storage on the host) are not affected; they are always read only. Only
    systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only
    systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the
    libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided
    that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host
    and guest together usually support PVHVM, the issue is exploitable only if the malicious guest
    administrator has control of the guest kernel or guest kernel command line. (CVE-2018-12892)

  - Systems with microprocessors utilizing speculative execution and speculative execution of memory reads
    before the addresses of all prior memory writes are known may allow unauthorized disclosure of information
    to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB),
    Variant 4. (CVE-2018-3639)

  - Systems with microprocessors utilizing speculative execution and address translations may allow
    unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access
    with guest OS privilege via a terminal page fault and a side-channel analysis. (CVE-2018-3646)

  - System software utilizing Lazy FP state restore technique on systems using Intel Core-based
    microprocessors may potentially allow a local process to infer data from another process through a
    speculative execution side channel. (CVE-2018-3665)

  - An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process.
    For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few
    rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page
    table contents, a malicious guest may cause such bypasses to be used for an unbounded number of
    iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host.
    Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions
    from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of
    attacks, due to them lacking preemption checks altogether in the affected code paths. Only x86 systems are
    affected. ARM systems are not affected. Only multi-vCPU x86 PV guests can leverage the vulnerability. x86
    HVM or PVH guests as well as x86 single-vCPU PV ones cannot leverage the vulnerability. (CVE-2018-12891)

This update for xen fixes the following issues :

Security issues fixed :

  - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267)     (bsc#1095242).

  - CVE-2018-12891: Fix possible Denial of Service (DoS) via     certain PV MMU operations that affect the entire host     (XSA-264) (bsc#1097521).

  - CVE-2018-12892: Fix libxl to honour the readonly flag on     HVM emulated SCSI disks (XSA-266) (bsc#1097523).

  - CVE-2018-12893: Fix crash/Denial of Service (DoS) via     safety check (XSA-265) (bsc#1097522).

Bug fixes :

  - bsc#1027519: Add upstream patches from January.

  - bsc#1098403: Fix regression introduced by changes for     bsc#1079730. A PV domU without qcow2 and/or vfb has no     qemu attached. Ignore QMP errors for PV domUs to handle     PV domUs with and without an attached qemu-xen.

  - bsc#1087289: Fix xen scheduler crash.

This update was imported from the SUSE:SLE-15:Update update project.

preemption checks bypassed in x86 PV MM handling [XSA-264, CVE-2018-12891] (#1595959) x86: #DB exception safety check can be triggered by a guest [XSA-265, CVE-2018-12893] (#1595958) libxl fails to honour readonly flag on HVM emulated SCSI disks [XSA-266, CVE-2018-12892] (#1595957)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues: Security issues fixed :

  - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267)     (bsc#1095242).

  - CVE-2018-12891: Fix possible Denial of Service (DoS) via     certain PV MMU operations that affect the entire host     (XSA-264) (bsc#1097521).

  - CVE-2018-12892: Fix libxl to honour the readonly flag on     HVM emulated SCSI disks (XSA-266) (bsc#1097523).

  - CVE-2018-12893: Fix crash/Denial of Service (DoS) via     safety check (XSA-265) (bsc#1097522). Bug fixes :

  - bsc#1027519: Add upstream patches from January.

  - bsc#1098403: Fix regression introduced by changes for     bsc#1079730. A PV domU without qcow2 and/or vfb has no     qemu attached. Ignore QMP errors for PV domUs to handle     PV domUs with and without an attached qemu-xen.

  - bsc#1087289: Fix xen scheduler crash.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201810-06 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       referenced CVE identifiers for details.
  Impact :

    A local attacker could cause a Denial of Service condition or disclose       sensitive information.
  Workaround :

    There is no known workaround at this time.

This update for xen fixes the following issues :

Security issues fixed :

CVE-2018-12891: Fix preemption checks bypass in x86 PV MM handling (XSA-264) (bsc#1097521).

CVE-2018-12892: Fix libxl failure to honour readonly flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523).

CVE-2018-12893: Fix #DB exception safety check that could be triggered by a guest (XSA-265) (bsc#1097522).

CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224).

CVE-2018-3665: Fix lazy FP Save/Restore (XSA-267) (bsc#1095242).

Bug fixes: bsc#1027519: Update to Xen 4.7.6 bug fix only release.

bsc#1087289: Xen BUG at sched_credit.c:1663.

bsc#1094725: `virsh blockresize` does not work with Xen qdisks.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

Security issues fixed :

  - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267)     (bsc#1095242).

  - CVE-2018-12891: Fix possible Denial of Service (DoS) via     certain PV MMU operations that affect the entire host     (XSA-264) (bsc#1097521).

  - CVE-2018-12892: Fix libxl to honour the readonly flag on     HVM emulated SCSI disks (XSA-266) (bsc#1097523).

  - CVE-2018-12893: Fix crash/Denial of Service (DoS) via     safety check (XSA-265) (bsc#1097522).

  - CVE-2018-11806: Fix heap buffer overflow while     reassembling fragmented datagrams (bsc#1096224).

Bug fixes :

  - bsc#1027519: Add upstream patches from January.

  - bsc#1087289: Fix xen scheduler crash.

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for xen fixes the following issues: Security issues fixed :

  - CVE-2018-12891: Fix preemption checks bypass in x86 PV     MM handling (XSA-264) (bsc#1097521).

  - CVE-2018-12892: Fix libxl failure to honour readonly     flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523).

  - CVE-2018-12893: Fix #DB exception safety check that     could be triggered by a guest (XSA-265) (bsc#1097522).

  - CVE-2018-11806: Fix heap buffer overflow while     reassembling fragmented datagrams (bsc#1096224).

  - CVE-2018-3665: Fix lazy FP Save/Restore (XSA-267)     (bsc#1095242). Bug fixes :

  - bsc#1027519: Update to Xen 4.7.6 bug fix only release.

  - bsc#1087289: Xen BUG at sched_credit.c:1663.

  - bsc#1094725: `virsh blockresize` does not work with Xen     qdisks.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a local security bypass vulnerability.

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

This update for xen fixes the following issues: Security issues fixed :

  - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267)     (bsc#1095242).

  - CVE-2018-12891: Fix possible Denial of Service (DoS) via     certain PV MMU operations that affect the entire host     (XSA-264) (bsc#1097521).

  - CVE-2018-12892: Fix libxl to honour the readonly flag on     HVM emulated SCSI disks (XSA-266) (bsc#1097523).

  - CVE-2018-12893: Fix crash/Denial of Service (DoS) via     safety check (XSA-265) (bsc#1097522).

  - CVE-2018-11806: Fix heap buffer overflow while     reassembling fragmented datagrams (bsc#1096224). Bug     fixes :

  - bsc#1027519: Add upstream patches from January.

  - bsc#1087289: Fix xen scheduler crash.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

preemption checks bypassed in x86 PV MM handling [XSA-264, CVE-2018-12891] x86: #DB exception safety check can be triggered by a guest [XSA-265, CVE-2018-12893] libxl fails to honour readonly flag on HVM emulated SCSI disks [XSA-266, CVE-2018-12892]

----

Speculative register leakage from lazy FPU context switching [XSA-267, CVE-2018-3665] fix for change in iasl output

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the Xen hypervisor :

  - CVE-2018-12891     It was discovered that insufficient validation of PV MMU     operations may result in denial of service.

  - CVE-2018-12892     It was discovered that libxl fails to honour the     'readonly' flag on HVM-emulated SCSI disks.

  - CVE-2018-12893     It was discovered that incorrect implementation of debug     exception checks could result in denial of service.

ID	Name	Product	Family	Severity
255789	Linux Distros Unpatched Vulnerability : CVE-2018-12892	Nessus	Misc.	critical
424684	Alpine: multiple xen packages: security update to 4.11.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
424684	Alpine: multiple xen packages: security update to 4.11.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
407910	Alpine: xen: security update to 4.9.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
407910	Alpine: xen: security update to 4.9.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
407898	Alpine: xen: security update to 4.8.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
407898	Alpine: xen: security update to 4.8.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
407888	Alpine: xen: security update to 4.7.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
407888	Alpine: xen: security update to 4.7.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
407738	Alpine: xen: security update to 4.10.1-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
407738	Alpine: xen: security update to 4.10.1-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
123224	openSUSE Security Update : xen (openSUSE-2019-533)	Nessus	SuSE Local Security Checks	critical
120682	Fedora 28 : xen (2018-a7862a75f5)	Nessus	Fedora Local Security Checks	critical
120050	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2018:1981-1)	Nessus	SuSE Local Security Checks	critical
118506	GLSA-201810-06 : Xen: Multiple vulnerabilities (Foreshadow) (Meltdown) (Spectre)	Nessus	Gentoo Local Security Checks	critical
118277	SUSE SLES12 Security Update : xen (SUSE-SU-2018:2081-2)	Nessus	SuSE Local Security Checks	critical
111565	openSUSE Security Update : xen (openSUSE-2018-803)	Nessus	SuSE Local Security Checks	critical
111433	SUSE SLES12 Security Update : xen (SUSE-SU-2018:2081-1)	Nessus	SuSE Local Security Checks	critical
111418	openSUSE Security Update : xen (openSUSE-2018-766)	Nessus	SuSE Local Security Checks	critical
111381	Xen Project Local Security Bypass Vulnerability (XSA-266)	Nessus	Misc.	critical
111348	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2018:2059-1)	Nessus	SuSE Local Security Checks	critical
111236	Fedora 27 : xen (2018-1a467757ce)	Nessus	Fedora Local Security Checks	critical
110787	Debian DSA-4236-1 : xen - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2018-12892

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical