An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) can lock up the entire host, causing a Denial of Service.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some     of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the     processor, and software has to be careful to configure it suitably not to lock up the core. As a result,     it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all     value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or     buggy guest administrator (on Intel x86 HVM or PVH) can lock up the entire host, causing a Denial of     Service. (CVE-2018-15468)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service
    (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data
    structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for
    CVE-2017-15595. (CVE-2018-19966)

  - Systems with microprocessors utilizing speculative execution and address translations may allow
    unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access
    via a terminal page fault and a side-channel analysis. (CVE-2018-3620)

  - Systems with microprocessors utilizing speculative execution and address translations may allow
    unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access
    with guest OS privilege via a terminal page fault and a side-channel analysis. (CVE-2018-3646)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when
    setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest
    administrators or (in some situations) users may be able to write to supposedly read-only disk images.
    Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are
    affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected).
    Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless
    of the nature of the backing storage on the host) are not affected; they are always read only. Only
    systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only
    systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the
    libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided
    that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host
    and guest together usually support PVHVM, the issue is exploitable only if the malicious guest
    administrator has control of the guest kernel or guest kernel command line. (CVE-2018-12892)

  - Systems with microprocessors utilizing speculative execution and address translations may allow
    unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access
    via a terminal page fault and a side-channel analysis. (CVE-2018-3620)

  - Systems with microprocessors utilizing speculative execution and address translations may allow
    unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access
    with guest OS privilege via a terminal page fault and a side-channel analysis. (CVE-2018-3646)

  - An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process.
    For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few
    rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page
    table contents, a malicious guest may cause such bypasses to be used for an unbounded number of
    iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host.
    Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions
    from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of
    attacks, due to them lacking preemption checks altogether in the affected code paths. Only x86 systems are
    affected. ARM systems are not affected. Only multi-vCPU x86 PV guests can leverage the vulnerability. x86
    HVM or PVH guests as well as x86 single-vCPU PV ones cannot leverage the vulnerability. (CVE-2018-12891)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service
    (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data
    structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for
    CVE-2017-15595. (CVE-2018-19966)

  - Systems with microprocessors utilizing speculative execution and address translations may allow
    unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access
    via a terminal page fault and a side-channel analysis. (CVE-2018-3620)

  - Systems with microprocessors utilizing speculative execution and address translations may allow
    unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access
    with guest OS privilege via a terminal page fault and a side-channel analysis. (CVE-2018-3646)

  - An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some
    of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the
    processor, and software has to be careful to configure it suitably not to lock up the core. As a result,
    it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all
    value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or
    buggy guest administrator (on Intel x86 HVM or PVH) can lock up the entire host, causing a Denial of
    Service. (CVE-2018-15468)

  - An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in
    the hypervisor or in Linux. Unfortunately, an ARM guest can still request v2 grant tables; they will
    simply not be properly set up, resulting in subsequent grant-related hypercalls hitting BUG() checks. An
    unprivileged guest can cause a BUG() check in the hypervisor, resulting in a denial-of-service (crash).
    (CVE-2018-15469)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when
    setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest
    administrators or (in some situations) users may be able to write to supposedly read-only disk images.
    Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are
    affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected).
    Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless
    of the nature of the backing storage on the host) are not affected; they are always read only. Only
    systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only
    systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the
    libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided
    that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host
    and guest together usually support PVHVM, the issue is exploitable only if the malicious guest
    administrator has control of the guest kernel or guest kernel command line. (CVE-2018-12892)

  - Systems with microprocessors utilizing speculative execution and speculative execution of memory reads
    before the addresses of all prior memory writes are known may allow unauthorized disclosure of information
    to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB),
    Variant 4. (CVE-2018-3639)

  - Systems with microprocessors utilizing speculative execution and address translations may allow
    unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access
    with guest OS privilege via a terminal page fault and a side-channel analysis. (CVE-2018-3646)

  - System software utilizing Lazy FP state restore technique on systems using Intel Core-based
    microprocessors may potentially allow a local process to infer data from another process through a
    speculative execution side channel. (CVE-2018-3665)

  - An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process.
    For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few
    rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page
    table contents, a malicious guest may cause such bypasses to be used for an unbounded number of
    iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host.
    Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions
    from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of
    attacks, due to them lacking preemption checks altogether in the affected code paths. Only x86 systems are
    affected. ARM systems are not affected. Only multi-vCPU x86 PV guests can leverage the vulnerability. x86
    HVM or PVH guests as well as x86 single-vCPU PV ones cannot leverage the vulnerability. (CVE-2018-12891)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0039 for details.

This update for xen fixes the following issues :

Update to Xen 4.10.2 bug fix release (bsc#1027519).

Security vulnerabilities fixed :

  - CVE-2018-19961, CVE-2018-19962: Fixed an issue related     to insufficient TLB flushing with AMD IOMMUs, which     potentially allowed a guest to escalate its privileges,     may cause a Denial of Service (DoS) affecting the entire     host, or may be able to access data it is not supposed     to access. (XSA-275) (bsc#1115040)

  - CVE-2018-19965: Fixed an issue related to the INVPCID     instruction in case non-canonical addresses are     accessed, which may allow a guest to cause Xen to crash,     resulting in a Denial of Service (DoS) affecting the     entire host. (XSA-279) (bsc#1115045)

  - CVE-2018-19966: Fixed an issue related to a previous fix     for XSA-240, which conflicted with shadow paging and     allowed a guest to cause Xen to crash, resulting in a     Denial of Service (DoS). (XSA-280) (bsc#1115047)

  - CVE-2018-18883: Fixed an issue related to inproper     restriction of nested VT-x, which allowed a guest to     cause Xen to crash, resulting in a Denial of Service     (DoS). (XSA-278) (bsc#1114405)

  - CVE-2018-15468: Fixed incorrect MSR_DEBUGCTL handling,     which allowed guests to enable Branch Trace Store and     may cause a Denial of Service (DoS) of the entire host.
    (XSA-269) (bsc#1103276)

  - CVE-2018-15469: Fixed use of v2 grant tables on ARM,     which were not properly implemented and may cause a     Denial of Service (DoS). (XSA-268) (bsc#1103275)

  - CVE-2018-15470: Fixed an issue in the logic in     oxenstored for handling writes, which allowed a guest to     write memory unbounded leading to system-wide Denial of     Service (DoS). (XSA-272) (bsc#1103279)

  - CVE-2018-3646: Mitigations for VMM aspects of L1     Terminal Fault (XSA-273) (bsc#1091107)

Other bugs fixed :

  - Fixed an issue related to a domU hang on SLE12-SP3 HV     (bsc#1108940)

  - Fixed an issue with xpti=no-dom0 not working as expected     (bsc#1105528)

  - Fixed a kernel oops related to fs/dcache.c called by     d_materialise_unique() (bsc#1094508)

This update was imported from the SUSE:SLE-15:Update update project.

L1 Terminal Fault speculative side channel patch bundle [XSA-273, CVE-2018-3620, CVE-2018-3646] drop patches also in the bundle, which also includes Use of v2 grant tables may cause crash on ARM [XSA-268] (#1616081) x86: Incorrect MSR_DEBUGCTL handling lets guests enable BTS [XSA-269] (#1616077) oxenstored does not apply quota-maxentity [XSA-272] (#1616080)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

Update to Xen 4.10.2 bug fix release (bsc#1027519).

Security vulnerabilities fixed :

CVE-2018-19961, CVE-2018-19962: Fixed an issue related to insufficient TLB flushing with AMD IOMMUs, which potentially allowed a guest to escalate its privileges, may cause a Denial of Service (DoS) affecting the entire host, or may be able to access data it is not supposed to access. (XSA-275) (bsc#1115040)

CVE-2018-19965: Fixed an issue related to the INVPCID instruction in case non-canonical addresses are accessed, which may allow a guest to cause Xen to crash, resulting in a Denial of Service (DoS) affecting the entire host. (XSA-279) (bsc#1115045)

CVE-2018-19966: Fixed an issue related to a previous fix for XSA-240, which conflicted with shadow paging and allowed a guest to cause Xen to crash, resulting in a Denial of Service (DoS). (XSA-280) (bsc#1115047)

CVE-2018-18883: Fixed an issue related to inproper restriction of nested VT-x, which allowed a guest to cause Xen to crash, resulting in a Denial of Service (DoS). (XSA-278) (bsc#1114405)

CVE-2018-15468: Fixed incorrect MSR_DEBUGCTL handling, which allowed guests to enable Branch Trace Store and may cause a Denial of Service (DoS) of the entire host. (XSA-269) (bsc#1103276)

CVE-2018-15469: Fixed use of v2 grant tables on ARM, which were not properly implemented and may cause a Denial of Service (DoS).
(XSA-268) (bsc#1103275)

CVE-2018-15470: Fixed an issue in the logic in oxenstored for handling writes, which allowed a guest to write memory unbounded leading to system-wide Denial of Service (DoS). (XSA-272) (bsc#1103279)

CVE-2018-3646: Mitigations for VMM aspects of L1 Terminal Fault (XSA-273) (bsc#1091107)

Other bugs fixed: Fixed an issue related to a domU hang on SLE12-SP3 HV (bsc#1108940)

Fixed an issue with xpti=no-dom0 not working as expected (bsc#1105528)

Fixed a kernel oops related to fs/dcache.c called by d_materialise_unique() (bsc#1094508)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0282 for details.

This update for xen fixes the following issues :

XEN was updated to the Xen 4.9.3 bug fix only release (bsc#1027519)

  - CVE-2018-17963: qemu_deliver_packet_iov accepted packet     sizes greater than INT_MAX, which allows attackers to     cause a denial of service or possibly have unspecified     other impact. (bsc#1111014)

  - CVE-2018-15470: oxenstored might not have enforced the     configured quota-maxentity. This allowed a malicious or     buggy guest to write as many xenstore entries as it     wishes, causing unbounded memory usage in oxenstored.
    This can lead to a system-wide DoS. (XSA-272)     (bsc#1103279)

  - CVE-2018-15469: ARM never properly implemented grant     table v2, either in the hypervisor or in Linux.
    Unfortunately, an ARM guest can still request v2 grant     tables; they will simply not be properly set up,     resulting in subsequent grant-related hypercalls hitting     BUG() checks. An unprivileged guest can cause a BUG()     check in the hypervisor, resulting in a     denial-of-service (crash). (XSA-268) (bsc#1103275) Note     that SUSE does not ship ARM Xen, so we are not affected.

  - CVE-2018-15468: The DEBUGCTL MSR contains several     debugging features, some of which virtualise cleanly,     but some do not. In particular, Branch Trace Store is     not virtualised by the processor, and software has to be     careful to configure it suitably not to lock up the     core. As a result, it must only be available to fully     trusted guests. Unfortunately, in the case that vPMU is     disabled, all value checking was skipped, allowing the     guest to choose any MSR_DEBUGCTL setting it likes. A     malicious or buggy guest administrator (on Intel x86 HVM     or PVH) can lock up the entire host, causing a Denial of     Service. (XSA-269) (bsc#1103276)

  - CVE-2018-3646: Systems with microprocessors utilizing     speculative execution and address translations may have     allowed unauthorized disclosure of information residing     in the L1 data cache to an attacker with local user     access with guest OS privilege via a terminal page fault     and a side-channel analysis. (XSA-273) (bsc#1091107)

Non security issues fixed :

  - The affinity reporting via 'xl vcpu-list' was broken     (bsc#1106263)

  - Kernel oops in fs/dcache.c called by     d_materialise_unique() (bsc#1094508)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

The remote host is affected by the vulnerability described in GLSA-201810-06 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       referenced CVE identifiers for details.
  Impact :

    A local attacker could cause a Denial of Service condition or disclose       sensitive information.
  Workaround :

    There is no known workaround at this time.

This update for xen fixes the following issues :

XEN was updated to the Xen 4.9.3 bug fix only release (bsc#1027519)

CVE-2018-17963: qemu_deliver_packet_iov accepted packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. (bsc#1111014)

CVE-2018-15470: oxenstored might not have enforced the configured quota-maxentity. This allowed a malicious or buggy guest to write as many xenstore entries as it wishes, causing unbounded memory usage in oxenstored. This can lead to a system-wide DoS. (XSA-272) (bsc#1103279)

CVE-2018-15469: ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest can still request v2 grant tables; they will simply not be properly set up, resulting in subsequent grant-related hypercalls hitting BUG() checks.
An unprivileged guest can cause a BUG() check in the hypervisor, resulting in a denial-of-service (crash). (XSA-268) (bsc#1103275) Note that SUSE does not ship ARM Xen, so we are not affected.

CVE-2018-15468: The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests.
Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) can lock up the entire host, causing a Denial of Service.
(XSA-269) (bsc#1103276)

CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis. (XSA-273) (bsc#1091107)

Non security issues fixed: The affinity reporting via 'xl vcpu-list' was broken (bsc#1106263)

Kernel oops in fs/dcache.c called by d_materialise_unique() (bsc#1094508)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

CVE-2018-17963: qemu_deliver_packet_iov accepted packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. (bsc#1111014)

CVE-2018-15468: The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests.
Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) could have locked up the entire host, causing a Denial of Service. (XSA-269) (bsc#1103276)

Non security issues fixed: Kernel oops in fs/dcache.c called by d_materialise_unique() (bsc#1094508)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a denial of service vulnerability.

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

ID	Name	Product	Family	Severity
254778	Linux Distros Unpatched Vulnerability : CVE-2018-15468	Nessus	Misc.	medium
424700	Alpine: multiple xen packages: security update to 4.11.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424700	Alpine: multiple xen packages: security update to 4.11.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
407910	Alpine: xen: security update to 4.9.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
407910	Alpine: xen: security update to 4.9.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
407899	Alpine: xen: security update to 4.8.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407899	Alpine: xen: security update to 4.8.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
407738	Alpine: xen: security update to 4.10.1-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
407738	Alpine: xen: security update to 4.10.1-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
140019	OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	critical
123167	openSUSE Security Update : xen (openSUSE-2019-1046) (Foreshadow)	Nessus	SuSE Local Security Checks	high
120490	Fedora 28 : xen (2018-683dfde81a) (Foreshadow)	Nessus	Fedora Local Security Checks	medium
120196	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2018:4300-1) (Foreshadow)	Nessus	SuSE Local Security Checks	high
119951	openSUSE Security Update : xen (openSUSE-2018-1624) (Foreshadow)	Nessus	SuSE Local Security Checks	high
119277	OracleVM 3.4 : xen (OVMSA-2018-0282) (Foreshadow) (Spectre)	Nessus	OracleVM Local Security Checks	medium
118563	openSUSE Security Update : xen (openSUSE-2018-1331) (Foreshadow)	Nessus	SuSE Local Security Checks	critical
118506	GLSA-201810-06 : Xen: Multiple vulnerabilities (Foreshadow) (Meltdown) (Spectre)	Nessus	Gentoo Local Security Checks	critical
118491	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2018:3490-1) (Foreshadow)	Nessus	SuSE Local Security Checks	critical
118351	SUSE SLES12 Security Update : xen (SUSE-SU-2018:3332-1)	Nessus	SuSE Local Security Checks	critical
112234	Fedora 27 : xen (2018-915602df63) (Foreshadow)	Nessus	Fedora Local Security Checks	medium
112157	Xen Project MSR_DEBUGCTL 'Branch Trace Store' DoS (XSA-269)	Nessus	Misc.	medium

Detections

Analytics

CVE-2018-15468

medium

Tenable Plugins

medium

high

high

critical

critical

high

high

critical

critical

critical

high

medium

high

high

medium

critical

critical

critical

critical

medium

medium