An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service
    or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB
    flushes. (CVE-2019-17346)

  - An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or
    gain privileges because grant-table transfer requests are mishandled. (CVE-2019-17340)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service
    or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI
    device. (CVE-2019-17341)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service
    or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains. (CVE-2019-17343)

  - An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of
    service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed
    guest. (CVE-2019-17345)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of     service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed     guest. (CVE-2019-17345)

Note that Nessus relies on the presence of the package as reported by the vendor.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks.

In addition this update provides mitigations for the 'TSX Asynchronous Abort'speculative side channel attack. For additional information please refer to https://xenbits.xen.org/xsa/advisory-305.html

This update for xen fixes the following issues :

Security issues fixed :

CVE-2019-15890: Fixed a use-after-free in SLiRP networking implementation of QEMU emulator which could have led to Denial of Service (bsc#1149813).

CVE-2019-12068: Fixed an issue in lsi which could lead to an infinite loop and denial of service (bsc#1146874).

CVE-2019-14378: Fixed a heap buffer overflow in SLiRp networking implementation of QEMU emulator which could have led to execution of arbitrary code with privileges of the QEMU process (bsc#1143797).

Other issue fixed: Fixed an issue where libxenlight could not restore domain vsa6535522 on live migration (bsc#1133818).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.11.2 fixes the following issues :

Security issues fixed :

CVE-2019-15890: Fixed a use-after-free in SLiRP networking implementation of QEMU emulator which could have led to Denial of Service (bsc#1149813).

CVE-2019-12068: Fixed an issue in lsi which could lead to an infinite loop and denial of service (bsc#1146874).

CVE-2019-14378: Fixed a heap buffer overflow in SLiRp networking implementation of QEMU emulator which could have led to execution of arbitrary code with privileges of the QEMU process (bsc#1143797).

Other issues fixed: Fixed an HPS bug which did not allow to install Windows Server 2016 with 2 CPUs setting or above (bsc#1137717).

Fixed a segmentation fault in Libvrtd during live migration to a VM (bsc#1145774).

Fixed an issue where libxenlight could not create new domain (bsc#1131811).

Fixed an issue where attached pci devices were lost after reboot (bsc#1129642).

Fixed an issue where Xen could not pre-allocate 1 shadow page (bsc#1145240).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a denial of service vulnerability. Only x86 systems are affected.

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

ID	Name	Product	Family	Severity
435815	Alpine: xen: security update to 4.11.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
435815	Alpine: xen: security update to 4.11.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
257382	Linux Distros Unpatched Vulnerability : CVE-2019-17345	Nessus	Misc.	medium
407748	Alpine: xen: security update to 4.11.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407748	Alpine: xen: security update to 4.11.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
132875	Debian DSA-4602-1 : xen - security update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Debian Local Security Checks	critical
130253	SUSE SLES12 Security Update : xen (SUSE-SU-2019:2769-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	high
130197	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2019:2753-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	high
122874	Xen Project PCI Pass-through Device Denial of Service Vulnerability (XSA-291)	Nessus	Misc.	medium

Detections

Analytics

CVE-2019-17345

medium

Tenable Plugins

high

high

medium

high

high

critical

high

high

medium