An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl or StoreExcl operation.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service
    or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB
    flushes. (CVE-2019-17346)

  - An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or
    gain privileges because grant-table transfer requests are mishandled. (CVE-2019-17340)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service
    or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI
    device. (CVE-2019-17341)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service
    or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains. (CVE-2019-17343)

  - An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of
    service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed
    guest. (CVE-2019-17345)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service     (infinite loop) involving a LoadExcl or StoreExcl operation. (CVE-2019-17349)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service
    (infinite loop) involving a LoadExcl or StoreExcl operation. (CVE-2019-17349)

  - An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service
    (infinite loop) involving a compare-and-exchange operation. (CVE-2019-17350)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by multiple denial of service (DoS) vulnerabilities :

  - A denial of service (DoS) vulnerability exists in the LoadExcl and StoreExcl operations due to a possible     infinite loop. An unauthenticated, local attacker can exploit this issue, by accessing a memory region     shared with the hypervisor while the hypervisor is performing an atomic operation on the same region, to     cause the system to stop responding. (CVE-2019-17349)

  - A denial of service (DoS) vulnerability exists in the compare-and-exchange operation due to a possible     infinite loop. An unauthenticated, local attacker can exploit this issue, by accessing a memory region     shared with the hypervisor while the hypervisor is performing an atomic operation on the same region, to     cause the system to stop responding. (CVE-2019-17350)

Only Arm processors are affected by these vulnerabilities. x86 processors are not vulnerable.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks.

In addition this update provides mitigations for the 'TSX Asynchronous Abort'speculative side channel attack. For additional information please refer to https://xenbits.xen.org/xsa/advisory-305.html

ID	Name	Product	Family	Severity
435815	Alpine: xen: security update to 4.11.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
435815	Alpine: xen: security update to 4.11.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
259640	Linux Distros Unpatched Vulnerability : CVE-2019-17349	Nessus	Misc.	medium
424703	Alpine: multiple xen packages: security update to 4.12.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
424703	Alpine: multiple xen packages: security update to 4.12.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
407748	Alpine: xen: security update to 4.11.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407748	Alpine: xen: security update to 4.11.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
135292	Xen Project Denial of Service (XSA-295)	Nessus	Misc.	medium
132875	Debian DSA-4602-1 : xen - security update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-17349

medium

Tenable Plugins

high

high

medium

medium

medium

high

high

medium

critical