An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no guarantee when all the writes will reach the memory.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory     accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones     during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the     operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no     guarantee when all the writes will reach the memory. (CVE-2021-26933)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI
    pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with
    MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the
    MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system,
    not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices
    can mount a Denial of Service (DoS) attack affecting the pass through of PCI devices to other guests or
    the hardware domain. In the latter case, this would affect the entire host. (CVE-2021-3308)

  - An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory
    accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones
    during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the
    operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no
    guarantee when all the writes will reach the memory. (CVE-2021-26933)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Observable response discrepancy in some Intel(R) Processors may allow an authorized user to potentially
    enable information disclosure via local access. (CVE-2021-0089)

  - An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory
    accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones
    during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the
    operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no
    guarantee when all the writes will reach the memory. (CVE-2021-26933)

  - x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort
    speculative security vulnerability. Please see https://xenbits.xen.org/xsa/advisory-305.html for details.
    Mitigating TAA by disabling TSX (the default and preferred option) requires selecting a non-default
    setting in MSR_TSX_CTRL. This setting isn't restored after S3 suspend. (CVE-2021-28690)

  - inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel
    with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous
    notification of the completion of such commands is not used. Instead, the issuing CPU spin-waits for the
    completion of the most recently issued command(s). Some of these waiting loops try to apply a timeout to
    fail overly-slow commands. The course of action upon a perceived timeout actually being detected is
    inappropriate: - on Intel hardware guests which did not originally cause the timeout may be marked as
    crashed, - on AMD hardware higher layer callers would not be notified of the issue, making them continue
    as if the IOMMU operation succeeded. (CVE-2021-28692)

  - xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...)
    in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not
    leaked from the modules, Xen must "scrub" them before handing the page over to the allocator.
    Unfortunately, it was discovered that modules will not be scrubbed on Arm. (CVE-2021-28693)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory
    accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones
    during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the
    operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no
    guarantee when all the writes will reach the memory. (CVE-2021-26933)

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, privilege escalation or memory disclosure.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-47f53a940a advisory.

  - An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory     accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones     during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the     operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no     guarantee when all the writes will reach the memory. (CVE-2021-26933)

  - An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation     (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this     wasn't stated accordingly in its support status entry. (CVE-2021-26934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-4c819bf1ad advisory.

  - An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory     accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones     during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the     operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no     guarantee when all the writes will reach the memory. (CVE-2021-26933)

  - An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation     (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this     wasn't stated accordingly in its support status entry. (CVE-2021-26934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an information disclosure vulnerability. On Arm, a guest is allowed to control whether memory access bypass the cache. This means that Xen needs to ensure that all writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Unfortunately the operation to clean the cache happens before checking if the page was scrubbed. Therefore there is no guarantee when all the writes will reach the memory. A malicious guest may be able to read sensitive data from memory that previously belonged to another guest.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

ID	Name	Product	Family	Severity
256974	Linux Distros Unpatched Vulnerability : CVE-2021-26933	Nessus	Misc.	medium
424719	Alpine: multiple xen packages: security update to 4.14.1-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
424719	Alpine: multiple xen packages: security update to 4.14.1-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
424702	Alpine: multiple xen packages: security update to 4.14.1-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424702	Alpine: multiple xen packages: security update to 4.14.1-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
407779	Alpine: xen: security update to 4.13.2-r5	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
407779	Alpine: xen: security update to 4.13.2-r5	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400263	Alpine: multiple xen packages: security update to 4.14.1-r2 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400263	Alpine: multiple xen packages: security update to 4.14.1-r2 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
148444	Debian DSA-4888-1 : xen - security update	Nessus	Debian Local Security Checks	high
146913	Fedora 33 : xen (2021-47f53a940a)	Nessus	Fedora Local Security Checks	high
146901	Fedora 32 : xen (2021-4c819bf1ad)	Nessus	Fedora Local Security Checks	high
146596	Xen Scrubbed Pages Cache Information Disclosure (XSA-364)	Nessus	Misc.	medium

Detections

Analytics

CVE-2021-26933

medium

Tenable Plugins

medium

medium

medium

high

high

medium

medium

medium

medium

high

high

high

medium