HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline, but not all of them. When the "soft reset" feature was implemented, the libxl__domain_suspend_state structure didn't require any initialization or disposal. At some point later, an initialization function was introduced for the structure; but the "soft reset" path wasn't refactored to call the initialization function. When a guest nwo initiates a "soft reboot", uninitialized data structure leads to an assert() when later code finds the structure in an unexpected state. The effect of this is to crash the process monitoring the guest. How this affects the system depends on the structure of the toolstack. For xl, this will have no security-relevant effect: every VM has its own independent monitoring process, which contains no state. The domain in question will hang in a crashed state, but can be destroyed by `xl destroy` just like any other non-cooperating domain. For daemon-based toolstacks linked against libxl, such as libvirt, this will crash the toolstack, losing the state of any in-progress operations (localized DoS), and preventing further administrator operations unless the daemon is configured to restart automatically (system-wide DoS). If crashes "leak" resources, then repeated crashes could use up resources, also causing a system-wide DoS.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to
    be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal
    data structures also require this initialize / dispose discipline, but not all of them. When the "soft
    reset" feature was implemented, the libxl__domain_suspend_state structure didn't require any
    initialization or disposal. At some point later, an initialization function was introduced for the
    structure; but the "soft reset" path wasn't refactored to call the initialization function. When a guest
    nwo initiates a "soft reboot", uninitialized data structure leads to an assert() when later code finds the
    structure in an unexpected state. The effect of this is to crash the process monitoring the guest. How
    this affects the system depends on the structure of the toolstack. For xl, this will have no security-
    relevant effect: every VM has its own independent monitoring process, which contains no state. The domain
    in question will hang in a crashed state, but can be destroyed by `xl destroy` just like any other non-
    cooperating domain. For daemon-based toolstacks linked against libxl, such as libvirt, this will crash the
    toolstack, losing the state of any in-progress operations (localized DoS), and preventing further
    administrator operations unless the daemon is configured to restart automatically (system-wide DoS). If
    crashes "leak" resources, then repeated crashes could use up resources, also causing a system-wide DoS.
    (CVE-2021-28687)

The remote host is affected by the vulnerability described in GLSA-202107-30 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for xen fixes the following issues :

CVE-2020-28368: Intel RAPL sidechannel attack aka PLATYPUS attack (bsc#1178591, XSA-351)

CVE-2021-3308: IRQ vector leak on x86 (bsc#1181254, XSA-360)

CVE-2021-28687: HVM soft-reset crashes toolstack (bsc#1183072, XSA-368)

L3: conring size for XEN HV's with huge memory to small (bsc#1177204).

kdump of HVM fails, soft-reset not handled by libxl (bsc#1179148)

openQA job causes libvirtd to dump core when running kdump inside domain (bsc#1181989).

Upstream bug fixes (bsc#1027519)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

  - CVE-2021-3308: VUL-0: xen: IRQ vector leak on x86     (bsc#1181254, XSA-360)

  - CVE-2021-28687: HVM soft-reset crashes toolstack     (bsc#1183072, XSA-368)

  - L3: conring size for XEN HV's with huge memory to small.
    Inital Xen logs cut (bsc#1177204)

  - L3: XEN domU crashed on resume when using the xl unpause     command (bsc#1182576)

  - L3: xen: no needsreboot flag set (bsc#1180690)

  - kdump of HVM fails, soft-reset not handled by libxl     (bsc#1179148)

  - openQA job causes libvirtd to dump core when running     kdump inside domain (bsc#1181989)

  - Upstream bug fixes (bsc#1027519)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for xen fixes the following issues :

CVE-2021-3308: VUL-0: xen: IRQ vector leak on x86 (bsc#1181254, XSA-360)

CVE-2021-28687: HVM soft-reset crashes toolstack (bsc#1183072, XSA-368)

L3: conring size for XEN HV's with huge memory to small. Inital Xen logs cut (bsc#1177204)

L3: XEN domU crashed on resume when using the xl unpause command (bsc#1182576)

L3: xen: no needsreboot flag set (bsc#1180690)

kdump of HVM fails, soft-reset not handled by libxl (bsc#1179148)

openQA job causes libvirtd to dump core when running kdump inside domain (bsc#1181989)

Upstream bug fixes (bsc#1027519)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

CVE-2021-3308: VUL-0: xen: IRQ vector leak on x86 (bsc#1181254, XSA-360)

CVE-2021-28687: VUL-0: xen: HVM soft-reset crashes toolstack (bsc#1183072, XSA-368)

CVE-2021-20257: VUL-0: xen: infinite loop issue in the e1000 NIC emulator (bsc#1182846)

CVE-2020-28368: VUL-0: xen: Intel RAPL sidechannel attack aka PLATYPUS attack aka (bsc#1178591, XSA-351)

L3: conring size for XEN HV's with huge memory to small. Inital Xen logs cut (bsc#1177204)

Kdump of HVM fails, soft-reset not handled by libxl (bsc#1179148)

OpenQA job causes libvirtd to dump core when running kdump inside domain (bsc#1181989)

Allow restart of xenwatchdogd, enable tuning of keep-alive interval and timeout options via XENWATCHDOGD_ARGS= (bsc#1178736)

The receiving side did detect holes in a to-be-allocated superpage, but allocated a superpage anyway. This resulted to over-allocation (bsc#1177112)

The receiving side may punch holes incorrectly into optimistically allocated superpages. Also reduce overhead in bitmap handling (bsc#1177112)

Upstream bug fixes (bsc#1027519)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-0b784a4d02 advisory.

  - HVM soft-reset crashes toolstack (XSA-368) (CVE-2021-28687)

  - HVM soft-reset crashes toolstack (XSA-368) [fedora-all] (CVE-2021-28687)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-a468f36bbe advisory.

  - HVM soft-reset crashes toolstack (XSA-368) (CVE-2021-28687)

  - HVM soft-reset crashes toolstack (XSA-368) [fedora-all] (CVE-2021-28687)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
424721	Alpine: multiple xen packages: security update to 4.15.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
424721	Alpine: multiple xen packages: security update to 4.15.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
407780	Alpine: xen: security update to 4.13.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
407780	Alpine: xen: security update to 4.13.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
157004	GLSA-202107-30 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
149227	SUSE SLES15 Security Update : xen (SUSE-SU-2021:1460-1)	Nessus	SuSE Local Security Checks	medium
148384	openSUSE Security Update : xen (openSUSE-2021-514)	Nessus	SuSE Local Security Checks	medium
148366	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2021:1028-1)	Nessus	SuSE Local Security Checks	medium
148365	SUSE SLES12 Security Update : xen (SUSE-SU-2021:1023-1)	Nessus	SuSE Local Security Checks	medium
148202	Fedora 33 : xen (2021-0b784a4d02)	Nessus	Fedora Local Security Checks	medium
148199	Fedora 32 : xen (2021-a468f36bbe)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2021-28687

medium

Tenable Plugins

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium