x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not architecturally protect ring 0 from predictions learnt in ring 1. For more details, see: https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-speculation Similar situations may exist with other mitigations for other kinds of speculative execution attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to be discovered, disclosed, or mitigated.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4241-1 advisory.

  - x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in     ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is     why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In     AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit     guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for     virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect     Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative     execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For     more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not     architecturally protect ring 0 from predictions learnt in ring 1. For more details, see:
    https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-     speculation Similar situations may exist with other mitigations for other kinds of speculative execution     attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to     be discovered, disclosed, or mitigated. (CVE-2021-28689)

  - P2M pool freeing may take excessively long The P2M pool backing second level address translation for     guests may be of significant size. Therefore its freeing may take more time than is reasonable without     intermediate preemption checks. Such checking for the need to preempt was so far missing. (CVE-2022-33746)

  - lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was     inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a     result two cooperating guests granting each other transitive grants can cause locks to be acquired nested     within one another, but in respectively opposite order. With suitable timing between the involved grant     copy operations this may result in the locking up of a CPU. (CVE-2022-33748)

  - Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause     xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored     or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by     the guest e.g. by exceeding the quota value of maximum nodes per domain. (CVE-2022-42309)

  - Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction     resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the     cleanup after the error will not remove all nodes already created. When the transaction is committed after     this situation, nodes without a valid parent can be made permanent in the data base. (CVE-2022-42310)

  - Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple     CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause     xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of     xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by     issuing new requests to xenstored without reading the responses, causing the responses to be buffered in     memory - - by causing large number of watch events to be generated via setting up multiple xenstore     watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as     allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing     many nodes inside a transaction (CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314,     CVE-2022-42315, CVE-2022-42316, CVE-2022-42317, CVE-2022-42318)

  - Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest,     xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only     after the request has been finished completely. A request is regarded to be finished only after the guest     has read the response message of the request from the ring page. Thus a guest not reading the response can     cause xenstored to not free the temporary memory. This can result in memory shortages causing Denial of     Service (DoS) of xenstored. (CVE-2022-42319)

  - Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are     per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the     domid of the removed domain. This is normally no problem, as those access right entries will be corrected     when such a node is written later. There is a small time window when a new domain is created, where the     access rights of a past domain with the same domid as the new one will be regarded to be still valid,     leading to the new domain being able to get access to a node which was meant to be accessible by the     removed domain. For this to happen another domain needs to write the node before the newly created domain     is being introduced to Xenstore by dom0. (CVE-2022-42320)

  - Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some     Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With sufficiently deep nesting     levels this can result in stack exhaustion on xenstored, leading to a crash of xenstored. (CVE-2022-42321)

  - Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of     XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow     two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by     domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes     and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and     over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by     Xenstore quota. (CVE-2022-42322, CVE-2022-42323)

  - Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record     relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In     case a node has been created in a transaction and it is later deleted in the same transaction, the     transaction will be terminated with an error. As this error is encountered only when handling the deleted     node at transaction finalization, the transaction will have been performed partially and without updating     the accounting information. This will enable a malicious guest to create arbitrary number of nodes.
    (CVE-2022-42325, CVE-2022-42326)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4051-1 advisory.

  - x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in     ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is     why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In     AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit     guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for     virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect     Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative     execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For     more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not     architecturally protect ring 0 from predictions learnt in ring 1. For more details, see:
    https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-     speculation Similar situations may exist with other mitigations for other kinds of speculative execution     attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to     be discovered, disclosed, or mitigated. (CVE-2021-28689)

  - P2M pool freeing may take excessively long The P2M pool backing second level address translation for     guests may be of significant size. Therefore its freeing may take more time than is reasonable without     intermediate preemption checks. Such checking for the need to preempt was so far missing. (CVE-2022-33746)

  - lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was     inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a     result two cooperating guests granting each other transitive grants can cause locks to be acquired nested     within one another, but in respectively opposite order. With suitable timing between the involved grant     copy operations this may result in the locking up of a CPU. (CVE-2022-33748)

  - Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause     xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored     or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by     the guest e.g. by exceeding the quota value of maximum nodes per domain. (CVE-2022-42309)

  - Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction     resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the     cleanup after the error will not remove all nodes already created. When the transaction is committed after     this situation, nodes without a valid parent can be made permanent in the data base. (CVE-2022-42310)

  - Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple     CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause     xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of     xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by     issuing new requests to xenstored without reading the responses, causing the responses to be buffered in     memory - - by causing large number of watch events to be generated via setting up multiple xenstore     watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as     allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing     many nodes inside a transaction (CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314,     CVE-2022-42315, CVE-2022-42316, CVE-2022-42317, CVE-2022-42318)

  - Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are     per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the     domid of the removed domain. This is normally no problem, as those access right entries will be corrected     when such a node is written later. There is a small time window when a new domain is created, where the     access rights of a past domain with the same domid as the new one will be regarded to be still valid,     leading to the new domain being able to get access to a node which was meant to be accessible by the     removed domain. For this to happen another domain needs to write the node before the newly created domain     is being introduced to Xenstore by dom0. (CVE-2022-42320)

  - Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some     Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With sufficiently deep nesting     levels this can result in stack exhaustion on xenstored, leading to a crash of xenstored. (CVE-2022-42321)

  - Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of     XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow     two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by     domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes     and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and     over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by     Xenstore quota. (CVE-2022-42322, CVE-2022-42323)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3971-1 advisory.

  - x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in     ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is     why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In     AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit     guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for     virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect     Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative     execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For     more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not     architecturally protect ring 0 from predictions learnt in ring 1. For more details, see:
    https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-     speculation Similar situations may exist with other mitigations for other kinds of speculative execution     attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to     be discovered, disclosed, or mitigated. (CVE-2021-28689)

  - P2M pool freeing may take excessively long The P2M pool backing second level address translation for     guests may be of significant size. Therefore its freeing may take more time than is reasonable without     intermediate preemption checks. Such checking for the need to preempt was so far missing. (CVE-2022-33746)

  - lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was     inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a     result two cooperating guests granting each other transitive grants can cause locks to be acquired nested     within one another, but in respectively opposite order. With suitable timing between the involved grant     copy operations this may result in the locking up of a CPU. (CVE-2022-33748)

  - Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause     xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored     or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by     the guest e.g. by exceeding the quota value of maximum nodes per domain. (CVE-2022-42309)

  - Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction     resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the     cleanup after the error will not remove all nodes already created. When the transaction is committed after     this situation, nodes without a valid parent can be made permanent in the data base. (CVE-2022-42310)

  - Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple     CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause     xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of     xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by     issuing new requests to xenstored without reading the responses, causing the responses to be buffered in     memory - - by causing large number of watch events to be generated via setting up multiple xenstore     watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as     allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing     many nodes inside a transaction (CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314,     CVE-2022-42315, CVE-2022-42316, CVE-2022-42317, CVE-2022-42318)

  - Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest,     xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only     after the request has been finished completely. A request is regarded to be finished only after the guest     has read the response message of the request from the ring page. Thus a guest not reading the response can     cause xenstored to not free the temporary memory. This can result in memory shortages causing Denial of     Service (DoS) of xenstored. (CVE-2022-42319)

  - Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are     per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the     domid of the removed domain. This is normally no problem, as those access right entries will be corrected     when such a node is written later. There is a small time window when a new domain is created, where the     access rights of a past domain with the same domid as the new one will be regarded to be still valid,     leading to the new domain being able to get access to a node which was meant to be accessible by the     removed domain. For this to happen another domain needs to write the node before the newly created domain     is being introduced to Xenstore by dom0. (CVE-2022-42320)

  - Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some     Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With sufficiently deep nesting     levels this can result in stack exhaustion on xenstored, leading to a crash of xenstored. (CVE-2022-42321)

  - Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of     XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow     two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by     domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes     and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and     over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by     Xenstore quota. (CVE-2022-42322, CVE-2022-42323)

  - Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record     relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In     case a node has been created in a transaction and it is later deleted in the same transaction, the     transaction will be terminated with an error. As this error is encountered only when handling the deleted     node at transaction finalization, the transaction will have been performed partially and without updating     the accounting information. This will enable a malicious guest to create arbitrary number of nodes.
    (CVE-2022-42325, CVE-2022-42326)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3928-1 advisory.

  - x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in     ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is     why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In     AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit     guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for     virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect     Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative     execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For     more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not     architecturally protect ring 0 from predictions learnt in ring 1. For more details, see:
    https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-     speculation Similar situations may exist with other mitigations for other kinds of speculative execution     attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to     be discovered, disclosed, or mitigated. (CVE-2021-28689)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - P2M pool freeing may take excessively long The P2M pool backing second level address translation for     guests may be of significant size. Therefore its freeing may take more time than is reasonable without     intermediate preemption checks. Such checking for the need to preempt was so far missing. (CVE-2022-33746)

  - lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was     inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a     result two cooperating guests granting each other transitive grants can cause locks to be acquired nested     within one another, but in respectively opposite order. With suitable timing between the involved grant     copy operations this may result in the locking up of a CPU. (CVE-2022-33748)

  - Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause     xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored     or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by     the guest e.g. by exceeding the quota value of maximum nodes per domain. (CVE-2022-42309)

  - Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction     resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the     cleanup after the error will not remove all nodes already created. When the transaction is committed after     this situation, nodes without a valid parent can be made permanent in the data base. (CVE-2022-42310)

  - Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple     CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause     xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of     xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by     issuing new requests to xenstored without reading the responses, causing the responses to be buffered in     memory - - by causing large number of watch events to be generated via setting up multiple xenstore     watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as     allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing     many nodes inside a transaction (CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314,     CVE-2022-42315, CVE-2022-42316, CVE-2022-42317, CVE-2022-42318)

  - Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest,     xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only     after the request has been finished completely. A request is regarded to be finished only after the guest     has read the response message of the request from the ring page. Thus a guest not reading the response can     cause xenstored to not free the temporary memory. This can result in memory shortages causing Denial of     Service (DoS) of xenstored. (CVE-2022-42319)

  - Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are     per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the     domid of the removed domain. This is normally no problem, as those access right entries will be corrected     when such a node is written later. There is a small time window when a new domain is created, where the     access rights of a past domain with the same domid as the new one will be regarded to be still valid,     leading to the new domain being able to get access to a node which was meant to be accessible by the     removed domain. For this to happen another domain needs to write the node before the newly created domain     is being introduced to Xenstore by dom0. (CVE-2022-42320)

  - Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some     Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With sufficiently deep nesting     levels this can result in stack exhaustion on xenstored, leading to a crash of xenstored. (CVE-2022-42321)

  - Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of     XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow     two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by     domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes     and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and     over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by     Xenstore quota. (CVE-2022-42322, CVE-2022-42323)

  - Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record     relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In     case a node has been created in a transaction and it is later deleted in the same transaction, the     transaction will be terminated with an error. As this error is encountered only when handling the deleted     node at transaction finalization, the transaction will have been performed partially and without updating     the accounting information. This will enable a malicious guest to create arbitrary number of nodes.
    (CVE-2022-42325, CVE-2022-42326)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3925-1 advisory.

  - x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in     ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is     why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In     AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit     guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for     virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect     Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative     execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For     more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not     architecturally protect ring 0 from predictions learnt in ring 1. For more details, see:
    https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-     speculation Similar situations may exist with other mitigations for other kinds of speculative execution     attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to     be discovered, disclosed, or mitigated. (CVE-2021-28689)

  - P2M pool freeing may take excessively long The P2M pool backing second level address translation for     guests may be of significant size. Therefore its freeing may take more time than is reasonable without     intermediate preemption checks. Such checking for the need to preempt was so far missing. (CVE-2022-33746)

  - lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was     inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a     result two cooperating guests granting each other transitive grants can cause locks to be acquired nested     within one another, but in respectively opposite order. With suitable timing between the involved grant     copy operations this may result in the locking up of a CPU. (CVE-2022-33748)

  - Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause     xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored     or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by     the guest e.g. by exceeding the quota value of maximum nodes per domain. (CVE-2022-42309)

  - Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction     resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the     cleanup after the error will not remove all nodes already created. When the transaction is committed after     this situation, nodes without a valid parent can be made permanent in the data base. (CVE-2022-42310)

  - Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple     CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause     xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of     xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by     issuing new requests to xenstored without reading the responses, causing the responses to be buffered in     memory - - by causing large number of watch events to be generated via setting up multiple xenstore     watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as     allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing     many nodes inside a transaction (CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314,     CVE-2022-42315, CVE-2022-42316, CVE-2022-42317, CVE-2022-42318)

  - Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest,     xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only     after the request has been finished completely. A request is regarded to be finished only after the guest     has read the response message of the request from the ring page. Thus a guest not reading the response can     cause xenstored to not free the temporary memory. This can result in memory shortages causing Denial of     Service (DoS) of xenstored. (CVE-2022-42319)

  - Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are     per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the     domid of the removed domain. This is normally no problem, as those access right entries will be corrected     when such a node is written later. There is a small time window when a new domain is created, where the     access rights of a past domain with the same domid as the new one will be regarded to be still valid,     leading to the new domain being able to get access to a node which was meant to be accessible by the     removed domain. For this to happen another domain needs to write the node before the newly created domain     is being introduced to Xenstore by dom0. (CVE-2022-42320)

  - Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some     Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With sufficiently deep nesting     levels this can result in stack exhaustion on xenstored, leading to a crash of xenstored. (CVE-2022-42321)

  - Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of     XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow     two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by     domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes     and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and     over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by     Xenstore quota. (CVE-2022-42322, CVE-2022-42323)

  - Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record     relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In     case a node has been created in a transaction and it is later deleted in the same transaction, the     transaction will be terminated with an error. As this error is encountered only when handling the deleted     node at transaction finalization, the transaction will have been performed partially and without updating     the accounting information. This will enable a malicious guest to create arbitrary number of nodes.
    (CVE-2022-42325, CVE-2022-42326)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3728-1 advisory.

  - x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in     ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is     why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In     AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit     guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for     virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect     Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative     execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For     more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not     architecturally protect ring 0 from predictions learnt in ring 1. For more details, see:
    https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-     speculation Similar situations may exist with other mitigations for other kinds of speculative execution     attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to     be discovered, disclosed, or mitigated. (CVE-2021-28689)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - P2M pool freeing may take excessively long The P2M pool backing second level address translation for     guests may be of significant size. Therefore its freeing may take more time than is reasonable without     intermediate preemption checks. Such checking for the need to preempt was so far missing. (CVE-2022-33746)

  - lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was     inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a     result two cooperating guests granting each other transitive grants can cause locks to be acquired nested     within one another, but in respectively opposite order. With suitable timing between the involved grant     copy operations this may result in the locking up of a CPU. (CVE-2022-33748)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3665-1 advisory.

  - x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in     ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is     why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In     AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit     guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for     virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect     Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative     execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For     more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not     architecturally protect ring 0 from predictions learnt in ring 1. For more details, see:
    https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-     speculation Similar situations may exist with other mitigations for other kinds of speculative execution     attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to     be discovered, disclosed, or mitigated. (CVE-2021-28689)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels     unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. To address XSA-401, code was     moved inside a function in Xen. This code movement missed a variable changing meaning / value between old     and new code positions. The now wrong use of the variable did lead to a wrong TLB flush condition,     omitting flushes where such are necessary. (CVE-2022-33745)

  - P2M pool freeing may take excessively long The P2M pool backing second level address translation for     guests may be of significant size. Therefore its freeing may take more time than is reasonable without     intermediate preemption checks. Such checking for the need to preempt was so far missing. (CVE-2022-33746)

  - lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was     inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a     result two cooperating guests granting each other transitive grants can cause locks to be acquired nested     within one another, but in respectively opposite order. With suitable timing between the involved grant     copy operations this may result in the locking up of a CPU. (CVE-2022-33748)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xen fixes the following issues :

Security issue fixed :

CVE-2021-28689: Fixed some x86 speculative vulnerabilities with bare (non-shim) 32-bit PV guests (XSA-370) (bsc#1185104)

Make sure xencommons is in a format as expected by fillup.
(bsc#1185682)

Each comment needs to be followed by an enabled key. Otherwise fillup will remove manually enabled key=value pairs, along with everything that looks like a stale comment, during next pkg update

A recent systemd update caused a regression in xenstored.service systemd now fails to track units that use systemd-notify (bsc#1183790)

Added a delay between the call to systemd-notify and the final exit of the wrapper script (bsc#1185021, bsc#1185196)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
168242	SUSE SLES12 Security Update : xen (SUSE-SU-2022:4241-1)	Nessus	SuSE Local Security Checks	high
167932	SUSE SLES12 Security Update : xen (SUSE-SU-2022:4051-1)	Nessus	SuSE Local Security Checks	high
167515	SUSE SLES15 Security Update : xen (SUSE-SU-2022:3971-1)	Nessus	SuSE Local Security Checks	high
167337	SUSE SLES15 Security Update : xen (SUSE-SU-2022:3928-1)	Nessus	SuSE Local Security Checks	high
167242	SUSE SLES15 Security Update : xen (SUSE-SU-2022:3925-1)	Nessus	SuSE Local Security Checks	high
166529	SUSE SLES12 Security Update : xen (SUSE-SU-2022:3728-1)	Nessus	SuSE Local Security Checks	high
166301	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2022:3665-1)	Nessus	SuSE Local Security Checks	high
149801	SUSE SLES12 Security Update : xen (SUSE-SU-2021:1648-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2021-28689

medium

Tenable Plugins

high

high

high

high

high

high

high

medium