An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system, not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices can mount a Denial of Service (DoS) attack affecting the pass through of PCI devices to other guests or the hardware domain. In the latter case, this would affect the entire host.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI
    pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with
    MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the
    MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system,
    not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices
    can mount a Denial of Service (DoS) attack affecting the pass through of PCI devices to other guests or
    the hardware domain. In the latter case, this would affect the entire host. (CVE-2021-3308)

  - An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory
    accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones
    during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the
    operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no
    guarantee when all the writes will reach the memory. (CVE-2021-26933)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI
    pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with
    MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the
    MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system,
    not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices
    can mount a Denial of Service (DoS) attack affecting the pass through of PCI devices to other guests or
    the hardware domain. In the latter case, this would affect the entire host. (CVE-2021-3308)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI
    pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with
    MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the
    MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system,
    not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices
    can mount a Denial of Service (DoS) attack affecting the pass through of PCI devices to other guests or
    the hardware domain. In the latter case, this would affect the entire host. (CVE-2021-3308)

The remote host is affected by the vulnerability described in GLSA-202107-30 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2955-1 advisory.

    Security issues fixed:

    - CVE-2021-28698: long running loops in grant table handling (XSA-380)(bsc#1189378).
    - CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation     (XSA-379)(bsc#1189376).
    - CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373).
    - CVE-2021-28699: inadequate grant-v2 status frames array bounds check (XSA-382)(bsc#1189380).
    - CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling (bsc#1186429)
    - CVE-2021-28690: xen: x86: TSX Async Abort protections not restored after S3 (bsc#1186434)
    - CVE-2021-0089: xen: Speculative Code Store Bypass (bsc#1186433)
    - CVE-2021-20255: Fixed stack overflow via infinite recursion in eepro100 (bsc#1182654)
    - CVE-2021-3592: slirp: invalid pointer initialization may lead to information disclosure     (bootp)(bsc#1187369).
    - CVE-2021-3594: slirp: invalid pointer initialization may lead to information disclosure     (udp)(bsc#1187378).
    - CVE-2021-3595: slirp: invalid pointer initialization may lead to information disclosure     (tftp)(bsc#1187376).
    - CVE-2021-3308: Fixed IRQ vector leak on x86 (XSA-360)(bsc#1181254).

    - Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xen fixes the following issues :

CVE-2020-28368: Intel RAPL sidechannel attack aka PLATYPUS attack (bsc#1178591, XSA-351)

CVE-2021-3308: IRQ vector leak on x86 (bsc#1181254, XSA-360)

CVE-2021-28687: HVM soft-reset crashes toolstack (bsc#1183072, XSA-368)

L3: conring size for XEN HV's with huge memory to small (bsc#1177204).

kdump of HVM fails, soft-reset not handled by libxl (bsc#1179148)

openQA job causes libvirtd to dump core when running kdump inside domain (bsc#1181989).

Upstream bug fixes (bsc#1027519)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a denial of service (DoS) vulnerability. An x86 HVM guest with PCI pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system, not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices can mount a DoS attack affecting the pass through of PCI devices to other guests or the hardware domain. In the latter case, this would affect the entire host.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

This update for xen fixes the following issues :

  - CVE-2021-3308: VUL-0: xen: IRQ vector leak on x86     (bsc#1181254, XSA-360)

  - CVE-2021-28687: HVM soft-reset crashes toolstack     (bsc#1183072, XSA-368)

  - L3: conring size for XEN HV's with huge memory to small.
    Inital Xen logs cut (bsc#1177204)

  - L3: XEN domU crashed on resume when using the xl unpause     command (bsc#1182576)

  - L3: xen: no needsreboot flag set (bsc#1180690)

  - kdump of HVM fails, soft-reset not handled by libxl     (bsc#1179148)

  - openQA job causes libvirtd to dump core when running     kdump inside domain (bsc#1181989)

  - Upstream bug fixes (bsc#1027519)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for xen fixes the following issues :

CVE-2021-3308: VUL-0: xen: IRQ vector leak on x86 (bsc#1181254, XSA-360)

CVE-2021-28687: HVM soft-reset crashes toolstack (bsc#1183072, XSA-368)

L3: conring size for XEN HV's with huge memory to small. Inital Xen logs cut (bsc#1177204)

L3: XEN domU crashed on resume when using the xl unpause command (bsc#1182576)

L3: xen: no needsreboot flag set (bsc#1180690)

kdump of HVM fails, soft-reset not handled by libxl (bsc#1179148)

openQA job causes libvirtd to dump core when running kdump inside domain (bsc#1181989)

Upstream bug fixes (bsc#1027519)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

CVE-2021-3308: VUL-0: xen: IRQ vector leak on x86 (bsc#1181254, XSA-360)

CVE-2021-28687: VUL-0: xen: HVM soft-reset crashes toolstack (bsc#1183072, XSA-368)

CVE-2021-20257: VUL-0: xen: infinite loop issue in the e1000 NIC emulator (bsc#1182846)

CVE-2020-28368: VUL-0: xen: Intel RAPL sidechannel attack aka PLATYPUS attack aka (bsc#1178591, XSA-351)

L3: conring size for XEN HV's with huge memory to small. Inital Xen logs cut (bsc#1177204)

Kdump of HVM fails, soft-reset not handled by libxl (bsc#1179148)

OpenQA job causes libvirtd to dump core when running kdump inside domain (bsc#1181989)

Allow restart of xenwatchdogd, enable tuning of keep-alive interval and timeout options via XENWATCHDOGD_ARGS= (bsc#1178736)

The receiving side did detect holes in a to-be-allocated superpage, but allocated a superpage anyway. This resulted to over-allocation (bsc#1177112)

The receiving side may punch holes incorrectly into optimistically allocated superpages. Also reduce overhead in bitmap handling (bsc#1177112)

Upstream bug fixes (bsc#1027519)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-16c9c40d4d advisory.

  - An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI     pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with     MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the     MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system,     not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices     can mount a Denial of Service (DoS) attack affecting the pass through of PCI devices to other guests or     the hardware domain. In the latter case, this would affect the entire host. (CVE-2021-3308)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
424719	Alpine: multiple xen packages: security update to 4.14.1-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
424719	Alpine: multiple xen packages: security update to 4.14.1-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
407793	Alpine: xen: security update to 4.14.1-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
407793	Alpine: xen: security update to 4.14.1-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
407778	Alpine: xen: security update to 4.13.2-r4	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
407778	Alpine: xen: security update to 4.13.2-r4	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
157004	GLSA-202107-30 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
152991	SUSE SLES12: xen / xen-doc-html / xen-libs / xen-libs-32bit / xen-tools / etc (SUSE-SU-2021:2955-1)	Nessus	SuSE Local Security Checks	high
149227	SUSE SLES15 Security Update : xen (SUSE-SU-2021:1460-1)	Nessus	SuSE Local Security Checks	medium
149086	Xen IRQ Vector Leak DoS (XSA-360)	Nessus	Misc.	medium
148384	openSUSE Security Update : xen (openSUSE-2021-514)	Nessus	SuSE Local Security Checks	medium
148366	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2021:1028-1)	Nessus	SuSE Local Security Checks	medium
148365	SUSE SLES12 Security Update : xen (SUSE-SU-2021:1023-1)	Nessus	SuSE Local Security Checks	medium
145769	Fedora 32 : xen (2021-16c9c40d4d)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2021-3308

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium

medium