OracleVM 3.1 : xen (OVMSA-2014-0002)

This script is Copyright (C) 2014-2017 Tenable Network Security, Inc.


Synopsis :

The remote OracleVM host is missing one or more security updates.

Description :

The remote OracleVM system is missing necessary patches to address
critical security updates :

- flask: restrict allocations done by hypercall interface
Other than in 4.2 and newer, we're not having an
overflow issue here, but uncontrolled exposure of the
operations opens the host to be driven out of memory by
an arbitrary guest. Since all operations other than
FLASK_LOAD simply deal with ASCII strings, limiting the
allocations (and incoming buffer sizes) to a page worth
of memory seems like the best thing we can do.
Consequently, in order to not expose the larger
allocation to arbitrary guests, the permission check for
FLASK_LOAD needs to be pulled ahead of the allocation
(and it's perhaps worth noting that - afaict - it was
pointlessly done with the sel_sem spin lock held). Note
that this breaks FLASK_AVC_CACHESTATS on systems with
sufficiently many CPUs (as requiring a buffer bigger
than PAGE_SIZE there). No attempt is made to address
this here, as it would needlessly complicate this fix
with rather little gain. This is XSA-84.

The index of boolean variables in FLASK_[GET,SET]BOOL
was not always checked against the bounds of the array.

18205387] (CVE-2014-1892, CVE-2014-1893)

- libxc: Fix out-of-memory error handling in
xc_cpupool_getinfo Avoid freeing info then returning it
to the caller. This is XSA-88. Coverity-ID: 1056192

18206144] [CVE-2014-XXXX]

See also :

http://www.nessus.org/u?07271db1

Solution :

Update the affected xen / xen-devel / xen-tools packages.

Risk factor :

Medium / CVSS Base Score : 5.2
(CVSS2#AV:A/AC:M/Au:S/C:N/I:N/A:C)
CVSS Temporal Score : 4.5
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false

Family: OracleVM Local Security Checks

Nessus Plugin ID: 79530 ()

Bugtraq ID: 65419

CVE ID: CVE-2014-1892
CVE-2014-1893

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now