FreeBSD : xen-tools -- Potential unintended writes to host MSI message data field via qemu (af38cfec-27e7-11e5-a4a5-002590263bf5)

This script is Copyright (C) 2015 Tenable Network Security, Inc.


Synopsis :

The remote FreeBSD host is missing a security-related update.

Description :

The Xen Project reports :

Logic is in place to avoid writes to certain host config space fields
when the guest must nevertheless be able to access their virtual
counterparts. A bug in how this logic deals with accesses spanning
multiple fields allows the guest to write to the host MSI message data
field.

While generally the writes write back the values previously read,
their value in config space may have got changed by the host between
the qemu read and write. In such a case host side interrupt handling
could become confused, possibly losing interrupts or allowing spurious
interrupt injection into other guests.

Certain untrusted guest administrators may be able to confuse host
side interrupt handling, leading to a Denial of Service.

See also :

http://xenbits.xen.org/xsa/advisory-128.html
http://www.nessus.org/u?a2cef002

Solution :

Update the affected package.

Risk factor :

Medium / CVSS Base Score : 4.9
(CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)

Family: FreeBSD Local Security Checks

Nessus Plugin ID: 84711 ()

Bugtraq ID:

CVE ID: CVE-2015-4103

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now