OracleVM 3.2 : xen (OVMSA-2016-0090)

This script is Copyright (C) 2016-2017 Tenable Network Security, Inc.


Synopsis :

The remote OracleVM host is missing one or more security updates.

Description :

The remote OracleVM system is missing necessary patches to address
critical security updates :

- x86/HVM: correct CPUID leaf 80000008 handling - 6c733e54
xsa173_01_0001-x86-HVM-correct-CPUID-leaf-80000008-handl
ing.patch was based on upstream commit:
ef437690af8b75e6758dce77af75a22b63982883 x86/HVM:
correct CPUID leaf 80000008 handling It should have been
based on upstream commit:
6c733e549889a9b8c4e03140348b8e00241d4ce9 x86/HVM:
correct CPUID leaf 80000008 handling The changes in this
patch are the differences between those two patches.

- x86/pv: Remove unsafe bits from the mod_l?_entry
fastpath All changes in writeability and cacheability
must go through full re-validation. Rework the logic as
a whitelist, to make it clearer to follow. This is
XSA-182

Upstream commit 798c1498f764bfaa7b0b955bab40b01b0610d372
Conflicts: xen/include/asm-x86/page.h

- x86/mm: fully honor PS bits in guest page table walks In
L4 entries it is currently unconditionally reserved (and
hence should, when set, always result in a reserved bit
page fault), and is reserved on hardware not supporting
1Gb pages (and hence should, when set, similarly cause a
reserved bit page fault on such hardware). This is
CVE-2016-4480 / XSA-176. (CVE-2016-4480)

- x86/mm: Handle 1GiB superpages in the pagetable walker.
This allows HAP guests to use 1GiB superpages. Shadow
and PV guests still can't use them without more support
in shadow/* and mm.c.

Conflicts: xen/arch/x86/hvm/hvm.c
xen/arch/x86/mm/guest_walk.c Backported from upstream
commit 96b740e209d0bea4c16d93211ceb139fc98d10c2
(CVE-2016-4480)

- main loop: Big hammer to fix logfile disk DoS in Xen
setups Each time round the main loop, we now fstat
stderr. If it is too big, we dup2 /dev/null onto it.
This is not a very pretty patch but it is very simple,
easy to see that it's correct, and has a low risk of
collateral damage. The limit is 1Mby by default but can
be adjusted by setting a new environment variable. This
fixes CVE-2014-3672. (CVE-2014-3672)

- x86: make hvm_cpuid tolerate NULL pointers Now that
other HVM code started making more extensive use of
hvm_cpuid, let's not force every caller to declare dummy
variables for output not cared about.

xen/arch/x86/hvm/svm/svm.c and
xen/arch/x86/hvm/vmx/vvmx.c part are removed as no
source matched. Upstream commit
11b85dbd0ab068bad3beadda3aee2298205a3c01

- x86: limit GFNs to 32 bits for shadowed superpages.
Superpage shadows store the shadowed GFN in the
backpointer field, which for non-BIGMEM builds is 32
bits wide. Shadowing a superpage mapping of a
guest-physical address above 2^44 would lead to the GFN
being truncated there, and a crash when we come to
remove the shadow from the hash table. Track the valid
width of a GFN for each guest, including reporting it
through CPUID, and enforce it in the shadow pagetables.
Set the maximum witth to 32 for guests where this
truncation could occur. This is XSA-173.

Conflicts: xen/arch/x86/cpu/common.c
arch/x86/mm/guest_walk.c Upstream commit
95dd1b6e87b61222fc856724a5d828c9bdc30c80 (CVE-2016-3960)

- x86/HVM: correct CPUID leaf 80000008 handling
CPUID[80000008].EAX[23:16] have been given the meaning
of the guest physical address restriction (in case it
needs to be smaller than the host's), hence we need to
mirror that into vCPUID[80000008].EAX[7:0]. Enforce a
lower limit at the same time, as well as a fixed value
for the virtual address bits, and zero for the guest
physical address ones. In order for the vMTRR code to
see these overrides we need to make it call hvm_cpuid
instead of domain_cpuid, which in turn requires special
casing (and relaxing) the controlling domain. This
additionally should hide an ordering problem in the
tools: Both xend and xl appear to be restoring a guest
from its image before setting up the CPUID policy in the
hypervisor, resulting in domain_cpuid returning all
zeros and hence the check in mtrr_var_range_msr_set
failing if the guest previously had more than the
minimum 36 physical address bits.

Conflicts: xen/arch/x86/hvm/mtrr.c Upstream commit
ef437690af8b75e6758dce77af75a22b63982883 (CVE-2016-3960)

See also :

https://oss.oracle.com/pipermail/oraclevm-errata/2016-July/000505.html

Solution :

Update the affected xen / xen-devel / xen-tools packages.

Risk factor :

High / CVSS Base Score : 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 5.3
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: OracleVM Local Security Checks

Nessus Plugin ID: 92602 ()

Bugtraq ID:

CVE ID: CVE-2014-3672
CVE-2016-3960
CVE-2016-4480

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now