Xen Hypervisor Multiple Vulnerabilities (XSA-213 - XSA-215)

High Nessus Plugin ID 100124


The remote Xen hypervisor installation is missing a security update.


According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by multiple vulnerabilities :

- An information disclosure vulnerability exists in the get_user() function due to permissions for accessing MMIO ranges being checked only after accessing them. An attacker on the guest can exploit this to disclose potentially sensitive information in the host memory.
(VulnDB 156958)

- A privilege escalation vulnerability exists when an IRET hypercall is placed within a multicall batch due to improper handling of kernel-mode access to pagetables.
An attacker on the guest can exploit this to access arbitrary system memory and gain elevated privileges on the host. (VulnDB 157110)

- A privilege escalation vulnerability exists in the steal_page() function within file xen/arch/x86/mm.c when transferring pages from one guest to another PV guest with a different bitness or an HVM guest. An attacker with access to multiple guests can exploit this to access arbitrary system memory and gain elevated privileges on the host. (VulnDB 157111)

- A flaw exists within arch/x86/x86_64/entry.S when handling failsafe callbacks due to improper validation of certain input. An attacker on the guest can exploit this to corrupt memory, potentially resulting in gaining elevated privileges. (VulnDB 157112)

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.


Apply the appropriate patch according to the vendor advisory.

See Also





Plugin Details

Severity: High

ID: 100124

File Name: xen_server_XSA-215.nasl

Version: $Revision: 1.2 $

Type: local

Family: Misc.

Published: 2017/05/11

Modified: 2017/08/16

Dependencies: 78089

Risk Information

Risk Factor: High


Base Score: 7.2

Temporal Score: 6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND


Base Score: 8.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/o:xen:xen

Required KB Items: installed_sw/Xen Hypervisor, Settings/ParanoidReport

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/05/02

Vulnerability Publication Date: 2017/05/02

Reference Information

OSVDB: 156958, 157110, 157111, 157112

IAVB: 2017-B-0050