GLSA-201309-24 : Xen: Multiple vulnerabilities

high Nessus Plugin ID 70184
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-201309-24 (Xen: Multiple vulnerabilities)

Multiple vulnerabilities have been discovered in Xen. Please review the CVE identifiers referenced below for details.
Impact :

Guest domains could possibly gain privileges, execute arbitrary code, or cause a Denial of Service on the host domain (Dom0). Additionally, guest domains could gain information about other virtual machines running on the same host or read arbitrary files on the host.
Workaround :

The CVEs listed below do not currently have fixes, but only apply to Xen setups which have “tmem” specified on the hypervisor command line.
TMEM is not currently supported for use in production systems, and administrators using tmem should disable it.
Relevant CVEs:
* CVE-2012-2497
* CVE-2012-6030
* CVE-2012-6031
* CVE-2012-6032
* CVE-2012-6033
* CVE-2012-6034
* CVE-2012-6035
* CVE-2012-6036

Solution

All Xen users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=app-emulation/xen-4.2.2-r1' All Xen-tools users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=app-emulation/xen-tools-4.2.2-r3' All Xen-pvgrub users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=app-emulation/xen-pvgrub-4.2.2-r1'

See Also

https://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.html

https://security.gentoo.org/glsa/201309-24

Plugin Details

Severity: High

ID: 70184

File Name: gentoo_GLSA-201309-24.nasl

Version: 1.17

Type: local

Published: 9/28/2013

Updated: 1/6/2021

Dependencies: ssh_get_info.nasl

Risk Information

VPR

Risk Factor: Critical

Score: 9.8

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: E:H/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:xen, p-cpe:/a:gentoo:linux:xen-pvgrub, p-cpe:/a:gentoo:linux:xen-tools, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/27/2013

Vulnerability Publication Date: 8/19/2011

Exploitable With

CANVAS (CANVAS)

Core Impact

Metasploit (FreeBSD Intel SYSRET Privilege Escalation)

Reference Information

CVE: CVE-2011-2901, CVE-2011-3262, CVE-2012-0217, CVE-2012-0218, CVE-2012-2934, CVE-2012-3432, CVE-2012-3433, CVE-2012-3494, CVE-2012-3495, CVE-2012-3496, CVE-2012-3497, CVE-2012-3498, CVE-2012-3515, CVE-2012-4411, CVE-2012-4535, CVE-2012-4536, CVE-2012-4537, CVE-2012-4538, CVE-2012-4539, CVE-2012-5510, CVE-2012-5511, CVE-2012-5512, CVE-2012-5513, CVE-2012-5514, CVE-2012-5515, CVE-2012-5525, CVE-2012-5634, CVE-2012-6030, CVE-2012-6031, CVE-2012-6032, CVE-2012-6033, CVE-2012-6034, CVE-2012-6035, CVE-2012-6036, CVE-2012-6075, CVE-2012-6333, CVE-2013-0151, CVE-2013-0152, CVE-2013-0153, CVE-2013-0154, CVE-2013-0215, CVE-2013-1432, CVE-2013-1917, CVE-2013-1918, CVE-2013-1919, CVE-2013-1920, CVE-2013-1922, CVE-2013-1952, CVE-2013-1964, CVE-2013-2076, CVE-2013-2077, CVE-2013-2078, CVE-2013-2194, CVE-2013-2195, CVE-2013-2196, CVE-2013-2211

BID: 49370, 53856, 53955, 53961, 54691, 54942, 55400, 55406, 55410, 55412, 55413, 55414, 55442, 56498, 56794, 56796, 56797, 56798, 56799, 56803, 56805, 57159, 57223, 57420, 57494, 57495, 57742, 57745, 58880, 59070, 59291, 59292, 59293, 59615, 59617, 60277, 60278, 60282, 60701, 60702, 60703, 60721, 60799

GLSA: 201309-24