Debian DSA-3729-1 : xen - security update

High Nessus Plugin ID 95610

Synopsis

The remote Debian host is missing a security-related update.

Description

Multiple vulnerabilities have been discovered in the Xen hypervisor.
The Common Vulnerabilities and Exposures project identifies the following problems :

- CVE-2016-7777 (XSA-190) Jan Beulich from SUSE discovered that Xen does not properly honor CR0.TS and CR0.EM for x86 HVM guests, potentially allowing guest users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it.

- CVE-2016-9379, CVE-2016-9380 (XSA-198) Daniel Richman and Gabor Szarka of the Cambridge University Student-Run Computing Facility discovered that pygrub, the boot loader emulator, fails to quote (or sanity check) its results when reporting them to its caller. A malicious guest administrator can take advantage of this flaw to cause an information leak or denial of service.

- CVE-2016-9382 (XSA-192) Jan Beulich of SUSE discovered that Xen does not properly handle x86 task switches to VM86 mode. A unprivileged guest process can take advantage of this flaw to crash the guest or, escalate its privileges to that of the guest operating system.

- CVE-2016-9383 (XSA-195) George Dunlap of Citrix discovered that the Xen x86 64-bit bit test instruction emulation is broken. A malicious guest can take advantage of this flaw to modify arbitrary memory, allowing for arbitrary code execution, denial of service (host crash), or information leaks.

- CVE-2016-9385 (XSA-193) Andrew Cooper of Citrix discovered that Xen's x86 segment base write emulation lacks canonical address checks. A malicious guest administrator can take advantage of this flaw to crash the host, leading to a denial of service.

- CVE-2016-9386 (XSA-191) Andrew Cooper of Citrix discovered that x86 null segments are not always treated as unusable. An unprivileged guest user program may be able to elevate its privilege to that of the guest operating system.

Solution

Upgrade the xen packages.

For the stable distribution (jessie), these problems have been fixed in version 4.4.1-9+deb8u8.

See Also

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845663

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845664

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845665

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845668

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845670

https://security-tracker.debian.org/tracker/CVE-2016-7777

https://security-tracker.debian.org/tracker/CVE-2016-9379

https://security-tracker.debian.org/tracker/CVE-2016-9380

https://security-tracker.debian.org/tracker/CVE-2016-9382

https://security-tracker.debian.org/tracker/CVE-2016-9383

https://security-tracker.debian.org/tracker/CVE-2016-9385

https://security-tracker.debian.org/tracker/CVE-2016-9386

https://packages.debian.org/source/jessie/xen

https://www.debian.org/security/2016/dsa-3729

Plugin Details

Severity: High

ID: 95610

File Name: debian_DSA-3729.nasl

Version: 3.12

Type: local

Agent: unix

Published: 2016/12/08

Updated: 2018/11/10

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:xen, cpe:/o:debian:debian_linux:8.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2016/12/07

Reference Information

CVE: CVE-2016-7777, CVE-2016-9379, CVE-2016-9380, CVE-2016-9382, CVE-2016-9383, CVE-2016-9385, CVE-2016-9386

DSA: 3729

IAVB: 2016-B-0149