xen: various flaws (#1463247) blkif responses leak backend stack data [XSA-216] page transfer may allow PV guest to elevate privilege [XSA-217] Races in the grant table unmap code [XSA-218] x86:
insufficient reference counts during shadow emulation [XSA-219] x86:
PKRU and BND* leakage between vCPU-s [XSA-220] stale P2M mappings due to insufficient error checking [XSA-222] ARM guest disabling interrupt may crash Xen [XSA-223] grant table operations mishandle reference counts [XSA-224] arm: vgic: Out-of-bound access when sending SGIs [XSA-225] NULL pointer deref in event channel poll [XSA-221] (#1463231)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Citrix XenServer installed on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists that causes grant table operations to fail     due to improper handling of reference counts. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact.

  - An information disclosure vulnerability exists due to     blkif responses leaking stack data. An unauthenticated,     remote attacker can exploit this to disclose potentially     sensitive information.

  - A NULL pointer dereference flaw exists in the event     channel poll that allows an unauthenticated, remote     attacker to cause a denial of service condition.

  - A flaw exists in shadow emulation due to insufficient     reference counts. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

  - A race condition exists in the grant table unmap code     that allows an unauthenticated, remote attacker to have     an unspecified impact.

  - An unspecified flaw exists in page transfers that allows     a local attacker on the PV guest to gain elevated     privileges.

  - A flaw exists that is triggered by stale P2M mappings     due to insufficient error checking. An unauthenticated,     remote attacker can exploit this to have an unspecified     impact.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0153 for details.

Multiple vulnerabilities have been discovered in the Xen hypervisor :

CVE-2017-10912

Jann Horn discovered that incorrectly handling of page transfers might result in privilege escalation.

CVE-2017-10913 / CVE-2017-10914

Jann Horn discovered that race conditions in grant handling might result in information leaks or privilege escalation.

CVE-2017-10915

Andrew Cooper discovered that incorrect reference counting with shadow paging might result in privilege escalation.

CVE-2017-10918

Julien Grall discovered that incorrect error handling in physical-to-machine memory mappings may result in privilege escalation, denial of service or an information leak.

CVE-2017-10920 / CVE-2017-10921 / CVE-2017-10922

Jan Beulich discovered multiple places where reference counting on grant table operations was incorrect, resulting in potential privilege escalation

CVE-2017-12135

Jan Beulich found multiple problems in the handling of transitive grants which could result in denial of service and potentially privilege escalation.

CVE-2017-12137

Andrew Cooper discovered that incorrect validation of grants may result in privilege escalation.

CVE-2017-12855

Jan Beulich discovered that incorrect grant status handling, thus incorrectly informing the guest that the grant is no longer in use.

CVE-2017-14316

Matthew Daley discovered that the NUMA node parameter wasn't verified which which may result in privilege escalation.

CVE-2017-14317

Eric Chanudet discovered that a race conditions in cxenstored might result in information leaks or privilege escalation.

CVE-2017-14318

Matthew Daley discovered that incorrect validation of grants may result in a denial of service.

CVE-2017-14319

Andrew Cooper discovered that insufficient grant unmapping checks may result in denial of service and privilege escalation.

For Debian 7 'Wheezy', these problems have been fixed in version 4.1.6.lts1-9.

We recommend that you upgrade your xen packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xen: various flaws (#1463247) blkif responses leak backend stack data [XSA-216] page transfer may allow PV guest to elevate privilege [XSA-217] Races in the grant table unmap code [XSA-218] x86:
insufficient reference counts during shadow emulation [XSA-219] x86:
PKRU and BND* leakage between vCPU-s [XSA-220] NULL pointer deref in event channel poll [XSA-221] (#1463231) stale P2M mappings due to insufficient error checking [XSA-222] ARM guest disabling interrupt may crash Xen [XSA-223] grant table operations mishandle reference counts [XSA-224] arm: vgic: Out-of-bound access when sending SGIs [XSA-225]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The shadow-paging feature in Xen through 4.8.x mismanages page references and consequently introduces a     race condition, which allows guest OS users to obtain Xen privileges, aka XSA-219. (CVE-2017-10915)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
101183	Fedora 24 : xen (2017-b3bdaf58bc)	Nessus	Fedora Local Security Checks	7/3/2017	12/12/2025	critical
101205	Citrix XenServer Multiple Vulnerabilities (CTX224740)	Nessus	Misc.	7/3/2017	4/24/2020	critical
103830	OracleVM 3.4 : xen (OVMSA-2017-0153)	Nessus	OracleVM Local Security Checks	10/13/2017	11/18/2025	critical
103791	Debian DLA-1132-1 : xen security update	Nessus	Debian Local Security Checks	10/12/2017	11/19/2025	critical
101638	Fedora 26 : xen (2017-5c6a9b07a3)	Nessus	Fedora Local Security Checks	7/17/2017	12/10/2025	critical
220275	Linux Distros Unpatched Vulnerability : CVE-2017-10915	Nessus	Misc.	3/4/2025	7/29/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical