According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a race condition that is triggered when handling TLB flush requests. This allows an attacker on the guest to access all system memory,  allowing them to cause a denial of service, disclose sensitive information, or gain elevated privileges on the host.

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an unspecified flaw in mm/shadow/multi.c that is triggered during the handling of self-linear shadow mappings with translated guests. This may allow an attacker on the guest to cause a denial of service or gain  elevated privileges on the host.

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

This update for xen fixes several issues: These security issues were fixed :

  - CVE-2017-5526: The ES1370 audio device emulation support     was vulnerable to a memory leakage issue allowing a     privileged user inside the guest to cause a DoS and/or     potentially crash the Qemu process on the host     (bsc#1059777)

  - CVE-2017-15593: Missing cleanup in the page type system     allowed a malicious or buggy PV guest to cause DoS     (XSA-242 bsc#1061084)

  - CVE-2017-15592: A problem in the shadow pagetable code     allowed a malicious or buggy HVM guest to cause DoS or     cause hypervisor memory corruption potentially allowing     the guest to escalate its privilege (XSA-243     bsc#1061086)

  - CVE-2017-15594: Problematic handling of the selector     fields in the Interrupt Descriptor Table (IDT) allowed a     malicious or buggy x86 PV guest to escalate its     privileges or cause DoS (XSA-244 bsc#1061087)

  - CVE-2017-15589: Intercepted I/O write operations with     less than a full machine word's worth of data were not     properly handled, which allowed a malicious unprivileged     x86 HVM guest to obtain sensitive information from the     host or other guests (XSA-239 bsc#1061080)

  - CVE-2017-15595: In certain configurations of linear page     tables a stack overflow might have occured that allowed     a malicious or buggy PV guest to cause DoS and     potentially privilege escalation and information leaks     (XSA-240 bsc#1061081)

  - CVE-2017-15588: Under certain conditions x86 PV guests     could have caused the hypervisor to miss a necessary TLB     flush for a page. This allowed a malicious x86 PV guest     to access all of system memory, allowing for privilege     escalation, DoS, and information leaks (XSA-241     bsc#1061082)

  - CVE-2017-15590: Multiple issues existed with the setup     of PCI MSI interrupts that allowed a malicious or buggy     guest to cause DoS and potentially privilege escalation     and information leaks (XSA-237 bsc#1061076)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service     (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted     page-table stacking. (CVE-2017-15595)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for xen fixes several issues. This new feature was included :

  - add script and sysv service to watch for vcpu     online/offline events in a HVM domU These security     issues were fixed :

  - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent     information leaks via side effects of speculative     execution, aka 'Spectre' and 'Meltdown' attacks     (bsc#1074562, bsc#1068032)

  - CVE-2018-5683: The vga_draw_text function allowed local     OS guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by     leveraging improper memory address validation     (bsc#1076116).

  - CVE-2017-18030: The cirrus_invalidate_region function     allowed local OS guest privileged users to cause a     denial of service (out-of-bounds array access and QEMU     process crash) via vectors related to negative pitch     (bsc#1076180).

  - CVE-2017-15595: x86 PV guest OS users were able to cause     a DoS (unbounded recursion, stack consumption, and     hypervisor crash) or possibly gain privileges via     crafted page-table stacking (bsc#1061081)

  - CVE-2017-17566: Prevent PV guest OS users to cause a     denial of service (host OS crash) or gain host OS     privileges in shadow mode by mapping a certain auxiliary     page (bsc#1070158).

  - CVE-2017-17563: Prevent guest OS users to cause a denial     of service (host OS crash) or gain host OS privileges by     leveraging an incorrect mask for reference-count     overflow checking in shadow mode (bsc#1070159).

  - CVE-2017-17564: Prevent guest OS users to cause a denial     of service (host OS crash) or gain host OS privileges by     leveraging incorrect error handling for reference     counting in shadow mode (bsc#1070160).

  - CVE-2017-17565: Prevent PV guest OS users to cause a     denial of service (host OS crash) if shadow mode and     log-dirty mode are in place, because of an incorrect     assertion related to M2P (bsc#1070163).

  - Added missing intermediate preemption checks for guest     requesting removal of memory. This allowed malicious     guest administrator to cause denial of service due to     the high cost of this operation (bsc#1080635).

  - Because of XEN not returning the proper error messages     when transitioning grant tables from v2 to v1 a     malicious guest was able to cause DoS or potentially     allowed for privilege escalation as well as information     leaks (bsc#1080662).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
103976	Xen Hypervisor TLB Flush Request Handling Race Condition System Memory Access Guest-to-Host Privilege Escalation (XSA-241)	Nessus	Misc.	10/19/2017	6/3/2021	high
103978	Xen Hypervisor Translated Guest Self-linear Shadow Mapping Handling Guest-to-Host Privilege Escalation (XSA-243)	Nessus	Misc.	10/19/2017	6/3/2021	high
104098	SUSE SLES11 Security Update : xen (SUSE-SU-2017:2812-1)	Nessus	SuSE Local Security Checks	10/23/2017	11/17/2025	high
104209	SUSE SLES12 Security Update : xen (SUSE-SU-2017:2856-1)	Nessus	SuSE Local Security Checks	10/27/2017	11/17/2025	high
220665	Linux Distros Unpatched Vulnerability : CVE-2017-15595	Nessus	Misc.	3/4/2025	7/29/2026	high
107254	SUSE SLES11 Security Update : xen (SUSE-SU-2018:0638-1) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	3/9/2018	1/13/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high