The remote OracleVM system is missing necessary patches to address critical security updates :

  - BUILDINFO: OVMF     commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8

  - BUILDINFO: xen     commit=3885a020649df84b883ea20d11ca15b7d7640201

  - BUILDINFO: QEMU upstream     commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - x86/HVM: don't give the wrong impression of WRMSR     succeeding (root) 

  - BUILDINFO: OVMF     commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8

  - BUILDINFO: xen     commit=71714f34026c4e0b105bf2def8d2dc4c7171d5b8

  - BUILDINFO: QEMU upstream     commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - Red-tape: Update repo with new CVE for XSA-297 (Patrick     Colp) [Orabug: 29725297] (CVE-2019-11091)

  - x86/spec-ctl: Expose X86_FEATURE_MD_CLEAR to guests     (Patrick Colp) [Orabug: 29677162] (CVE-2018-12126)     (CVE-2018-12127) (CVE-2018-12130)

  - x86/spec-ctrl: Introduce options to control VERW     flushing (Andrew Cooper) [Orabug: 2977162]     (CVE-2018-12126) (CVE-2018-12127) (CVE-2018-12130)     (CVE-2018-12126) (CVE-2018-12127) (CVE-2018-12130)

  - x86/spec-ctrl: Infrastructure to use VERW to flush     pipeline buffers (Andrew Cooper) [Orabug: 29677162]     (CVE-2018-12126) (CVE-2018-12127) (CVE-2018-12130)     (CVE-2018-12126) (CVE-2018-12127) (CVE-2018-12130)

  - x86/spec-ctrl: CPUID/MSR definitions for     Microarchitectural Data Sampling (Andrew Cooper)     [Orabug: 29677162] (CVE-2018-12126) (CVE-2018-12127)     (CVE-2018-12130) (CVE-2018-12126) (CVE-2018-12127)     (CVE-2018-12130)

  - BUILDINFO: OVMF     commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8

  - BUILDINFO: xen     commit=0d8ecd7732e56484c10e4b584de17d360d940252

  - BUILDINFO: QEMU upstream     commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - Config: Update git links to use linux-git.us.oracle.com     (Patrick Colp) 

  - gnttab: set page refcount for copy-on-grant-transfer     (Jan Beulich)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1181 advisory.

    [0.12.1.2-2.506.el6_10.3]
    - kvm-target-i386-define-md-clear-bit.patch [bz#1698996]
    - Resolves: bz#1698996       (CVE-2018-12130 qemu-kvm: hardware: MFBDS)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1171 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * A flaw was found in the implementation of the fill buffer, a mechanism used by modern CPUs when a     cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page     fault, the execution will continue speculatively with incorrect data from the fill buffer while the data     is fetched from higher level caches. This response time can be measured to infer data in the fill buffer.
    (CVE-2018-12130)

    * Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of     writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore     Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into     these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed     processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use     this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

    * Microprocessors use a load port subcomponent to perform load operations from memory or IO. During     a load operation, the load port receives data from the memory or IO subsystem and then provides the data     to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in     the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an     attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a     timing side-channel. (CVE-2018-12127)

    * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rwsem in inconsistent state leading system to hung (BZ#1690320)

    * iscsi driver can block reboot/shutdown (BZ#1693340)

    * ovl_create can return positive retval and crash the host (BZ#1696289)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1195 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    Security Fix(es):

    * A flaw was found in the implementation of the fill buffer, a mechanism used by modern CPUs when a     cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page     fault, the execution will continue speculatively with incorrect data from the fill buffer while the data     is fetched from higher level caches. This response time can be measured to infer data in the fill buffer.
    (CVE-2018-12130)

    * Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of     writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore     Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into     these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed     processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use     this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

    * Microprocessors use a load port subcomponent to perform load operations from memory or IO. During     a load operation, the load port receives data from the memory or IO subsystem and then provides the data     to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in     the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an     attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a     timing side-channel. (CVE-2018-12127)

    * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4669 advisory.

    [4.1.12-124.27.2]
    - x86/speculation/mds: Check for the right microcode before setting mitigation (Kanth Ghatraju)  [Orabug:
    29797118]
    - vxlan: test dev->flags & IFF_UP before accessing vxlan->dev->dev_addr (Venkat Venkatsubra)  [Orabug:
    29710939]
    - vxlan: test dev->flags & IFF_UP before calling gro_cells_receive() (Eric Dumazet)  [Orabug: 29710939]
    - nvme: allow timed-out ios to retry (James Smart)  [Orabug: 29301607]
    - rds: Introduce a pool of worker threads for connection management (Hakon Bugge)  [Orabug: 29391909]
    - rds: Use rds_conn_path cp_wq when applicable (Hakon Bugge)  [Orabug: 29391909]
    - rds: ib: Implement proper cm_id compare (Hakon Bugge)  [Orabug: 29391909]
    - Revert 'net/rds: prevent RDS connections using stale ARP entries' (Hakon Bugge)  [Orabug: 29391909]
    - rds: ib: Flush ARP cache when needed (Hakon Bugge)  [Orabug: 29391909]
    - rds: Add simple heuristics to determine connect delay (Hakon Bugge)  [Orabug: 29391909]
    - rds: Fix one-sided connect (Hakon Bugge)  [Orabug: 29391909]
    - rds: Consolidate and align ftrace related to connection management (Hakon Bugge)  [Orabug: 29391909]
    - rds: ib: Fix gratuitous ARP storm (Hakon Bugge)  [Orabug: 29391909]
    - IB/mlx4: Increase the timeout for CM cache (Hakon Bugge)  [Orabug: 29391909]
    - kvm/speculation: Allow KVM guests to use SSBD even if host does not (Alejandro Jimenez)  [Orabug:
    29423804]
    - x86/speculation: Keep enhanced IBRS on when spec_store_bypass_disable=on is used (Alejandro Jimenez)     [Orabug: 29423804]
    - x86/speculation: Clean up enhanced IBRS checks in bugs_64.c (Alejandro Jimenez)  [Orabug: 29423804]
    - mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings (Andrea Arcangeli)  [Orabug: 29510356]
    - bnxt_en: Reset device on RX buffer errors. (Michael Chan)  [Orabug: 29651238]
    - x86/mitigations: Fix the test for Xen PV guest (Boris Ostrovsky)  [Orabug: 29774291]
    - x86/speculation/mds: Fix verw usage to use memory operand (Kanth Ghatraju)  [Orabug: 29791036]     {CVE-2018-12127} {CVE-2018-12130}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xen fixes the following issues :

Security issues fixed :

CVE-2019-15890: Fixed a use-after-free in SLiRP networking implementation of QEMU emulator which could have led to Denial of Service (bsc#1149813).

CVE-2019-12068: Fixed an issue in lsi which could lead to an infinite loop and denial of service (bsc#1146874).

CVE-2019-14378: Fixed a heap buffer overflow in SLiRp networking implementation of QEMU emulator which could have led to execution of arbitrary code with privileges of the QEMU process (bsc#1143797).

Other issue fixed: Fixed an issue where libxenlight could not restore domain vsa6535522 on live migration (bsc#1133818).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
125104	OracleVM 3.4 : xen (OVMSA-2019-0016) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	OracleVM Local Security Checks	5/15/2019	3/6/2025	medium
125112	Oracle Linux 6 : qemu-kvm (ELSA-2019-1181)	Nessus	Oracle Linux Local Security Checks	5/15/2019	3/6/2025	medium
125117	RHEL 7 : kernel (RHSA-2019:1171)	Nessus	Red Hat Local Security Checks	5/15/2019	3/5/2025	medium
125125	RHEL 6 : qemu-kvm (RHSA-2019:1195)	Nessus	Red Hat Local Security Checks	5/15/2019	3/5/2025	medium
125665	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4669)	Nessus	Oracle Linux Local Security Checks	6/3/2019	3/4/2025	medium
130253	SUSE SLES12 Security Update : xen (SUSE-SU-2019:2769-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	10/25/2019	12/5/2022	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

high