The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0142 for details.

xen: various flaws (#1447345) x86: 64bit PV guest breakout via pagetable use-after-mode-change [XSA-213] grant transfer allows PV guest to elevate privileges [XSA-214]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - BUILDINFO: xen     commit=74b662e79bc874fe8ad8a93d2891e6569c380004

  - BUILDINFO: QEMU upstream     commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - gnttab: __gnttab_unmap_common_complete is all-or-nothing     (Jan Beulich) [Orabug: 26288614]

  - gnttab: correct logic to get page references during map     requests (George Dunlap) [Orabug: 26288614]

  - gnttab: never create host mapping unless asked to (Jan     Beulich) 

  - gnttab: Fix handling of dev_bus_addr during unmap     (George Dunlap) 

  - x86/shadow: Hold references for the duration of emulated     writes (Andrew Cooper) [Orabug: 26288568]

  - x86/mm: disallow page stealing from HVM domains (Jan     Beulich) 

  - guest_physmap_remove_page needs its return value checked     (Jan Beulich) [Orabug: 26288602]

  - xen/memory: Fix return value handing of     guest_remove_page (Andrew Cooper) [Orabug: 26288602]

  - evtchn: avoid NULL derefs (Jan Beulich) [Orabug:
    26288583]

  - gnttab: correct maptrack table accesses (Jan Beulich)     [Orabug: 26288557]

  - gnttab: Avoid potential double-put of maptrack entry     (George Dunlap) 

  - gnttab: fix unmap pin accounting race (Jan Beulich)     [Orabug: 26288557]

  - IOMMU: handle IOMMU mapping and unmapping failures (Quan     Xu) [Orabug: 26288557]

  - xen/disk: don't leak stack data via response ring (Jan     Beulich) 

  - BUILDINFO: xen     commit=7b45c3eb48a884f56f072a97a9a8da4d0b1077ed

  - BUILDINFO: QEMU upstream     commit=44c5f0a55d9a73e592426c33ce5705c969681955

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - livepatch: Wrong usage of spinlock on debug console.
    (Konrad Rzeszutek Wilk) [Orabug: 26248311]

  - BUILDINFO: xen     commit=40e21e7aea2b8bbc991346c3f516dfac4f94affe

  - BUILDINFO: QEMU upstream     commit=44c5f0a55d9a73e592426c33ce5705c969681955

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - x86/do_invalid_op should use is_active_kernel_text     rather than having its (Konrad Rzeszutek Wilk) [Orabug:
    26129273]

  - BUILDINFO: xen     commit=0eadc919cf32139e5565e0d869ed09f35c0a3212

  - BUILDINFO: QEMU upstream     commit=44c5f0a55d9a73e592426c33ce5705c969681955

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - kexec: Add spinlock for the whole hypercall. (Konrad     Rzeszutek Wilk) 

  - kexec: clear kexec_image slot when unloading kexec image     (Bhavesh Davda) [Orabug: 25861742]

  - BUILDINFO: xen     commit=8b90d66cd941599d50ee80e14fd144e337814bf6

  - BUILDINFO: QEMU upstream     commit=44c5f0a55d9a73e592426c33ce5705c969681955

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - x86: correct create_bounce_frame (tagged with CVE     number) (Boris Ostrovsky) [Orabug: 25927739]     (CVE-2017-8905)

  - x86: discard type information when stealing pages     (tagged with CVE number) (Boris Ostrovsky) [Orabug:
    25927669] (CVE-2017-8904)

  - multicall: deal with early exit conditions (tagged with     CVE number) (Boris Ostrovsky) [Orabug: 25927592]     (CVE-2017-8903)

  - BUILDINFO: xen     commit=583dedab5ceddbae4d0384de0ade8feeee75f78c

  - BUILDINFO: QEMU upstream     commit=fcd17fdf18b95a9e408acc84f6d2b37cf3fc0335

  - BUILDINFO: QEMU traditional     commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

  - BUILDINFO: IPXE     commit=9a93db3f0947484e30e753bbd61a10b17336e20e

  - BUILDINFO: SeaBIOS     commit=7d9cbe613694924921ed1a6f8947d711c5832eee

  - tools/libxc: Set max_elem to zero in     xc_lockprof_query_number (Boris Ostrovsky) [Orabug:
    26020611]

xen: various flaws (#1447345) x86: 64bit PV guest breakout via pagetable use-after-mode-change [XSA-213] grant transfer allows PV guest to elevate privileges [XSA-214] possible memory corruption via failsafe callback [XSA-215]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201705-11 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers and Xen Security Advisory referenced below for details.
  Impact :

    A local attacker could potentially execute arbitrary code with       privileges of Xen (QEMU) process on the host, gain privileges on the host       system, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Xen through 4.8.x mishandles the contains segment descriptors property during GNTTABOP_transfer (aka     guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS,     aka XSA-214. (CVE-2017-8904)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0153 for details.

Multiple vulnerabilities have been discovered in the Xen hypervisor.
The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2016-9932 (XSA-200)

CMPXCHG8B emulation allows local HVM guest OS users to obtain sensitive information from host stack memory.

CVE-2017-7995

Description Xen checks access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads.

CVE-2017-8903 (XSA-213)

Xen mishandles page tables after an IRET hypercall which can lead to arbitrary code execution on the host OS. The vulnerability is only exposed to 64-bit PV guests.

CVE-2017-8904 (XSA-214)

Xen mishandles the 'contains segment descriptors' property during GNTTABOP_transfer. This might allow PV guest OS users to execute arbitrary code on the host OS.

CVE-2017-8905 (XSA-215)

Xen mishandles a failsafe callback which might allow PV guest OS users to execute arbitrary code on the host OS.

For Debian 7 'Wheezy', these problems have been fixed in version 4.1.6.lts1-8.

We recommend that you upgrade your xen packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0039 for details.

ID	Name	Product	Family	Published	Updated	Severity
102835	OracleVM 3.4 : xen (OVMSA-2017-0142)	Nessus	OracleVM Local Security Checks	8/30/2017	11/25/2025	critical
100189	Fedora 25 : xen (2017-5ae70ac6a5)	Nessus	Fedora Local Security Checks	5/16/2017	12/18/2025	high
101195	OracleVM 3.4 : xen (OVMSA-2017-0116)	Nessus	OracleVM Local Security Checks	7/3/2017	12/12/2025	high
100198	Fedora 24 : xen (2017-c9d71f0860)	Nessus	Fedora Local Security Checks	5/16/2017	12/18/2025	high
101659	Fedora 26 : xen (2017-77ca39d254)	Nessus	Fedora Local Security Checks	7/17/2017	12/10/2025	high
100443	GLSA-201705-11 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	5/26/2017	12/17/2025	high
221247	Linux Distros Unpatched Vulnerability : CVE-2017-8904	Nessus	Misc.	3/4/2025	3/4/2025	high
103830	OracleVM 3.4 : xen (OVMSA-2017-0153)	Nessus	OracleVM Local Security Checks	10/13/2017	11/18/2025	critical
100575	Debian DLA-964-1 : xen security update	Nessus	Debian Local Security Checks	6/2/2017	12/17/2025	high
111992	OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	8/20/2018	8/16/2024	critical
140019	OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre)	Nessus	OracleVM Local Security Checks	8/28/2020	12/7/2022	critical

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

high

critical

high

critical

critical