Updated xen packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Red Hat Enterprise Linux.

It was found that the xc_try_bzip2_decode() and xc_try_lzma_decode() decode routines did not correctly check for a possible buffer size overflow in the decoding loop. As well, several integer overflow flaws and missing error/range checking were found that could lead to an infinite loop. A privileged guest user could use these flaws to crash the guest or, possibly, execute arbitrary code in the privileged management domain (Dom0). (CVE-2011-1583)

All xen users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Several vulnerabilities were discovered in the Xen virtual machine hypervisor.

  - CVE-2011-1166     A 64-bit guest can get one of its vCPUs into non-kernel     mode without first providing a valid non-kernel     pagetable, thereby locking up the host system.

  - CVE-2011-1583, CVE-2011-3262     Local users can cause a denial of service and possibly     execute arbitrary code via a crafted paravirtualised     guest kernel image.

  - CVE-2011-1898     When using PCI passthrough on Intel VT-d chipsets that     do not have interrupt remapping, guest OS users can gain     host OS privileges by writing to the interrupt injection     registers.

The oldstable distribution (lenny) contains a different version of Xen not affected by these problems.

The remote host is affected by the vulnerability described in GLSA-201309-24 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Guest domains could possibly gain privileges, execute arbitrary code, or       cause a Denial of Service on the host domain (Dom0). Additionally, guest       domains could gain information about other virtual machines running on       the same host or read arbitrary files on the host.
  Workaround :

    The CVEs listed below do not currently have fixes, but only apply to Xen       setups which have &ldquo;tmem&rdquo; specified on the hypervisor command line.
      TMEM is not currently supported for use in production systems, and       administrators using tmem should disable it.
      Relevant CVEs:
      * CVE-2012-2497
      * CVE-2012-6030
      * CVE-2012-6031
      * CVE-2012-6032
      * CVE-2012-6033
      * CVE-2012-6034
      * CVE-2012-6035
      * CVE-2012-6036

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0496 advisory.

  - Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local     users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest     kernel image that triggers (1) a buffer overflow during a decompression loop or (2) an out-of-bounds read     in the loader involving unspecified length fields. (CVE-2011-1583)

  - tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allows local users to cause a denial of     service (management software infinite loop and management domain resource consumption) via unspecified     vectors related to Lack of error checking in the decompression loop. (CVE-2011-3262)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
53870	CentOS 5 : xen (CESA-2011:0496)	Nessus	CentOS Local Security Checks	5/12/2011	1/4/2021	medium
56716	Debian DSA-2337-1 : xen - several vulnerabilities	Nessus	Debian Local Security Checks	11/7/2011	1/11/2021	high
53853	RHEL 5 : xen (RHSA-2011:0496)	Nessus	Red Hat Local Security Checks	5/10/2011	1/14/2021	medium
70184	GLSA-201309-24 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	9/28/2013	1/6/2021	high
68272	Oracle Linux 5 : xen (ELSA-2011-0496)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/16/2024	medium

Detections

Analytics

Plugins Search

medium

high

medium

high

medium