According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by multiple vulnerabilities.

Note that Nessus has checked the changeset versions based on the xen.git change log. Nessus did not check guest hardware configurations or if patches were applied manually to the source code before a recompile and reinstall.

The remote host is affected by the vulnerability described in GLSA-201801-14 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       referenced CVE identifiers for details.
  Impact :

    A local attacker could potentially execute arbitrary code with the       privileges of the Xen (QEMU) process on the host, gain privileges on the       host system, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0142 for details.

This update for xen to version 4.7.3 fixes several issues. These security issues were fixed :

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-12136: Race conditions with maptrack free list     handling allows a malicious guest administrator to crash     the host or escalate their privilege to that of the host     (XSA-228, bsc#1051789).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230 CVE-2017-12855).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-12136: Race conditions with maptrack free list     handling allows a malicious guest administrator to crash     the host or escalate their privilege to that of the host     (XSA-228, bsc#1051789).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230 bsc#1052686.

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.7.3 fixes several issues.

These security issues were fixed :

  - CVE-2017-12135: Unbounded recursion in grant table code     allowed a malicious guest to crash the host or     potentially escalate privileges/leak information     (XSA-226, bsc#1051787).

  - CVE-2017-12137: Incorrectly-aligned updates to     pagetables allowed for privilege escalation (XSA-227,     bsc#1051788).

  - CVE-2017-12136: Race conditions with maptrack free list     handling allows a malicious guest administrator to crash     the host or escalate their privilege to that of the host     (XSA-228, bsc#1051789).

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049578).

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046637).

  - CVE-2017-12855: Premature clearing of GTF_writing /     GTF_reading lead to potentially leaking sensitive     information (XSA-230 CVE-2017-12855).

These non-security issues were fixed :

  - bsc#1055695: XEN: 11SP4 and 12SP3 HVM guests can not be     restored after the save using xl stack 

  - bsc#1035231: Migration of HVM domU did not use     superpages on destination dom0

  - bsc#1002573: Optimized LVM functions in block-dmmd     block-dmmd

  - bsc#1037840: Xen-detect always showed HVM for PV guests

This update was imported from the SUSE:SLE-12-SP2:Update update project.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
102585	Xen Hypervisor Multiple Vulnerabilities (XSA-226 - XSA-230)	Nessus	Misc.	2017/8/18	2020/7/10	high
106038	GLSA-201801-14 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2018/1/15	2025/11/3	high
102835	OracleVM 3.4 : xen (OVMSA-2017-0142)	Nessus	OracleVM Local Security Checks	2017/8/30	2025/11/25	critical
102952	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:2326-1)	Nessus	SuSE Local Security Checks	2017/9/5	2025/11/24	critical
102953	SUSE SLED12 Security Update : xen (SUSE-SU-2017:2327-1)	Nessus	SuSE Local Security Checks	2017/9/5	2025/11/24	high
103158	openSUSE Security Update : xen (openSUSE-2017-1022)	Nessus	SuSE Local Security Checks	2017/9/13	2025/11/21	critical

検出

プラグインの検索

high

high

critical

critical

high

critical