Multiple security issues have been found in the Xen virtualisation solution :

  - CVE-2015-3209     Matt Tait discovered a flaw in the way QEMU's AMD PCnet     Ethernet emulation handles multi-TMD packets with a     length above 4096 bytes. A privileged guest user in a     guest with an AMD PCNet ethernet card enabled can     potentially use this flaw to execute arbitrary code on     the host with the privileges of the hosting QEMU     process.

  - CVE-2015-4103     Jan Beulich discovered that the QEMU Xen code does not     properly restrict write access to the host MSI message     data field, allowing a malicious guest to cause a denial     of service.

  - CVE-2015-4104     Jan Beulich discovered that the QEMU Xen code does not     properly restrict access to PCI MSI mask bits, allowing     a malicious guest to cause a denial of service.

  - CVE-2015-4105     Jan Beulich reported that the QEMU Xen code enables     logging for PCI MSI-X pass-through error messages,     allowing a malicious guest to cause a denial of service.

  - CVE-2015-4106     Jan Beulich discovered that the QEMU Xen code does not     properly restrict write access to the PCI config space     for certain PCI pass-through devices, allowing a     malicious guest to cause a denial of service, obtain     sensitive information or potentially execute arbitrary     code.

  - CVE-2015-4163     Jan Beulich discovered that a missing version check in     the GNTTABOP_swap_grant_ref hypercall handler may result     in denial of service. This only applies to Debian     stable/jessie.

  - CVE-2015-4164     Andrew Cooper discovered a vulnerability in the iret     hypercall handler, which may result in denial of     service.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1088 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for     Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the     user-space component for running virtual machines using KVM.

    A flaw was found in the way QEMU's AMD PCnet Ethernet emulation handled     multi-TMD packets with a length above 4096 bytes. A privileged guest user     in a guest with an AMD PCNet ethernet card enabled could potentially use     this flaw to execute arbitrary code on the host with the privileges of the     hosting QEMU process. (CVE-2015-3209)

    Red Hat would like to thank Matt Tait of Google's Project Zero security     team for reporting this issue.

    All qemu-kvm-rhev users are advised to upgrade to these updated packages,     which contain a backported patch to correct this issue. After installing     this update, shut down all running virtual machines. Once all virtual     machines have shut down, start them again for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Xen was updated to 4.4.2 to fix multiple vulnerabilities and non-security bugs.

The following vulnerabilities were fixed :

  - CVE-2015-4103: Potential unintended writes to host MSI     message data field via qemu (XSA-128) (boo#931625)

  - CVE-2015-4104: PCI MSI mask bits inadvertently exposed     to guests (XSA-129) (boo#931626)

  - CVE-2015-4105: Guest triggerable qemu MSI-X pass-through     error messages (XSA-130) (boo#931627)

  - CVE-2015-4106: Unmediated PCI register access in qemu     (XSA-131) (boo#931628)

  - CVE-2015-4164: DoS through iret hypercall handler     (XSA-136) (boo#932996)

  - CVE-2015-4163: GNTTABOP_swap_grant_ref operation     misbehavior (XSA-134) (boo#932790)

  - CVE-2015-3209: heap overflow in qemu pcnet controller     allowing guest to host escape (XSA-135) (boo#932770)

  - CVE-2015-3456: Fixed a buffer overflow in the floppy     drive emulation, which could be used to denial of     service attacks or potential code execution against the     host. ()

  - CVE-2015-3340: Xen did not initialize certain fields,     which allowed certain remote service domains to obtain     sensitive information from memory via a (1)     XEN_DOMCTL_gettscinfo or (2)     XEN_SYSCTL_getdomaininfolist request. ()

  - CVE-2015-2752: Long latency MMIO mapping operations are     not preemptible (XSA-125 boo#922705)

  - CVE-2015-2756: Unmediated PCI command register access in     qemu (XSA-126 boo#922706)

  - CVE-2015-2751: Certain domctl operations may be abused     to lock up the host (XSA-127 boo#922709)

  - CVE-2015-2151: Hypervisor memory corruption due to x86     emulator flaw (boo#919464 XSA-123)

  - CVE-2015-2045: Information leak through version     information hypercall (boo#918998 XSA-122)

  - CVE-2015-2044: Information leak via internal x86 system     device emulation (boo#918995 (XSA-121)

  - CVE-2015-2152: HVM qemu unexpectedly enabling emulated     VGA graphics backends (boo#919663 XSA-119)

  - CVE-2014-3615: information leakage when guest sets high     resolution (boo#895528)

The following non-security bugs were fixed :

  - xentop: Fix memory leak on read failure 

  - boo#923758: xen dmesg contains bogus output in early     boot

  - boo#921842: Xentop doesn't display disk statistics for     VMs using qdisks

  - boo#919098: L3: XEN blktap device intermittently fails     to connect 

  - boo#882089: Windows 2012 R2 fails to boot up with     greater than 60 vcpus

  - boo#903680: Problems with detecting free loop devices on     Xen guest startup

  - boo#861318: xentop reports 'Found interface vif101.0 but     domain 101 does not exist.'

  - boo#901488: Intel ixgbe driver assigns rx/tx queues per     core resulting in irq problems on servers with a large     amount of CPU cores

  - boo#910254: SLES11 SP3 Xen VT-d igb NIC doesn't work

  - boo#912011: high ping latency after upgrade to latest     SLES11SP3 on xen Dom0

  - boo#906689: let systemd schedule xencommons after     network-online.target and remote-fs.target so that     xendomains has access to remote shares

The following functionality was enabled or enhanced :

  - Enable spice support in qemu for x86_64

  - Add Qxl vga support

  - Enhancement to virsh/libvirtd 'send-key' command     (FATE#317240)

  - Add domain_migrate_constraints_set API to Xend's http     interface (FATE#317239)

Heap overflow in QEMU PCNET controller, allowing guest->host escape [XSA-135, CVE-2015-3209] (#1230537) GNTTABOP_swap_grant_ref operation misbehavior [XSA-134, CVE-2015-4163] vulnerability in the iret hypercall handler [XSA-136, CVE-2015-4164] Potential unintended writes to host MSI message data field via qemu [XSA-128, CVE-2015-4103], PCI MSI mask bits inadvertently exposed to guests [XSA-129, CVE-2015-4104], Guest triggerable qemu MSI-X pass-through error messages [XSA-130, CVE-2015-4105], Unmediated PCI register access in qemu [XSA-131, CVE-2015-4106]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1189 advisory.

    [kvm-83-273.0.1.el5]
    - Added kvm-add-oracle-workaround-for-libvirt-bug.patch
    - Added kvm-Introduce-oel-machine-type.patch

    [kvm-83.273.el5]
    - kvm-pcnet-Properly-handle-TX-requests-during-Link-Fail.patch [bz#1225896]
    - kvm-pcnet-fix-Negative-array-index-read.patch [bz#1225896]
    - kvm-pcnet-force-the-buffer-access-to-be-in-bounds-during.patch [bz#1225896]
    - Resolves: bz#1225896       (EMBARGOED CVE-2015-3209 kvm: qemu: pcnet: multi-tmd buffer overflow in the tx path [rhel-5.11.z)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems.

A flaw was found in the way QEMU's AMD PCnet Ethernet emulation handled multi-TMD packets with a length above 4096 bytes. A privileged guest user in a guest with an AMD PCNet ethernet card enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the hosting QEMU process. (CVE-2015-3209)

Red Hat would like to thank Matt Tait of Google's Project Zero security team for reporting this issue.

All kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Note: The procedure in the Solution section must be performed before this update will take effect.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
84169	Debian DSA-3286-1 : xen - security update	Nessus	Debian Local Security Checks	2015/6/15	2021/1/11	high
84188	RHEL 6 : qemu-kvm-rhev (RHSA-2015:1088)	Nessus	Red Hat Local Security Checks	2015/6/15	2025/4/15	critical
84333	openSUSE Security Update : xen (openSUSE-2015-434) (Venom)	Nessus	SuSE Local Security Checks	2015/6/23	2021/1/19	high
84378	Fedora 20 : xen-4.3.4-6.fc20 (2015-9965)	Nessus	Fedora Local Security Checks	2015/6/25	2021/1/11	high
84418	Oracle Linux 5 : kvm (ELSA-2015-1189)	Nessus	Oracle Linux Local Security Checks	2015/6/26	2024/10/22	critical
84421	RHEL 5 : kvm (RHSA-2015:1189)	Nessus	Red Hat Local Security Checks	2015/6/26	2019/10/24	high

検出

プラグインの検索

high

critical

high

high

critical

high