Multiple vulnerabilities in Xen

1) Input validation error

EUVDB-ID: #VU40508

Risk: High

CVSSv3.1: 7.4 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-1570

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to execute arbitrary code.

The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 3.4.0 - 4.6.0

CPE2.3

External links

http://www.debian.org/security/2016/dsa-3519
http://www.securitytracker.com/id/1034744
http://xenbits.xen.org/xsa/advisory-167.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security Features

EUVDB-ID: #VU40537

Risk: Medium

CVSSv3.1: 4.4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-8615

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to perform service disruption.

The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 4.6.0

CPE2.3

cpe:2.3:a:xen_project:xen:4.6.0:*:*:*:*:*:*:*

External links

http://www.securityfocus.com/bid/79644
http://www.securitytracker.com/id/1034512
http://xenbits.xen.org/xsa/advisory-169.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource management error

EUVDB-ID: #VU40574

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-8341

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 4.1.0 - 4.6.0

CPE2.3

External links

http://www.debian.org/security/2016/dsa-3519
http://www.securitytracker.com/id/1034389
http://xenbits.xen.org/xsa/advisory-160.html
http://security.gentoo.org/glsa/201604-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU40575

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-8340

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 3.2.0 - 4.6.0

CPE2.3

External links

http://support.citrix.com/article/CTX203451
http://www.debian.org/security/2016/dsa-3519
http://www.securityfocus.com/bid/79038
http://www.securitytracker.com/id/1034391
http://xenbits.xen.org/xsa/advisory-159.html
http://security.gentoo.org/glsa/201604-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Data Handling

EUVDB-ID: #VU40576

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-8339

CWE-ID: CWE-19 - Data Handling

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 3.2.0 - 4.6.0

CPE2.3

External links

http://support.citrix.com/article/CTX203451
http://www.debian.org/security/2016/dsa-3519
http://www.securityfocus.com/bid/79038
http://www.securitytracker.com/id/1034391
http://xenbits.xen.org/xsa/advisory-159.html
http://security.gentoo.org/glsa/201604-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Security Features

EUVDB-ID: #VU40596

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-7812

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The hypercall_create_continuation function in arch/arm/domain.c in Xen 4.4.x through 4.6.x allows local guest users to cause a denial of service (host crash) via a preemptible hypercall to the multicall interface.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 4.4.0 - 4.6.0

CPE2.3

External links

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html
http://www.debian.org/security/2015/dsa-3414
http://www.securitytracker.com/id/1034031
http://xenbits.xen.org/xsa/advisory-145.html
http://security.gentoo.org/glsa/201604-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Resource management error

EUVDB-ID: #VU40617

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-7972

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through 4.6.x do not properly calculate the balloon size when using the populate-on-demand (PoD) system, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors related to "heavy memory pressure."

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 3.4.0 - 4.6.0

CPE2.3

External links

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html
http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html
http://support.citrix.com/article/CTX202404
http://www.debian.org/security/2015/dsa-3414
http://www.securityfocus.com/bid/77365
http://www.securitytracker.com/id/1034036
http://xenbits.xen.org/xsa/advisory-153.html
http://security.gentoo.org/glsa/201604-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Data Handling

EUVDB-ID: #VU40618

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-7971

CWE-ID: CWE-19 - Data Handling

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 3.2.0 - 4.6.0

CPE2.3

External links

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html
http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html
http://support.citrix.com/article/CTX202404
http://www.debian.org/security/2015/dsa-3414
http://www.securityfocus.com/bid/77363
http://www.securitytracker.com/id/1034035
http://xenbits.xen.org/xsa/advisory-152.html
http://security.gentoo.org/glsa/201604-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Resource management error

EUVDB-ID: #VU40619

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-7969

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 4.0.0 - 4.6.0

CPE2.3

External links

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html
http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html
http://support.citrix.com/article/CTX202404
http://www.debian.org/security/2015/dsa-3414
http://www.securityfocus.com/bid/77364
http://www.securitytracker.com/id/1034033
http://xenbits.xen.org/xsa/advisory-149.html
http://xenbits.xen.org/xsa/advisory-151.html
http://security.gentoo.org/glsa/201604-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Input validation error

EUVDB-ID: #VU40620

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-7835

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 3.4.0 - 4.6.0

CPE2.3

External links

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html
http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html
http://lists.opensuse.org/opensuse-updates/2015-12/msg00053.html
http://support.citrix.com/article/CTX202404
http://www.debian.org/security/2015/dsa-3390
http://www.securityfocus.com/bid/77366
http://www.securitytracker.com/id/1034032
http://xenbits.xen.org/xsa/advisory-148.html
http://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-022-2015.txt
http://security.gentoo.org/glsa/201604-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Resource management error

EUVDB-ID: #VU40621

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-7813

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Xen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercalls, which allows local guests to cause a denial of service via a sequence of (1) HYPERVISOR_physdev_op hypercalls, which are not properly handled in the do_physdev_op function in arch/arm/physdev.c, or (2) HYPERVISOR_hvm_op hypercalls, which are not properly handled in the do_hvm_op function in arch/arm/hvm.c.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 4.4.0 - 4.6.0

CPE2.3

External links

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html
http://www.debian.org/security/2015/dsa-3414
http://www.securitytracker.com/id/1034029
http://xenbits.xen.org/xsa/advisory-146.html
http://security.gentoo.org/glsa/201604-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	11
CVE-ID	CVE-2016-1570 CVE-2015-8615 CVE-2015-8341 CVE-2015-8340 CVE-2015-8339 CVE-2015-7812 CVE-2015-7972 CVE-2015-7971 CVE-2015-7969 CVE-2015-7835 CVE-2015-7813
CWE-ID	CWE-20 CWE-254 CWE-399 CWE-19
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Xen Server applications / Virtualization software
Vendor	Xen Project