SB2015103003 - Multiple vulnerabilities in Xen 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2015103003

SB2015103003 - Multiple vulnerabilities in Xen

Published: October 30, 2015 Updated: August 9, 2020

Security Bulletin ID SB2015103003
Severity
High
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 18% Medium 55% Low 27%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2016-1570)

The vulnerability allows a remote authenticated user to execute arbitrary code.

The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.


2) Security Features (CVE-ID: CVE-2015-8615)

The vulnerability allows a remote authenticated user to perform service disruption.

The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).


3) Resource management error (CVE-ID: CVE-2015-8341)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.


4) Input validation error (CVE-ID: CVE-2015-8340)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling.


5) Data Handling (CVE-ID: CVE-2015-8339)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.


6) Security Features (CVE-ID: CVE-2015-7812)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The hypercall_create_continuation function in arch/arm/domain.c in Xen 4.4.x through 4.6.x allows local guest users to cause a denial of service (host crash) via a preemptible hypercall to the multicall interface.


7) Resource management error (CVE-ID: CVE-2015-7972)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through 4.6.x do not properly calculate the balloon size when using the populate-on-demand (PoD) system, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors related to "heavy memory pressure."


8) Data Handling (CVE-ID: CVE-2015-7971)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.


9) Resource management error (CVE-ID: CVE-2015-7969)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall.


10) Input validation error (CVE-ID: CVE-2015-7835)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.


11) Resource management error (CVE-ID: CVE-2015-7813)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Xen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercalls, which allows local guests to cause a denial of service via a sequence of (1) HYPERVISOR_physdev_op hypercalls, which are not properly handled in the do_physdev_op function in arch/arm/physdev.c, or (2) HYPERVISOR_hvm_op hypercalls, which are not properly handled in the do_hvm_op function in arch/arm/hvm.c.


Remediation

Install update from vendor's website.

References