Xen Hypervisor Multiple Vulnerabilities (XSA-231 - XSA-234)

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(103328);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/06/03");

  script_cve_id(
    "CVE-2017-14316",
    "CVE-2017-14317",
    "CVE-2017-14318",
    "CVE-2017-14319"
  );
  script_bugtraq_id(
    100817,
    100818,
    100819,
    100826
  );
  script_xref(name:"IAVB", value:"2017-B-0128-S");

  script_name(english:"Xen Hypervisor Multiple Vulnerabilities (XSA-231 - XSA-234)");
  script_summary(english:"Checks 'xl info' output for the Xen hypervisor version.");

  script_set_attribute(attribute:"synopsis", value:
"The remote Xen hypervisor installation is missing a security update.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the Xen hypervisor
installed on the remote host is affected by multiple vulnerabilities :

  - A flaw exists in the alloc_heap_pages() function due to
    improper handling when 'node >= MAX_NUMNODES'. A guest
    attacker can use crafted hypercalls to execute arbitrary
    code on the host system. (CVE-2017-14316)

  - A double-free flaw exists in the domain_cleanup()
    function within 'xenstored_domain.c'. A local attacker
    can use this flaw to crash the xenstored daemon which
    potentially could cause a denial of service.
    (CVE-2017-14317)

  - A null pointer dereference flaw exists in the
    __gnttab_cache_flush() function. An attacker could
    potentially leverage this flaw to crash the host system
    from a guest system. (CVE-2017-14318)

  - A flaw exists within 'arch/x86/mm.c'. An attacker could
    leverage this vulnerability to gain elevated privileges
    on the host system from a guest system. (CVE-2017-14319)

Note that Nessus has checked the changeset versions based on the
xen.git change log. Nessus did not check guest hardware configurations
or if patches were applied manually to the source code before a
recompile and reinstall.");
  script_set_attribute(attribute:"see_also", value:"http://xenbits.xen.org/xsa/advisory-231.html");
  script_set_attribute(attribute:"see_also", value:"http://xenbits.xen.org/xsa/advisory-232.html");
  script_set_attribute(attribute:"see_also", value:"http://xenbits.xen.org/xsa/advisory-233.html");
  script_set_attribute(attribute:"see_also", value:"http://xenbits.xen.org/xsa/advisory-234.html");
  script_set_attribute(attribute:"see_also", value:"https://xenbits.xen.org/gitweb/?p=xen.git;a=summary");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-14319");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/09/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/09/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/09/19");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xen:xen");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("xen_server_detect.nbin");
  script_require_keys("installed_sw/Xen Hypervisor", "Settings/ParanoidReport");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("install_func.inc");
include("misc_func.inc");

app_name = "Xen Hypervisor";
install  = get_single_install(app_name:app_name);
if (report_paranoia < 2) audit(AUDIT_PARANOID);

version         = install['version'];
display_version = install['display_version'];
path            = install['path'];
managed_status  = install['Managed status'];
changeset       = install['Changeset'];

if (!empty_or_null(changeset))
  display_version += " (changeset " + changeset + ")";

# Installations that are vendor-managed are handled by OS-specific local package checks
if (managed_status == "managed")
  audit(AUDIT_INST_PATH_NOT_VULN, app_name, display_version, path);

# XSA-231
fixes['4.5']['fixed_ver']           = '4.5.5';
fixes['4.5']['fixed_ver_display']   = '4.5.5 (changeset e3f0768)';
fixes['4.5']['affected_ver_regex']  = '^4\\.5\\.';
fixes['4.5']['affected_changesets'] = make_list("d5a5231", "c5b0fe5",
  "136ff4e", "42c8ba5", "d38489d", "df59014", "3217129", "4964e86",
  "c079597", "6ec173b", "a373456", "0780e81", "e5ef76d", "25eaa86",
  "ae02360", "5597df9", "c5de05e", "773094e", "e39a248", "7b3712a",
  "be35327", "8825df1", "d7e3725", "6eb61e4", "b1fcfed", "5779d6a",
  "afdd77e", "c18367a", "7b7fd80", "b30e165", "62ef9b2", "8071724",
  "235b5d5", "a28b99d", "ff294fc", "bc01e2d", "da50922", "386cc94",
  "139960f", "ec3ddd6", "988929a", "1c48dff", "20d4248", "9610422",
  "cd76cd3", "455fd66", "b820c31", "ac3d8bc", "cde86fc", "1678521",
  "83cb2db", "43d06ef", "2b17bf4", "1a2bda5", "0bd7faf", "e3426e2",
  "37281bc", "27be856", "bdf3ef1", "cc325c0", "8e7b84d", "387b8ae",
  "34fbae7", "1530da2", "274a1f6", "b679cfa", "877b760", "cfe165d",
  "84e4e56", "e4ae4b0");

fixes['4.6']['fixed_ver']           = '4.6.6';
fixes['4.6']['fixed_ver_display']   = '4.6.6 (changeset 629eddd)';
fixes['4.6']['affected_ver_regex']  = '^4\\.6\\.';
fixes['4.6']['affected_changesets'] = make_list("64c03bb", "b4660b4",
  "1ac8162", "747df3c", "5ae011e", "f974d32", "3300ad3", "d708b69");

fixes['4.7']['fixed_ver']           = '4.7.4';
fixes['4.7']['fixed_ver_display']   = '4.7.4-pre (changeset a67b223)';
fixes['4.7']['affected_ver_regex']  = '^4\\.7\\.';
fixes['4.7']['affected_changesets'] = make_list("68dbba2", "2728470",
  "dea68ed", "9d12253", "73d7bc5", "b704b1a", "ca4ef7b", "ece330a",
  "3d63ebc", "30d50f8", "2dc3cdb", "5151257", "c9f3ca0", "e873251",
  "8aebf85", "c362cde", "fece08a");

fixes['4.8']['fixed_ver']           = '4.8.3';
fixes['4.8']['fixed_ver_display']   = '4.8.3-pre (changeset 90dafa4)';
fixes['4.8']['affected_ver_regex']  = '^4\\.8\\.';
fixes['4.8']['affected_changesets'] = make_list("c020cf2");

fixes['4.9']['fixed_ver']           = '4.9.1';
fixes['4.9']['fixed_ver_display']   = '4.9.1-pre (changeset 4821228)';
fixes['4.9']['affected_ver_regex']  = '^4\\.9\\.';
fixes['4.9']['affected_changesets'] = make_list("d23bcc5", "308654c",
  "6fd84b3", "89b36cc", "a9ecd60", "798f6c9", "6508278", "5587d9a",
  "527fc5c", "5ff1de3", "692ed82", "9bf14bb", "c57b1f9", "6b147fd",
  "0e186e3", "afc5ebf", "266fc0e", "4698106", "f4f02f1", "0fada05",
  "ab4eb6c", "b29ecc7", "a11d14b", "107401e", "1b7834a");

# XSA-232
fixes['4.5']['fixed_ver']           = '4.5.5';
fixes['4.5']['fixed_ver_display']   = '4.5.5 (changeset 0b2ceae)';
fixes['4.5']['affected_ver_regex']  = '^4\\.5\\.';
fixes['4.5']['affected_changesets'] = make_list("e3f0768", "d5a5231",
  "c5b0fe5", "136ff4e", "42c8ba5", "d38489d", "df59014", "3217129",
  "4964e86", "c079597", "6ec173b", "a373456", "0780e81", "e5ef76d",
  "25eaa86", "ae02360", "5597df9", "c5de05e", "773094e", "e39a248",
  "7b3712a", "be35327", "8825df1", "d7e3725", "6eb61e4", "b1fcfed",
  "5779d6a", "afdd77e", "c18367a", "7b7fd80", "b30e165", "62ef9b2",
  "8071724", "235b5d5", "a28b99d", "ff294fc", "bc01e2d", "da50922",
  "386cc94", "139960f", "ec3ddd6", "988929a", "1c48dff", "20d4248",
  "9610422", "cd76cd3", "455fd66", "b820c31", "ac3d8bc", "cde86fc",
  "1678521", "83cb2db", "43d06ef", "2b17bf4", "1a2bda5", "0bd7faf",
  "e3426e2", "37281bc", "27be856", "bdf3ef1", "cc325c0", "8e7b84d",
  "387b8ae", "34fbae7", "1530da2", "274a1f6", "b679cfa", "877b760",
  "cfe165d", "84e4e56", "e4ae4b0");

fixes['4.6']['fixed_ver']           = '4.6.6';
fixes['4.6']['fixed_ver_display']   = '4.6.6 (changeset a8cd231)';
fixes['4.6']['affected_ver_regex']  = '^4\\.6\\.';
fixes['4.6']['affected_changesets'] = make_list("629eddd", "64c03bb",
  "b4660b4", "1ac8162", "747df3c", "5ae011e", "f974d32", "3300ad3", "d708b69");

fixes['4.7']['fixed_ver']           = '4.7.4';
fixes['4.7']['fixed_ver_display']   = '4.7.4-pre (changeset 83966a3)';
fixes['4.7']['affected_ver_regex']  = '^4\\.7\\.';
fixes['4.7']['affected_changesets'] = make_list("a67b223", "68dbba2",
  "2728470", "dea68ed", "9d12253", "73d7bc5", "b704b1a", "ca4ef7b",
  "ece330a", "3d63ebc", "30d50f8", "2dc3cdb", "5151257", "c9f3ca0",
  "e873251", "8aebf85", "c362cde", "fece08a");

fixes['4.8']['fixed_ver']           = '4.8.3';
fixes['4.8']['fixed_ver_display']   = '4.8.3-pre (changeset e574046)';
fixes['4.8']['affected_ver_regex']  = '^4\\.8\\.';
fixes['4.8']['affected_changesets'] = make_list("90dafa4", "c020cf2");

fixes['4.9']['fixed_ver']           = '4.9.1';
fixes['4.9']['fixed_ver_display']   = '4.9.1-pre (changeset 43cb0c4)';
fixes['4.9']['affected_ver_regex']  = '^4\\.9\\.';
fixes['4.9']['affected_changesets'] = make_list("4821228", "d23bcc5",
  "308654c", "6fd84b3", "89b36cc", "a9ecd60", "798f6c9", "6508278",
  "5587d9a", "527fc5c", "5ff1de3", "692ed82", "9bf14bb", "c57b1f9",
  "6b147fd", "0e186e3", "afc5ebf", "266fc0e", "4698106", "f4f02f1",
  "0fada05", "ab4eb6c", "b29ecc7", "a11d14b", "107401e", "1b7834a");

# XSA-233
fixes['4.5']['fixed_ver']           = '4.5.5';
fixes['4.5']['fixed_ver_display']   = '4.5.5 (changeset 04b8c4c)';
fixes['4.5']['affected_ver_regex']  = '^4\\.5\\.';
fixes['4.5']['affected_changesets'] = make_list("0b2ceae", "e3f0768",
  "d5a5231", "c5b0fe5", "136ff4e", "42c8ba5", "d38489d", "df59014",
  "3217129", "4964e86", "c079597", "6ec173b", "a373456", "0780e81",
  "e5ef76d", "25eaa86", "ae02360", "5597df9", "c5de05e", "773094e",
  "e39a248", "7b3712a", "be35327", "8825df1", "d7e3725", "6eb61e4",
  "b1fcfed", "5779d6a", "afdd77e", "c18367a", "7b7fd80", "b30e165",
  "62ef9b2", "8071724", "235b5d5", "a28b99d", "ff294fc", "bc01e2d",
  "da50922", "386cc94", "139960f", "ec3ddd6", "988929a", "1c48dff",
  "20d4248", "9610422", "cd76cd3", "455fd66", "b820c31", "ac3d8bc",
  "cde86fc", "1678521", "83cb2db", "43d06ef", "2b17bf4", "1a2bda5",
  "0bd7faf", "e3426e2", "37281bc", "27be856", "bdf3ef1", "cc325c0",
  "8e7b84d", "387b8ae", "34fbae7", "1530da2", "274a1f6", "b679cfa",
  "877b760", "cfe165d", "84e4e56", "e4ae4b0");

fixes['4.6']['fixed_ver']           = '4.6.6';
fixes['4.6']['fixed_ver_display']   = '4.6.6 (changeset 22b6dfa)';
fixes['4.6']['affected_ver_regex']  = '^4\\.6\\.';
fixes['4.6']['affected_changesets'] = make_list("a8cd231", "629eddd",
  "64c03bb", "b4660b4", "1ac8162", "747df3c", "5ae011e", "f974d32",
  "3300ad3", "d708b69");

fixes['4.7']['fixed_ver']           = '4.7.4';
fixes['4.7']['fixed_ver_display']   = '4.7.4-pre (changeset 3331050)';
fixes['4.7']['affected_ver_regex']  = '^4\\.7\\.';
fixes['4.7']['affected_changesets'] = make_list("83966a3", "a67b223",
  "68dbba2", "2728470", "dea68ed", "9d12253", "73d7bc5", "b704b1a",
  "ca4ef7b", "ece330a", "3d63ebc", "30d50f8", "2dc3cdb", "5151257",
  "c9f3ca0", "e873251", "8aebf85", "c362cde", "fece08a");

fixes['4.8']['fixed_ver']           = '4.8.3';
fixes['4.8']['fixed_ver_display']   = '4.8.3-pre (changeset 4d7ccae)';
fixes['4.8']['affected_ver_regex']  = '^4\\.8\\.';
fixes['4.8']['affected_changesets'] = make_list("e574046", "90dafa4",
  "c020cf2");

fixes['4.9']['fixed_ver']           = '4.9.1';
fixes['4.9']['fixed_ver_display']   = '4.9.1-pre (changeset 79775f5)';
fixes['4.9']['affected_ver_regex']  = '^4\\.9\\.';
fixes['4.9']['affected_changesets'] = make_list("43cb0c4", "4821228",
  "d23bcc5", "308654c", "6fd84b3", "89b36cc", "a9ecd60", "798f6c9",
  "6508278", "5587d9a", "527fc5c", "5ff1de3", "692ed82", "9bf14bb",
  "c57b1f9", "6b147fd", "0e186e3", "afc5ebf", "266fc0e", "4698106",
  "f4f02f1", "0fada05", "ab4eb6c", "b29ecc7", "a11d14b", "107401e", "1b7834a");

# XSA-234
fixes['4.5']['fixed_ver']           = '4.5.5';
fixes['4.5']['fixed_ver_display']   = '4.5.5 (changeset 83724d9)';
fixes['4.5']['affected_ver_regex']  = '^4\\.5\\.';
fixes['4.5']['affected_changesets'] = make_list("04b8c4c", "0b2ceae",
  "e3f0768", "d5a5231", "c5b0fe5", "136ff4e", "42c8ba5", "d38489d",
  "df59014", "3217129", "4964e86", "c079597", "6ec173b", "a373456",
  "0780e81", "e5ef76d", "25eaa86", "ae02360", "5597df9", "c5de05e",
  "773094e", "e39a248", "7b3712a", "be35327", "8825df1", "d7e3725",
  "6eb61e4", "b1fcfed", "5779d6a", "afdd77e", "c18367a", "7b7fd80",
  "b30e165", "62ef9b2", "8071724", "235b5d5", "a28b99d", "ff294fc",
  "bc01e2d", "da50922", "386cc94", "139960f", "ec3ddd6", "988929a",
  "1c48dff", "20d4248", "9610422", "cd76cd3", "455fd66", "b820c31",
  "ac3d8bc", "cde86fc", "1678521", "83cb2db", "43d06ef", "2b17bf4",
  "1a2bda5", "0bd7faf", "e3426e2", "37281bc", "27be856", "bdf3ef1",
  "cc325c0", "8e7b84d", "387b8ae", "34fbae7", "1530da2", "274a1f6",
  "b679cfa", "877b760", "cfe165d", "84e4e56", "e4ae4b0");

fixes['4.6']['fixed_ver']           = '4.6.6';
fixes['4.6']['fixed_ver_display']   = '4.6.6 (changeset 1658a87)';
fixes['4.6']['affected_ver_regex']  = '^4\\.6\\.';
fixes['4.6']['affected_changesets'] = make_list("22b6dfa", "a8cd231",
  "629eddd", "64c03bb", "b4660b4", "1ac8162", "747df3c", "5ae011e",
  "f974d32", "3300ad3", "d708b69");

fixes['4.7']['fixed_ver']           = '4.7.4';
fixes['4.7']['fixed_ver_display']   = '4.7.4-pre (changeset c7783d9)';
fixes['4.7']['affected_ver_regex']  = '^4\\.7\\.';
fixes['4.7']['affected_changesets'] = make_list("3331050", "83966a3",
  "a67b223", "68dbba2", "2728470", "dea68ed", "9d12253", "73d7bc5",
  "b704b1a", "ca4ef7b", "ece330a", "3d63ebc", "30d50f8", "2dc3cdb",
  "5151257", "c9f3ca0", "e873251", "8aebf85", "c362cde", "fece08a");

fixes['4.8']['fixed_ver']           = '4.8.3';
fixes['4.8']['fixed_ver_display']   = '4.8.3-pre (changeset 36898eb)';
fixes['4.8']['affected_ver_regex']  = '^4\\.8\\.';
fixes['4.8']['affected_changesets'] = make_list("4d7ccae", "e574046",
  "90dafa4", "c020cf2");

fixes['4.9']['fixed_ver']           = '4.9.1';
fixes['4.9']['fixed_ver_display']   = '4.9.1-pre (changeset 2cc3d32)';
fixes['4.9']['affected_ver_regex']  = '^4\\.9\\.';
fixes['4.9']['affected_changesets'] = make_list("79775f5", "43cb0c4",
  "4821228", "d23bcc5", "308654c", "6fd84b3", "89b36cc", "a9ecd60",
  "798f6c9", "6508278", "5587d9a", "527fc5c", "5ff1de3", "692ed82",
  "9bf14bb", "c57b1f9", "6b147fd", "0e186e3", "afc5ebf", "266fc0e",
  "4698106", "f4f02f1", "0fada05", "ab4eb6c", "b29ecc7", "a11d14b",
  "107401e", "1b7834a");

fix = NULL;
foreach ver_branch (keys(fixes))
{
  if (version =~ fixes[ver_branch]['affected_ver_regex'])
  {
    ret = ver_compare(ver:version, fix:fixes[ver_branch]['fixed_ver']);
    if (ret < 0)
      fix = fixes[ver_branch]['fixed_ver_display'];
    else if (ret == 0)
    {
      if (empty_or_null(changeset))
        fix = fixes[ver_branch]['fixed_ver_display'];
      else
        foreach affected_changeset (fixes[ver_branch]['affected_changesets'])
          if (changeset == affected_changeset)
            fix = fixes[ver_branch]['fixed_ver_display'];
    }
  }
}

if (empty_or_null(fix))
  audit(AUDIT_INST_PATH_NOT_VULN, app_name, display_version, path);

items  = make_array("Installed version", display_version,
                    "Fixed version", fix,
                    "Path", path);
order  = make_list("Path", "Installed version", "Fixed version");
report = report_items_str(report_items:items, ordered_fields:order) + '\n';

security_report_v4(port:0, extra:report, severity:SECURITY_HOLE);