Citrix XenServer Multiple Vulnerabilities (XSA-472)

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(264553);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/12");

  script_cve_id(
    "CVE-2025-27466",
    "CVE-2025-58142",
    "CVE-2025-58143"
  );
  script_xref(name:"IAVA", value:"2025-A-0656");

  script_name(english:"Citrix XenServer Multiple Vulnerabilities (XSA-472)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Xen hypervisor installation is missing a security update.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by
multiple vulnerabilities:

  - A NULL pointer dereference in the updating of the reference TSC area. (CVE-2025-27466)

  - A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. 
    (CVE-2025-58142)

  - A race in the mapping of the reference TSC page, where a guest can get Xen to free a page while still present in the
    guest physical to machine (p2m) page tables. (CVE-2025-58143)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://xenbits.xen.org/xsa/advisory-472.html");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate hotfix according to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-27466");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:citrix:xenserver");
  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("xen_server_detect.nbin");
  script_require_keys("installed_sw/Xen Hypervisor", "Settings/ParanoidReport");
  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app = 'Xen Hypervisor';
var app_info = vcf::xen_hypervisor::get_app_info(app:app);

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var fixes;
var version = app_info['version'];

# there are versions that are vulnerable and seem to be EOL so they will not have the fix patch ever
var greater_than_equal_to_first_vuln_version = ver_compare(ver:version, fix:'4.13', strict:false) >= 0;
var less_than_first_patch_version = ver_compare(ver:version, fix:'4.17', strict:false) < 0;

if (greater_than_equal_to_first_vuln_version && less_than_first_patch_version)
{
    vcf::report_results(
      app_info: app_info,
      fix: 'See vendor advisory',
      severity: SECURITY_HOLE
    );
}

fixes['4.17']['fixed_ver']           = '4.17.5';
fixes['4.17']['fixed_ver_display']   = '4.17.5 (changeset af733b7)';
fixes['4.17']['affected_ver_regex']  = "^4\.17([^0-9]|$)";
fixes['4.17']['affected_changesets'] = make_list('f20f975', '600db44',
  '746543f', '5da8dd3', '14bcad6', '1fe1358', '7a7171a', '77d74b0',
  '8a4ed23', '1d0efc4', '0ecbb2f', 'd6223a0', 'b73528f', '1bd4c2b',
  'c865cbf', 'bf90273', 'bdca9c8', '63b21de', 'df9770b', '27dad0c',
  'd09cad4', '1b989d6', '0596a69', '90b79a5', '015a7e3', '3c31a87',
  'ddc5c1e', '1d4361b', 'ebf61f7', '15bb4cc', '2aa9922', 'd109962',
  'd6654c6', 'b6eb793', 'f370d37', '2f5d4a0', '574e42e', 'a4e5191',
  '1db4f1a', '9629661', 'f65f18e', '9a6bd1e', '72064cf', '4ae329d',
  '0604496', 'd9606f9', '8d13862', 'f277875', '9cf7d9c', '78b984d',
  '8d75f6a', '0824ba9', '8ca06b7', 'f56bf7e', '3ef9196', '1db6ce3',
  '265aa7f', 'b72f32e', '9f6e015', 'd772df5', '430ce6c');

fixes['4.18']['fixed_ver']           = '4.18.5';
fixes['4.18']['fixed_ver_display']   = '4.18.5 (changeset 2102093)';
fixes['4.18']['affected_ver_regex']  = "^4\.18([^0-9]|$)";
fixes['4.18']['affected_changesets'] = make_list('de89b16', 'aba830f',
  '5119086', '25a125c', '13d3020', 'd8cab42', '41b62f8', '82c302a',
  'b6266b2', 'cd46db2', '9c0becc', '9548f45', '2ec55f6', 'df49dab',
  '709a223', '8b348e9', '60820cd', 'dcc9c3a', '43c513c', '8fc76b1',
  'e9d112e', '460ece3', '438bb12', '0b8f769');

fixes['4.20']['fixed_ver']           = '4.20.2';
fixes['4.20']['fixed_ver_display']   = '4.20.2-pre (changeset 665a641)';
fixes['4.20']['affected_ver_regex']  = "^4\.20([^0-9]|$)";
fixes['4.20']['affected_changesets'] = make_list('c5ecaf0', '5f83f72',
  'c59a69a', '24fef7a', 'eb1dc44', '9eb436c', '68f5ecf', '1541866',
  '96b7183', 'a98591e', 'cb827d8', 'e259054', '16dae1e', '67fcd2d',
  'ea50255', '7cda6b6', '4072b0b', 'ec5752e', '2fd3628', 'f1f2ac1',
  '69568ab', '73eaac3', 'c7f876c', 'c75f3ae', 'a586e38', '36a8397',
  '758879c', '60186d6', '76281c3', '1345e24', 'a634a48', 'a4dd64e',
  '733dd65', '53939e2', '6d0b94a', 'faf4082');

  vcf::xen_hypervisor::check_version_and_report(app_info:app_info, fixes:fixes, severity:SECURITY_HOLE);