Xen: x86 HVM I/O Port List Traversal (XSA-491)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(320868);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/15");

  script_cve_id("CVE-2026-42487");
  script_xref(name:"IAVB", value:"2026-B-0069");

  script_name(english:"Xen: x86 HVM I/O Port List Traversal (XSA-491)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Xen hypervisor installation is missing a security update.");
  script_set_attribute(attribute:"description", value:
"HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the
device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of
those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so
far. A device model of a HVM guest can cause a hypervisor crash, causing a Denial of Service (DoS) of the entire host.
Privilege escalation and information leaks cannot be ruled out.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://xenbits.xenproject.org/xsa/advisory-491.html");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-42487");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/12");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xen:xen");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("xen_server_detect.nbin");
  script_require_keys("installed_sw/Xen Hypervisor", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var fixes;
var app = 'Xen Hypervisor';
var app_info = vcf::xen_hypervisor::get_app_info(app:app);
if (report_paranoia < 2) audit(AUDIT_PARANOID);

fixes['4.17']['fixed_ver']           = '4.17.6';
fixes['4.17']['fixed_ver_display']   = '4.17.6 (changeset 4c11789)';
fixes['4.17']['affected_ver_regex']  = "^4\.17\.";
fixes['4.17']['affected_changesets'] = make_list("caf651f", "550d632",
  "7dedada", "7985e87", "db0c7c9", "57d0c0c", "2319a85", "ca4c5d8",
  "36e6dcb", "a2bca55", "87567b0", "8f29c76", "8c80ec8");

fixes['4.18']['fixed_ver']           = '4.18.5';
fixes['4.18']['fixed_ver_display']   = '4.18.5 (changeset 4ef23e6)';
fixes['4.18']['affected_ver_regex']  = "^4\.18\.";
fixes['4.18']['affected_changesets'] = make_list("3f4d62d", "581a10f",
  "dd781ac", "7f9ded3", "fcac058", "9f070ec", "4c88676", "2c5f7fd",
  "8b8c324", "ec8251e", "d477525", "f196c2f", "502d206", "343379c",
  "d15515f", "f6b0a04", "4112b5c", "8746612", "f0fcf69", "d04a36f",
  "a52a373", "832ecbf", "9143406", "1ac5088", "c90cec6", "46c0b23",
  "2102093", "de89b16", "aba830f", "5119086", "25a125c", "13d3020",
  "d8cab42", "41b62f8", "82c302a", "b6266b2", "cd46db2", "9c0becc",
  "9548f45", "2ec55f6", "df49dab", "709a223", "8b348e9", "60820cd",
  "dcc9c3a", "43c513c", "8fc76b1", "e9d112e", "460ece3", "438bb12", "0b8f769");

fixes['4.19']['fixed_ver']           = '4.19.5';
fixes['4.19']['fixed_ver_display']   = '4.19.5 (changeset 792e70b)';
fixes['4.19']['affected_ver_regex']  = "^4\.19\.";
fixes['4.19']['affected_changesets'] = make_list("e1eae71", "8056c40",
  "7bcc106", "308be67", "7497e64", "60a2c34", "7a15cde");

fixes['4.20']['fixed_ver']           = '4.20.4';
fixes['4.20']['fixed_ver_display']   = '4.20.4-pre (changeset 493a937)';
fixes['4.20']['affected_ver_regex']  = "^4\.20\.";
fixes['4.20']['affected_changesets'] = make_list("24ccd83", "6cf9b61",
  "2abb8d0", "33a6d8a", "806c814", "ccac195", "ae41936", "0bd3ff8",
  "04747ce", "8f981ab", "152183d", "4563f9c", "a99d160", "d006fa1",
  "869ef9b", "937d1c7", "3ed365e", "51e0905", "cf3a174", "54ba668",
  "207e11f", "5f70542", "ad5d955", "57db4b6", "ef5c706", "be6b618",
  "d5c70a5", "c6d16eb", "92d668b", "1f067a8", "1648908", "491f661",
  "928144f", "eb2c288", "05b8f71", "140d981", "0359ff3", "c2cb923",
  "c1a7c61", "ce40b0b", "36366ff", "f1826fa", "b96452c", "5568870");

fixes['4.21']['fixed_ver']           = '4.21.2';
fixes['4.21']['fixed_ver_display']   = '4.21.2-pre (changeset 4ac1fc0)';
fixes['4.21']['affected_ver_regex']  = "^4\.21\.";
fixes['4.21']['affected_changesets'] = make_list("1b251cc", "4989714",
  "9a0327b", "647e362", "04db4dc", "4d6e6ed", "3928945", "02bcb4e",
  "16e9e62", "ed13b64", "3db23df", "7372aca", "fd2ccd7", "3dccad5",
  "1ae7e08", "9358a20", "a8e8541", "13ca96c", "00496ab", "032d39f",
  "8af05b4", "0d8b25d", "43e32ae", "f732e91", "17a7843", "54db249",
  "27748a7", "2d1a11a", "76b359a", "9c79644", "6b8be12", "b2352be",
  "8f3dcdc", "afb919f", "f35f0ac", "c9ba169", "feb9949", "e2981e0",
  "761aba9", "a011ca9", "8482a1c", "b3c4a20", "aaa03d4", "646bcc1",
  "d174a86", "fa82d4f");

vcf::xen_hypervisor::check_version_and_report(app_info:app_info, fixes:fixes, severity:SECURITY_WARNING);