Xen: x86 DMs May Cause Mem Leak by IRQ Binding (XSA-509)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344804);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/14");

  script_cve_id("CVE-2026-62437");
  script_xref(name:"IAVB", value:"2026-B-0250");

  script_name(english:"Xen: x86 DMs May Cause Mem Leak by IRQ Binding (XSA-509)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Xen hypervisor installation is missing a security update.");
  script_set_attribute(attribute:"description", value:
"When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were
assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively
early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM)
to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking
structures would still be cleaned up later on, at least one would not be.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://xenbits.xenproject.org/xsa/advisory-509.html");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-62437");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/11");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xen:xen");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("xen_server_detect.nbin");
  script_require_keys("installed_sw/Xen Hypervisor", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var fixes;
var app = 'Xen Hypervisor';
var app_info = vcf::xen_hypervisor::get_app_info(app:app);
if (report_paranoia < 2) audit(AUDIT_PARANOID);

fixes['4.17']['fixed_ver']           = '4.17.7';
fixes['4.17']['fixed_ver_display']   = '4.17.7 (changeset 439228f)';
fixes['4.17']['affected_ver_regex']  = "^4\.17([^0-9]|$)";
fixes['4.17']['affected_changesets'] = make_list("9373a59");

fixes['4.18']['fixed_ver']           = '4.18.6';
fixes['4.18']['fixed_ver_display']   = '4.18.6 (changeset a5817d1)';
fixes['4.18']['affected_ver_regex']  = "^4\.18([^0-9]|$)";
fixes['4.18']['affected_changesets'] = make_list("c935589");

fixes['4.19']['fixed_ver']           = '4.19.6';
fixes['4.19']['fixed_ver_display']   = '4.19.6 (changeset 5dd29d6)';
fixes['4.19']['affected_ver_regex']  = "^4\.19([^0-9]|$)";
fixes['4.19']['affected_changesets'] = make_list("54ee7c5");

fixes['4.20']['fixed_ver']           = '4.20.5';
fixes['4.20']['fixed_ver_display']   = '4.20.5-pre (changeset b26451e)';
fixes['4.20']['affected_ver_regex']  = "^4\.20([^0-9]|$)";
fixes['4.20']['affected_changesets'] = make_list("7b7f5be", "88c2d73",
  "d3eddf9", "ee3befc", "da5a214", "934897e", "2862edc");

fixes['4.21']['fixed_ver']           = '4.21.3';
fixes['4.21']['fixed_ver_display']   = '4.21.3-pre (changeset d9dbb24)';
fixes['4.21']['affected_ver_regex']  = "^4\.21([^0-9]|$)";
fixes['4.21']['affected_changesets'] = make_list("1cefa77", "21ef125",
  "cd91b44", "fc203d4", "6a78d0e", "1129f83", "9dccd42", "9113315");

vcf::xen_hypervisor::check_version_and_report(app_info:app_info, fixes:fixes, severity:SECURITY_HOLE);