CVE-2014-8867

The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/O MMIO emulated in the hypervisor, which allows local HVM guests to cause a denial of service host crash via unspecified vectors...

Excessive checking in compatibility mode hypercall argument translation

ISSUE DESCRIPTION The hypercall argument translation needed for 32-bit guests running on 64-bit hypervisors performs checks on the final register state. These checks cover all registers potentially holding hypercall arguments, not just the ones actually doing so for the hypercall being processed,...

OracleVM 2.2 : xen (OVMSA-2012-0058)

The remote OracleVM system is missing necessary patches to address critical security updates : XSA-27: hvm: Limit the size of large HVM op batches orabug 15907978 CVE-2012-5511 XSA-29: add missing guest address range checks to XENMEMexchange handlers orabug 15907996 CVE-2012-5513 XSA-30: xen: fix...

OracleVM 3.2 : xen (OVMSA-2014-0026)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: properly bound x2APIC MSR range This is XSA-108. Additional changelog comments added to 4.1.3-25.el5.94.1.3 CVE-2014-7188 - Fix for bug 19698532 - x86emul: only emulate software interrupt...

OracleVM 2.2 : xen (OVMSA-2012-0036)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2012-3432 / XSA-10: HVM guest user mode MMIO emulation DoS vulnerability orabug 14463558 CVE-2012-3432 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were...

OracleVM 2.1 : xen (OVMSA-2009-0001)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix permissions problem with VM.GuestMetrics bugz 7265 - Disable ovs-disabled-create-netif-if-vif-type-set-ioemu.patch - Include proper patch for bugz 7807 - Implement VM.GuestMetrics to communicate...

OracleVM 3.1 : xen (OVMSA-2012-0034)

The remote OracleVM system is missing necessary patches to address critical security updates : - Xen Security Advisory CVE-2012-3433 / XSA-11 HVM guest destroy p2m teardown host DoS vulnerability An HVM guest is able to manipulate its physical address space such that tearing down the guest takes ...

OracleVM 3.3 : xen (OVMSA-2014-0025)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: properly bound x2APIC MSR range This is XSA-108. Additional changelog comments added to 4.3.0-55.el6.0.0.3 CVE-2014-7188 - Fix for bug 19698535 - x86emul: only emulate software interrupt...

OracleVM 3.1 : xen (OVMSA-2013-0087)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: only allow ring 0 guest code to make hypercalls Anything else would allow for privilege escalation. This is CVE-2013-4554 / XSA-76. CVE-2013-4554 - x86: restrict XENDOMCTLgetmemlist Coverity ...

OracleVM 3.2 : xen (OVMSA-2013-0085)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: only allow ring 0 guest code to make hypercalls Anything else would allow for privilege escalation. This is CVE-2013-4554 / XSA-76. CVE-2013-4554 - x86: restrict XENDOMCTLgetmemlist Coverity ...

OracleVM 2.2 : xen (OVMSA-2013-0088)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: only allow ring 0 guest code to make hypercalls XSA-76 Jan Beulich 17822325 CVE-2013-4554 - x86: restrict XENDOMCTLgetmemlist XSA-74 Jan Beulich 17821907 CVE-2013-4553 - gnttab: correct locki...

CVE-2014-9030

The dommuupdate function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMUMACHPHYSUPDATE...

CVE-2014-9030

The dommuupdate function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMUMACHPHYSUPDATE...

CVE-2014-9030

The dommuupdate function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMUMACHPHYSUPDATE...

CVE-2014-9030

The dommuupdate function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMUMACHPHYSUPDATE...

Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling

ISSUE DESCRIPTION An error handling path in the processing of MMUMACHPHYSUPDATE failed to drop a page reference which was acquired in an earlier processing step. IMPACT Malicious or buggy stub domain kernels or tool stacks otherwise living outside of Domain0 can mount a denial of service attack...

CVE-2014-8595

arch/x86/x86emulate/x86emulate.c in Xen 3.2.1 through 4.4.x does not properly check privileges, which allows local HVM guest users to gain privileges or cause a denial of service crash via a crafted 1 CALL, 2 JMP, 3 RETF, 4 LCALL, 5 LJMP, or 6 LRET far branch instruction...

DEBIAN-CVE-2014-8595

arch/x86/x86emulate/x86emulate.c in Xen 3.2.1 through 4.4.x does not properly check privileges, which allows local HVM guest users to gain privileges or cause a denial of service crash via a crafted 1 CALL, 2 JMP, 3 RETF, 4 LCALL, 5 LJMP, or 6 LRET far branch instruction...

CVE-2014-8594

The dommuupdate function in arch/x86/mm.c in Xen 4.x through 4.4.x does not properly restrict updates to only PV page tables, which allows remote PV guests to cause a denial of service NULL pointer dereference by leveraging hardware emulation services for HVM guests using Hardware Assisted Paging...

Information disclosure

arch/x86/x86emulate/x86emulate.c in Xen 3.2.1 through 4.4.x does not properly check privileges, which allows local HVM guest users to gain privileges or cause a denial of service crash via a crafted 1 CALL, 2 JMP, 3 RETF, 4 LCALL, 5 LJMP, or 6 LRET far branch instruction...