CVE-2014-2915

xen: Hardware features unintentionally exposed to guests on ARM

Xen 4.4.x, when running on ARM systems, does not properly restrict access to hardware features, which allows local guest users to cause a denial of service (host or guest crash) via unspecified vectors, related to (1) cache control, (2) coprocessors, (3) debug registers, and (4) other unspecified registers.

CVSS 2.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2014-2599

xen: HVMOP_set_mem_access is not preemptible

The HVMOP_set_mem_access HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service (CPU consumption) by leveraging access to certain service domains for HVM guests and a large input.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2014-2580

kernel: xen: Linux netback crash trying to disable due to malformed packet

The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service ("scheduling while atomic" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-7777

xen: CR0.TS and CR0.EM not always honored for x86 HVM guests (XSA-190)

Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it.

CVSS 3.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-7154

xen: use after free in FIFO event channel code

Use-after-free vulnerability in the FIFO event channel code in Xen 4.4.x allows local guest OS administrators to cause a denial of service (host crash) and possibly execute arbitrary code or obtain sensitive information via an invalid guest frame number.

CVSS 3.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-7094

xen: x86 HVM: Overflow of sh_ctxt->seg_reg[]

Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update.

CVSS 3.0 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2014-1896

xen: libvchan failure handling malicious ring indexes (xsa-86)

The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-7093

xen: x86: Mishandling of instruction pointer truncation during emulation

Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation.

CVSS 3.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-7092

xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests

The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables.

CVSS 3.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2014-1895

xen: Off-by-one error in FLASK_AVC_CACHESTAT hypercall (xsa-85)

Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read.

CVSS 2.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-6259

xen: x86: Missing SMAP whitelisting in 32-bit exception / event delivery (XSA-183)

Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check.

CVSS 3.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-6258

xen: x86: Privilege escalation in PV guests (XSA-182)

The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2014-1894

xen: integer overflow in several XSM/Flask hypercalls (xsa-84)

Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1893.

CVSS 2.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-5242

xen: arm: Host crash caused by VMID exhaustion (XSA-181)

The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (NULL pointer dereference and host OS crash) by creating concurrent domains and holding references to them, related to VMID exhaustion.

CVSS 3.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-4963

xen: Unsanitised driver domain input in libxl device handling (XSA-178)

The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2014-1893

xen: integer overflow in several XSM/Flask hypercalls (xsa-84)

Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894.

CVSS 2.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-4962

xen: Unsanitised guest input in libxl device handling code (XSA-175)

The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore.

CVSS 3.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle Xen

Products

Vm Server Xen

CVE-2016-4480

xen: x86 software guest page walk PS bit handling flaw (XSA-176)

The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory.

CVSS 3.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Oracle Xen

Products

Vm Server Xen

CVE-2014-1892

xen: integer overflow in several XSM/Flask hypercalls (xsa-84)

Xen 3.3 through 4.1, when XSM is enabled, allows local users to cause a denial of service via vectors related to a "large memory allocation," a different vulnerability than CVE-2014-1891, CVE-2014-1893, and CVE-2014-1894.

CVSS 2.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-3961

xen: hugetlbfs use may crash PV Linux guests (XSA-174)

Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Xen

Products

Ubuntu Linux Xen