CVE-2016-3960

xen: x86 shadow pagetables: address width overflow (XSA-173)

Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Oracle Xen

Products

Fedora Vm Server Xen

CVE-2014-1891

xen: integer overflow in several XSM/Flask hypercalls (xsa-84)

Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894.

CVSS 2.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-3159

xen: AMD FPU FIP/FDP/FOP leak workaround broken (XSA-172)

The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.

CVSS 3.0 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Oracle and 1 more

Products

Debian Linux Fedora Vm Server and 1 more

CVE-2016-3158

xen: AMD FPU FIP/FDP/FOP leak workaround broken (XSA-172)

The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.

CVSS 3.0 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Oracle Xen

Products

Fedora Vm Server Xen

CVE-2016-3157

kernel: xen: Privilege escalation on 64-bit Xen PV domains with IO port access privileges (XSA-171)

The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, which allows local guest OS users to gain privileges, cause a denial of service (guest OS crash), or obtain sensitive information by leveraging I/O port access.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Xen

Products

Ubuntu Linux Xen

CVE-2016-2271

xen: guest user mode may crash guest with non-canonical RIP (XSA-170)

VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-2270

xen: inconsistent cachability flags on guest mappings (XSA-154)

Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.

CVSS 3.0 · 6.8 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Fedoraproject Oracle and 1 more

Products

Debian Linux Fedora Vm Server and 1 more

CVE-2016-1571

xen: Intercept issue with INVLPG on non-canonical address causing host to crash

The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check.

CVSS 3.0 · 6.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-1570

xen: PV superpage functionality missing sanity checks

The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.

CVSS 3.0 · 8.5 High EPSS 1.2% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2015-8615

xen: Unintentional logging upon guest changing callback method on x86

The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).

CVSS 3.0 · 5.0 Medium EPSS 1.2% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2015-8555

xen: information leak in legacy x86 FPU/XMM initialization (XSA-165)

Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.

CVSS 3.0 · 8.6 High EPSS 2.3% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2015-8554

xen: qemu-dm buffer overrun in MSI-X handling (XSA-164)

Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a "write path."

CVSS 3.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2015-8552

xen: Linux pciback missing sanity checks leading to crash (XSA-157)

The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux pciback missing sanity checks."

CVSS 3.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Novell and 1 more

Products

Ubuntu Linux Debian Linux Suse Linux Enterprise Debuginfo and 2 more

CVE-2015-8550

xen: paravirtualized drivers incautious about shared memory contents (XSA-155)

Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability.

CVSS 3.0 · 8.2 High EPSS 1.1% KEV · Not listed

Vendors

Novell Xen

Products

Suse Linux Enterprise Real Time Extension Xen

CVE-2015-8341

xen: libxl leak of PV kernel can cause OOM condition

The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.

CVSS 2.0 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2015-8340

xen: XENMEM_exchange error handling may cause DoS to host

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling.

CVSS 3.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2015-8339

xen: XENMEM_exchange error handling may cause DoS to host

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.

CVSS 3.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2015-8338

xen: Long running memory operations on ARM cause DoS

Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.

CVSS 3.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2015-7972

xen: populate-on-demand balloon size inaccuracy can crash guests on x86

The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through 4.6.x do not properly calculate the balloon size when using the populate-on-demand (PoD) system, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors related to "heavy memory pressure."

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2015-7971

xen: Some pmu and profiling hypercalls log without rate limiting on x86

Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen