CVE-2016-6258

xen: x86: Privilege escalation in PV guests (XSA-182)

The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-6259

xen: x86: Missing SMAP whitelisting in 32-bit exception / event delivery (XSA-183)

Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check.

CVSS 3.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-7092

xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests

The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables.

CVSS 3.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-7093

xen: x86: Mishandling of instruction pointer truncation during emulation

Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation.

CVSS 3.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-7094

xen: x86 HVM: Overflow of sh_ctxt->seg_reg[]

Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update.

CVSS 3.0 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-7154

xen: use after free in FIFO event channel code

Use-after-free vulnerability in the FIFO event channel code in Xen 4.4.x allows local guest OS administrators to cause a denial of service (host crash) and possibly execute arbitrary code or obtain sensitive information via an invalid guest frame number.

CVSS 3.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-7777

xen: CR0.TS and CR0.EM not always honored for x86 HVM guests (XSA-190)

Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it.

CVSS 3.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-1920

kernel: xen: potential use of freed memory in event channel operations

Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running "under memory pressure" and the Xen Security Module (XSM) is enabled, uses the wrong ordering of operations when extending the per-domain event channel tracking table, which causes a use-after-free and allows local guest kernels to inject arbitrary events and gain privileges via unspecified vectors.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2014-1666

xen: PHYSDEVOP_{prepare,release}_msix exposed to unprivileged guests

The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors.

CVSS 2.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2014-1642

xen: out-of-memory condition yielding memory corruption during IRQ setup

The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configured to support a large number of CPUs, frees certain memory that may still be intended for use, which allows local guest administrators to cause a denial of service (memory corruption and hypervisor crash) and possibly execute arbitrary code via vectors related to an out-of-memory error that triggers a (1) use-after-free or (2) double free.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-6400

xen: IOMMU TLB flushing may be inadvertently suppressed

Xen 4.2.x and 4.3.x, when using Intel VT-d and a PCI device has been assigned, does not clear the flag that suppresses IOMMU TLB flushes when unspecified errors occur, which causes the TLB entries to not be flushed and allows local guest administrators to cause a denial of service (host crash) or gain privileges via unspecified vectors.

CVSS 2.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-6375

xen: Insufficient TLB flushing in VT-d (iommu) code

Xen 4.2.x and 4.3.x, when using Intel VT-d for PCI passthrough, does not properly flush the TLB after clearing a present translation table entry, which allows local guest administrators to cause a denial of service or gain privileges via unspecified vectors related to an "inverted boolean parameter."

CVSS 2.0 · 7.9 High EPSS 1.4% KEV · Not listed

Vendors

Opensuse Xen

Products

Opensuse Xen

CVE-2013-4554

kernel: xen: hypercalls exposed to privilege rings 1 and 2 of HVM guests

Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2.

CVSS 2.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Xen

Products

Enterprise Linux Xen

CVE-2013-4553

kernel: xen: lock order reversal between page_alloc_lock and mm_rwlock

The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock).

CVSS 2.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-4551

xen: Host crash due to guest VMX instruction execution

Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, which allows local HVM guest users to cause a denial of service (host crash) via unspecified vectors related to "guest VMX instruction execution."

CVSS 2.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-4494

kernel: xen: Lock order reversal between page allocation and grant table locks

Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified vectors.

CVSS 2.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Redhat Xen

Products

Debian Linux Enterprise Linux Xen

CVE-2013-4416

xen: ocaml xenstored mishandles oversized message replies (XSA-72)

The Ocaml xenstored implementation (oxenstored) in Xen 4.1.x, 4.2.x, and 4.3.x allows local guest domains to cause a denial of service (domain shutdown) via a large message reply.

CVSS 2.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-4375

xen: qemu disk backend (qdisk) resource leak (XSA-71)

The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause a denial of service (domain grant reference consumption) via unspecified vectors.

CVSS 2.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Qemu Xen

Products

Qemu Xen

CVE-2013-4371

xen: use-after-free in libxl_list_cpupool under memory pressure (XSA-70)

Use-after-free vulnerability in the libxl_list_cpupool function in the libxl toolstack library in Xen 4.2.x and 4.3.x, when running "under memory pressure," returns the original pointer when the realloc function fails, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-4370

xen: misplaced free in ocaml xc_vcpu_getaffinity stub (XSA-69)

The ocaml binding for the xc_vcpu_getaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors that trigger a (1) use-after-free or (2) double free.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen