CVE-2013-1952

kernel: xen: VT-d interrupt remapping source validation flaw for bridges

Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, does not properly check the source when accessing a bridge device's interrupt remapping table entries for MSI interrupts, which allows local guest domains to cause a denial of service (interrupt injection) via unspecified vectors.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2014-1666

xen: PHYSDEVOP_{prepare,release}_msix exposed to unprivileged guests

The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors.

CVSS 2.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2014-1642

xen: out-of-memory condition yielding memory corruption during IRQ setup

The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configured to support a large number of CPUs, frees certain memory that may still be intended for use, which allows local guest administrators to cause a denial of service (memory corruption and hypervisor crash) and possibly execute arbitrary code via vectors related to an out-of-memory error that triggers a (1) use-after-free or (2) double free.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-6400

xen: IOMMU TLB flushing may be inadvertently suppressed

Xen 4.2.x and 4.3.x, when using Intel VT-d and a PCI device has been assigned, does not clear the flag that suppresses IOMMU TLB flushes when unspecified errors occur, which causes the TLB entries to not be flushed and allows local guest administrators to cause a denial of service (host crash) or gain privileges via unspecified vectors.

CVSS 2.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-6375

xen: Insufficient TLB flushing in VT-d (iommu) code

Xen 4.2.x and 4.3.x, when using Intel VT-d for PCI passthrough, does not properly flush the TLB after clearing a present translation table entry, which allows local guest administrators to cause a denial of service or gain privileges via unspecified vectors related to an "inverted boolean parameter."

CVSS 2.0 · 7.9 High EPSS 1.4% KEV · Not listed

Vendors

Opensuse Xen

Products

Opensuse Xen

CVE-2013-4554

kernel: xen: hypercalls exposed to privilege rings 1 and 2 of HVM guests

Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2.

CVSS 2.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Xen

Products

Enterprise Linux Xen

CVE-2013-4553

kernel: xen: lock order reversal between page_alloc_lock and mm_rwlock

The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock).

CVSS 2.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-4551

xen: Host crash due to guest VMX instruction execution

Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, which allows local HVM guest users to cause a denial of service (host crash) via unspecified vectors related to "guest VMX instruction execution."

CVSS 2.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-4494

kernel: xen: Lock order reversal between page allocation and grant table locks

Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified vectors.

CVSS 2.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Redhat Xen

Products

Debian Linux Enterprise Linux Xen

CVE-2013-4416

xen: ocaml xenstored mishandles oversized message replies (XSA-72)

The Ocaml xenstored implementation (oxenstored) in Xen 4.1.x, 4.2.x, and 4.3.x allows local guest domains to cause a denial of service (domain shutdown) via a large message reply.

CVSS 2.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-4375

xen: qemu disk backend (qdisk) resource leak (XSA-71)

The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause a denial of service (domain grant reference consumption) via unspecified vectors.

CVSS 2.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Qemu Xen

Products

Qemu Xen

CVE-2013-4371

xen: use-after-free in libxl_list_cpupool under memory pressure (XSA-70)

Use-after-free vulnerability in the libxl_list_cpupool function in the libxl toolstack library in Xen 4.2.x and 4.3.x, when running "under memory pressure," returns the original pointer when the realloc function fails, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-4370

xen: misplaced free in ocaml xc_vcpu_getaffinity stub (XSA-69)

The ocaml binding for the xc_vcpu_getaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors that trigger a (1) use-after-free or (2) double free.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-4369

xen: possible null dereference when parsing vif ratelimiting info (XSA-68)

The xlu_vif_parse_rate function in the libxlu library in Xen 4.2.x and 4.3.x allows local users to cause a denial of service (NULL pointer dereference) by using the "@" character as the VIF rate configuration.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-4368

xen: information leak through outs instruction emulation (XSA-67)

The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Redhat Xen

Products

Enterprise Linux Xen

CVE-2013-4361

Kernel: Xen: Xsa-66: information leak through fbld instruction emulation

The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-4356

Kernel: Xen: Xsa-64: memory leak by 64bit PV guests under live migration

Xen 4.3.x writes hypervisor mappings to certain shadow pagetables when live migration is performed on hosts with more than 5TB of RAM, which allows local 64-bit PV guests to read or write to invalid memory and cause a denial of service (crash).

CVSS 2.0 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-4355

Kernel: Xen: Xsa-63: information leak via I/O instruction emulation

Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain hypervisor stack memory via a (1) port or (2) memory mapped I/O write or (3) other unspecified operations related to addresses without associated memory.

CVSS 2.0 · 1.5 Low EPSS < 1% KEV · Not listed

Vendors

Redhat Xen

Products

Enterprise Linux Xen

CVE-2013-4329

xen: libxl partially sets up HVM passthrough even with disabled iommu

The xenlight library (libxl) in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete, which allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction.

CVSS 2.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2013-3495

hw: virt: Intel VT-d Interrupt Remapping engines can be evaded by native NMI interrupts

The Intel VT-d Interrupt Remapping engine in Xen 3.3.x through 4.3.x allows local guests to cause a denial of service (kernel panic) via a malformed Message Signaled Interrupt (MSI) from a PCI device that is bus mastering capable that triggers a System Error Reporting (SERR) Non-Maskable Interrupt (NMI).

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Opensuse Xen

Products

Opensuse Xen