CVE-2016-9378

xen: x86 software interrupt injection mis-handled (XSA-196)

Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9386

xen: x86 null segments not always treated as unusable (XSA-191)

The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9383

xen: x86 64-bit bit test instruction emulation broken (XSA-195)

Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2017-10920

xen: grant table operations mishandle reference counts (XSA-224)

The grant-table feature in Xen through 4.8.x mishandles a GNTMAP_device_map and GNTMAP_host_map mapping, when followed by only a GNTMAP_host_map unmapping, which allows guest OS users to cause a denial of service (count mismanagement and memory corruption) or obtain privileged host OS access, aka XSA-224 bug 1.

CVSS 3.0 · 10.0 Critical EPSS 2.5% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9377

xen: x86 software interrupt injection mis-handled (XSA-196)

Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9384

xen: guest 32-bit ELF symbol table load leaking host data (XSA-194)

Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-10025

xen: x86: missing NULL pointer check in VMFUNC emulation (XSA-203)

VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-10013

xen: x86: Mishandling of SYSCALL singlestep during emulation (XSA-204)

Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-10024

xen: x86 PV guests may be able to mask interrupts (XSA-202)

Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations.

CVSS 3.0 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2017-8905

xen: possible memory corruption via failsafe callback (XSA-215)

Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2015-7504

Qemu: net: pcnet: heap overflow vulnerability in pcnet_receive

Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Qemu Redhat and 1 more

Products

Debian Linux Qemu Enterprise Linux and 2 more

CVE-2017-8903

xen: x86: 64bit PV guest breakout via pagetable use-after-mode-change (XSA-213)

Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-8904

xen: grant transfer allows PV guest to elevate privileges (XSA-214)

Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-214.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-17566

xen: x86 PV guests may gain access to internally used pages (XSA-248)

An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-17565

xen: improper bug check in x86 log-dirty handling (XSA-251)

An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P.

CVSS 3.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-7228

xen: x86: broken check in memory_exchange() permits PV guest breakout (XSA-212)

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

CVSS 3.0 · 8.2 High EPSS 1.6% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-17563

xen: broken x86 shadow mode refcount overflow check (XSA-249)

An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-17564

xen: improper x86 shadow mode refcount error handling (XSA-250)

An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-7995

xen: Checks access permissions to MMIO ranges only after accessing them

Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the get_user function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL.

CVSS 3.0 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Novell Suse Xen

Products

Suse Linux Enterprise Point Of Sale Suse Linux Enterprise Server Manager and 3 more

CVE-2017-15597

xen: pin count / page reference race in grant table code (XSA-236)

An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin would be accompanied by a suitable page reference. Other portions of code, however, did not match up with that assumption. When such a grant copy operation is being done on a grant of a dying domain, the assumption turns out wrong. A malicious guest administrator can cause hypervisor memory corruption, most likely resulting in host crash and a Denial of Service. Privilege escalation and information leaks cannot be ruled out.

CVSS 3.0 · 9.1 Critical EPSS 2.8% KEV · Not listed

Vendors

Xen

Products

Xen