CVE-2017-10913

xen: Races in the grant table unmap code (XSA-218)

The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls, which allows backend attackers to obtain sensitive information or gain privileges, aka XSA-218 bug 1.

CVSS 3.0 · 9.8 Critical EPSS 2.8% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9932

xen: x86 CMPXCHG8B emulation fails to ignore operand size override (XSA-200)

CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix.

CVSS 3.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-10917

xen: NULL pointer deref in event channel poll (XSA-221)

Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) or possibly obtain sensitive information, aka XSA-221.

CVSS 3.0 · 9.1 Critical EPSS 2.6% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9815

xen: ARM guests may induce host asynchronous abort (XSA-201)

Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host panic) by sending an asynchronous abort.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9816

xen: ARM guests may induce host asynchronous abort (XSA-201)

Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at EL2.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9818

xen: ARM guests may induce host asynchronous abort (XSA-201)

Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at HYP.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-10918

xen: stale P2M mappings due to insufficient error checking (XSA-222)

Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obtain privileged host OS access, aka XSA-222.

CVSS 3.0 · 10.0 Critical EPSS 3.7% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9384

xen: guest 32-bit ELF symbol table load leaking host data (XSA-194)

Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9385

xen: x86 segment base write emulation lacking canonical address checks (XSA-193)

The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks.

CVSS 3.0 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9817

xen: ARM guests may induce host asynchronous abort (XSA-201)

Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving a (1) data or (2) prefetch abort with the ESR_EL2.EA bit set.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9379

xen: delimiter injection vulnerabilities in pygrub (XSA-198)

The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.

CVSS 3.0 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9380

xen: delimiter injection vulnerabilities in pygrub (XSA-198)

The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.

CVSS 3.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9386

xen: x86 null segments not always treated as unusable (XSA-191)

The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9377

xen: x86 software interrupt injection mis-handled (XSA-196)

Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9378

xen: x86 software interrupt injection mis-handled (XSA-196)

Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9382

xen: x86 task switch to VM86 mode mis-handled (XSA-192)

Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9383

xen: x86 64-bit bit test instruction emulation broken (XSA-195)

Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2017-10919

xen: ARM guest disabling interrupt may crash Xen (XSA-223)

Xen through 4.8.x mishandles virtual interrupt injection, which allows guest OS users to cause a denial of service (hypervisor crash), aka XSA-223.

CVSS 3.0 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-10025

xen: x86: missing NULL pointer check in VMFUNC emulation (XSA-203)

VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-10013

xen: x86: Mishandling of SYSCALL singlestep during emulation (XSA-204)

Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen