CVE-2016-9379

xen: delimiter injection vulnerabilities in pygrub (XSA-198)

The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.

CVSS 3.0 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9377

xen: x86 software interrupt injection mis-handled (XSA-196)

Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9380

xen: delimiter injection vulnerabilities in pygrub (XSA-198)

The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.

CVSS 3.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9816

xen: ARM guests may induce host asynchronous abort (XSA-201)

Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at EL2.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9817

xen: ARM guests may induce host asynchronous abort (XSA-201)

Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving a (1) data or (2) prefetch abort with the ESR_EL2.EA bit set.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-10025

xen: x86: missing NULL pointer check in VMFUNC emulation (XSA-203)

VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-10024

xen: x86 PV guests may be able to mask interrupts (XSA-202)

Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations.

CVSS 3.0 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-10013

xen: x86: Mishandling of SYSCALL singlestep during emulation (XSA-204)

Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-8905

xen: possible memory corruption via failsafe callback (XSA-215)

Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-8903

xen: x86: 64bit PV guest breakout via pagetable use-after-mode-change (XSA-213)

Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-8904

xen: grant transfer allows PV guest to elevate privileges (XSA-214)

Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-214.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-17565

xen: improper bug check in x86 log-dirty handling (XSA-251)

An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P.

CVSS 3.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-17564

xen: improper x86 shadow mode refcount error handling (XSA-250)

An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-17566

xen: x86 PV guests may gain access to internally used pages (XSA-248)

An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-17046

xen: ARM: Some memory not scrubbed at boot (XSA-245)

An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest OS users to obtain sensitive information from DRAM after a reboot, because disjoint blocks, and physical addresses that do not start at zero, are mishandled.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-17045

xen: Missing p2m error checking in PoD code (XSA-247)

An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or cause a denial of service (BUG and host OS crash) by leveraging the mishandling of Populate on Demand (PoD) Physical-to-Machine (P2M) errors.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-17563

xen: broken x86 shadow mode refcount overflow check (XSA-249)

An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-7228

xen: x86: broken check in memory_exchange() permits PV guest breakout (XSA-212)

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

CVSS 3.0 · 8.2 High EPSS 1.6% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-15596

xen: add-to-physmap error paths fail to release lock on ARM

An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial of service (prevent physical CPU usage) because of lock mishandling upon detection of an add-to-physmap error.

CVSS 3.0 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2015-7504

Qemu: net: pcnet: heap overflow vulnerability in pcnet_receive

Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Qemu Redhat and 1 more

Products

Debian Linux Qemu Enterprise Linux and 2 more