CVE-2017-12134

xen: linux: Fix Xen block IO merge-ability calculation (XSA-229)

The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability calculation.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9932

xen: x86 CMPXCHG8B emulation fails to ignore operand size override (XSA-200)

CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix.

CVSS 3.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-15593

xen: page type reference leak on x86 (XSA-242)

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (memory leak) because reference counts are mishandled.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-10912

xen: page transfer may allow PV guest to elevate privilege (XSA-217)

Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217.

CVSS 3.0 · 10.0 Critical EPSS 2.7% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2017-10917

xen: NULL pointer deref in event channel poll (XSA-221)

Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) or possibly obtain sensitive information, aka XSA-221.

CVSS 3.0 · 9.1 Critical EPSS 2.6% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9384

xen: guest 32-bit ELF symbol table load leaking host data (XSA-194)

Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9383

xen: x86 64-bit bit test instruction emulation broken (XSA-195)

Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9385

xen: x86 segment base write emulation lacking canonical address checks (XSA-193)

The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks.

CVSS 3.0 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9380

xen: delimiter injection vulnerabilities in pygrub (XSA-198)

The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.

CVSS 3.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9379

xen: delimiter injection vulnerabilities in pygrub (XSA-198)

The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.

CVSS 3.0 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9382

xen: x86 task switch to VM86 mode mis-handled (XSA-192)

Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9818

xen: ARM guests may induce host asynchronous abort (XSA-201)

Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at HYP.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9377

xen: x86 software interrupt injection mis-handled (XSA-196)

Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9378

xen: x86 software interrupt injection mis-handled (XSA-196)

Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9386

xen: x86 null segments not always treated as unusable (XSA-191)

The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9815

xen: ARM guests may induce host asynchronous abort (XSA-201)

Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host panic) by sending an asynchronous abort.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9816

xen: ARM guests may induce host asynchronous abort (XSA-201)

Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at EL2.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-10024

xen: x86 PV guests may be able to mask interrupts (XSA-202)

Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations.

CVSS 3.0 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-10025

xen: x86: missing NULL pointer check in VMFUNC emulation (XSA-203)

VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-10013

xen: x86: Mishandling of SYSCALL singlestep during emulation (XSA-204)

Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen